Privacy policy

Rocket Science B.V. is responsible

xFreelance is a service of Rocket Science B.V. For your account, your cv and share links, email, hosting and server logs, and analytics, Rocket Science B.V. is the controller within the meaning of the General Data Protection Regulation (GDPR).

Questions about privacy: email@rocketsciencebv.nl

For the data you enter about your clients, projects and hours, and for your clients' decisions on your timesheets, you, the freelancer, are the controller. You decide which client data you enter and whom you ask for approval.

Rocket Science B.V. processes that data on your behalf, as a processor. The arrangements for this will be set out in a data processing agreement with the terms of service, which we have yet to publish.

Your account: only what is needed to sign in and work

For your account we store:

• your name, your email address and your password (as a hash only, never readable);
• your preferred language, your profile photo and your onboarding answers;
• your company details (company name, Chamber of Commerce number, VAT number and RSIN) and your invoice details;
• your sessions, with IP address and browser, to keep you signed in and to secure your account.

The legal basis is our agreement with you (Article 6(1)(b) GDPR): without this data we cannot provide xFreelance.

For your last sign-in we store the time and the IP address, to secure your account and to prevent abuse. We keep only the latest one: every new sign-in overwrites it. The legal basis is our legitimate interest in a secure service (Article 6(1)(f) GDPR).

We keep the data as long as your account exists. To have your account deleted, email email@rocketsciencebv.nl. We then delete your data within one month, except what the law requires us to keep. Your cv, templates, share links, clients, projects, hours and timesheets are deleted with your account.

Your cv and share links: visible only to those who have the link

We store your base cv, your templates, your photos and the logos of your employers.

When you create a share link, anyone with that link can view the chosen template and download it as a pdf. This works until you revoke the link or it expires.

We count how often a link was viewed and downloaded. We store nothing about who is viewing.

When you email a link from xFreelance, we use the recipient's email address only to send that email. We do not store it. We do keep track of how many emails you send per day, to prevent abuse.

Your clients, projects and hours: you are responsible for them

You enter data about your clients: a company or a person, a contact person, address, phone numbers, email address, websites, Chamber of Commerce number and VAT number. You also record your projects and hours.

For this data you are the controller and Rocket Science B.V. is the processor. The legal basis is yours: usually the performance of your contract with the client, or your legitimate interest in keeping proper records.

xFreelance uses this data only to provide the service to you. It is kept until you delete it or delete your account.

Timesheets you share with a client: evidence of the approval

When you share a timesheet, we store the recipient's name and email address with that timesheet, and your message if you add one.

When the recipient approves the hours or requests changes, we store as evidence:

• the name and email address entered;
• the signature (drawn or typed);
• the reason, if one was given;
• a snapshot of the hours, with a checksum (hash);
• the IP address, the browser (user agent) and the time.

When you, the freelancer, approve on your client's behalf, we store:

• your own name and email address as the signer;
• the name and email address of the client's contact on whose behalf you approve;
• your note, if you add one;
• the snapshot of the hours, your IP address, your browser and the time.

This makes it possible to prove later what was approved, by whom and when.

Here too the freelancer is the controller, and Rocket Science B.V. processes the data on their behalf. The legal basis is the freelancer's legitimate interest (Article 6(1)(f) GDPR) in a reliable approval of their hours. If you are a recipient and have questions, ask the freelancer or email email@rocketsciencebv.nl. We will forward your question.

The data is kept with the timesheet as long as the freelancer's account exists. The freelancer never sees IP addresses. The pages for recipients set no analytics cookies and no marketing cookies.

We send email through Resend

Emails that are part of using xFreelance are sent through Resend: the activation of your account, resetting your password, share links for your cv, timesheets (sharing, decisions, receipts and reopening) and the confirmation that an account was deleted.

Resend, Inc. in the United States processes these emails as a processor. The transfer to the United States is covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

We do not send newsletters.

Hosting at Hetzner

The servers and the database of xFreelance run at Hetzner Online GmbH in Germany (Falkenstein data centre). Photos and logos are kept in Hetzner's object storage.

With every request the server records your IP address, the time and the page requested. We keep these server logs only briefly, for security and to resolve outages, and they are then deleted. The legal basis is our legitimate interest in a secure service (Article 6(1)(f) GDPR).

Google Analytics only with your consent

Without your consent nothing goes to Google. Google Tag Manager and Google Analytics load only after you allow analytics cookies, and until then we do not send anonymous measurements either.

With your consent Google Analytics 4 measures:

• which pages and features you use, such as signing up, editing your cv, sharing a link or logging hours;
• how fast pages load and respond (Core Web Vitals).

Google never receives your name, your email address, the content of your cv, clients or hours, tokens from links, the numbers of your own records (such as clients, projects or timesheets) or the links to other sites you click. Only the number of a public job you open on the job board is sent. We never measure the pages for recipients of a cv or timesheet.

Google Analytics is set up to collect as little as possible:

• Google Ireland Limited processes the data as a processor, under Google's data processing terms (Google Ads Data Processing Terms);
• transfers to the United States are covered by the EU-US Data Privacy Framework;
• Google Analytics 4 does not log or store IP addresses;
• Google signals is off, and data sharing with Google is off, except for technical support;
• granular location and device data collection is off;
• user-level and event-level data is deleted after 14 months;
• visits from the administrator's own devices are not counted.

The legal basis is your consent (Article 6(1)(a) GDPR). You can change or withdraw your choice at any time via "Cookie settings" at the bottom of the page or in the account menu. When you withdraw your consent, we delete the _ga cookies straight away. Processing before that remains lawful.

These are the cookies and storage we use

The _ga cookies are set only if you allow analytics cookies. On https the sign-in cookie is called __Secure-xfreelance.session_token. In addition, xf_internal is kept in a cookie or in local storage, but only on the administrator's devices, so their own visits are not counted.

Every processing has a legal basis

• Our agreement with you (Article 6(1)(b) GDPR) for your account, your cv and share links and the emails that come with them.
• Legitimate interest (Article 6(1)(f) GDPR) for the server logs, your last sign-in and, on the freelancer's behalf, for the evidence on timesheets.
• Consent (Article 6(1)(a) GDPR) for Google Analytics.

Necessary cookies, such as your sign-in and your cookie choice, need no consent. We use no automated decision-making or profiling with legal or similarly significant effects for you (Article 22 GDPR).

Your rights

You have the right to access, correct and delete your data. You can also ask for the processing to be restricted and for your data to be transferred (data portability). You can object to processing based on legitimate interest (Article 21 GDPR).

You withdraw your consent for analytics via "Cookie settings". For the other rights, email email@rocketsciencebv.nl, and you will receive an answer within one month.

If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

Changes are published here, with a date

When this policy changes, the new date appears at the top of this page. When a new cookie or a new service that receives data is added, the policy also gets a new version number and we ask everyone for consent again.