The short version.

Innova9 builds software for JD Edwards. Our website (innova9.io) collects only the bare minimum needed to run it and answer your inquiry. Our products — Flow9, Hub9 and Claw9 — are designed to run inside your environment against your JDE and your locally-hosted LLM. We do not see your JDE data, and we do not want to.

Plain English: if you visit our website, we know you visited. If you submit our contact form, we know what you wrote. If you run our products, we don’t see what’s inside your JD Edwards.

Who this applies to.

This Privacy Policy applies to Innova9, Inc. (“Innova9,” “we,” “us”) and:

  • Visitors to innova9.io and any sub-domains.
  • People who submit our contact, demo, support or partner forms.
  • Customers and prospects who exchange email or other communications with us.

It does not govern the data that flows through Flow9, Hub9 or Claw9 when deployed inside your environment. That data is yours; your own privacy policy and data processing agreements govern it.

What we collect.

From the website

  • Standard server logs: IP address, user-agent, referring page, timestamp.
  • Anonymous, aggregated visit counts (no third-party advertising trackers).

From forms you submit

  • Name, work email and company.
  • Which product(s) you’re interested in.
  • The free-text message or use case you write.

From communications

  • Email content and metadata when you write to us at contact@innova9.io, support@innova9.io, privacy@innova9.io or related addresses.

We do not collect: payment card numbers (we don’t process payments through the website), government IDs, biometric data, precise geolocation, or special-category personal data as defined by GDPR Art. 9.

How we use it.

We use the personal information described above strictly to:

  • Respond to the inquiry, demo request, or support question you sent.
  • Send a small number of follow-ups that are relevant to that conversation.
  • Keep the website running, secure and free of abuse.
  • Comply with legal obligations (e.g. tax, accounting, lawful requests).

We do not sell personal information. We do not use it to train AI models. We do not share it with advertising networks.

Your JD Edwards data.

Flow9, Hub9 and Claw9 are designed to deploy on-premises or inside your private cloud. They speak Orchestrator and AIS REST inside your perimeter. When you run them:

  • Your JDE data stays inside your network.
  • Your authentication tokens (issued via /jderest/v2/tokenrequest) stay inside your vault.
  • Innova9 does not receive copies of your F-tables, business views, attachments or prompts.

The only exceptions are (a) diagnostic information you choose to share with us during a support case, and (b) any optional, opt-in anonymous usage metrics — off by default, configurable per environment, and never including business data.

Local AI and LLMs.

Innova9 was built to run against locally-hosted language models. We do not pipe your prompts, completions or JDE context to OpenAI, Anthropic, Google or any third-party AI provider. The product runs against the model you host (Llama, Mistral, Qwen, or another open-weight model of your choice) on the hardware you control.

This is not a feature flag. It is the architectural default of every product we ship.

Who we share with.

We share personal information only with a short list of vetted sub-processors, and only as needed to operate the website and respond to you:

  • Email forwarding — for delivering form submissions to our inbox.
  • Email hosting — the mailbox at innova9.io that receives your message.
  • Cloudflare — for DNS, edge tunneling and DDoS protection.
  • Hosting — the server farm that serves innova9.io.

We do not share personal data with marketing platforms, advertising networks or data brokers. A current sub-processor list is available on request to privacy@innova9.io.

How long we keep it.

  • Form submissions: retained as long as the conversation is active, plus up to 36 months after the last contact, then deleted or anonymized.
  • Server logs: 90 days, then rotated.
  • Customer records: for the duration of the commercial relationship plus the period required by tax and accounting law (typically 7 years).

How we protect it.

We follow the practices you’d expect for a JDE-adjacent vendor: TLS in transit, encryption at rest where supported by the underlying store, principle-of-least-privilege access control, audit logging on internal admin actions, and periodic credential rotation. Production data never crosses an unencrypted channel.

If we ever experience a breach affecting your personal data, we will notify you and, where applicable, the relevant supervisory authority within the time frames required by law.

Your rights.

Depending on where you live, you may have the right to access, correct, port, delete or restrict processing of your personal data, and to object to it being used for direct marketing. To exercise any of these rights, write to privacy@innova9.io. We will respond within 30 days.

If you are in the European Economic Area, the UK or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

Changes to this policy.

We will update the “Effective” date above when we make material changes. For substantive updates that affect how we use personal data, we will give reasonable notice — typically via the email on file or a banner on the website.