Privacy Policy

Last updated: 14 October 2026

This policy explains how Hojt Communication AB, organisation number 559017-1459, registered in Sweden (“Adamiro“, “we“, “us“) processes personal data when you visit our website at adamiro.com, use the Adamiro service, contact us, or interact with our marketing.

1. Who is the controller

For personal data we collect about you as a website visitor, account holder, prospect, or contact person at a customer organisation, Hojt Communication AB is the data controller.

For personal data you submit through the Service about other people (your colleagues, contacts, prospects, or end users), you are the controller and we are the processor. That relationship is governed by the Data Processing Addendum, which forms part of these Terms.

2. Scope

This policy covers personal data we process as controller, including:

• Visitors to adamiro.com and adam.hojt.se (staging).
• People who fill in forms, sign up for a free trial, or subscribe.
• Account holders and seat-level users on customer accounts.
• Contact persons at prospects, suppliers, and partners.
• People who email or call us.
• People who comment on, mention or send a direct message to Adamiro’s own Instagram account, @adam.adamiro.
• Job applicants who contact us via the website.

Where customers process personal data of third parties through the Service (for example, contacts referenced in Mentor / The Tank conversations, or people named in content created with Voice and published with Reach), we act as a processor on the customer’s behalf and the DPA governs that processing.

3. What personal data we process, why, and on what lawful basis

The table below lists each processing activity. “Lawful basis” refers to GDPR Art. 6(1) letters (a) consent, (b) contract, (c) legal obligation, (d) vital interests, (e) public task, (f) legitimate interest. Where we rely on legitimate interest, we have carried out a documented Legitimate Interest Assessment (LIA) and the assessed interests are summarised in the Why column.

3.1 Visitors to our website

We do not store the business idea you describe on that page. The offer text you type, any site text we read, and the board’s answer are processed only in the memory of your request — never written to a database, an option, a log file, or any other form of storage. The single exception is the report itself: emailing it to the address you give us is the one copy that leaves our systems, sent to you at your own request. That is a materially different promise from a normal contact form, where we do keep what you submitted — see the “Form submissions” row above.

The link in that report carries a signed reference to your lead record rather than your email address, so asking us to delete the record also breaks the link. Delete requests for this page are therefore satisfied by removing the lead row and, if you ticked the marketing box, the follow-up record and the marketing-list entry described below; there is no other copy.

The same promise covers Sounds Like Them. The two website addresses you paste there, the text we read from either page, and the three sentence pairs the tool shows you are processed only in the memory of your request, never written to a database, an option, a log file, or any other form of storage. The single exception is the emailed diagnosis: sending it to the address you give us is the one copy that leaves our systems. As with The First Round, the link in that email carries a signed reference to your lead record rather than your email address, so a deletion request removes the lead row and breaks the link at the same time. If you ticked the marketing box it also removes the follow-up record and the marketing-list entry described below.

If you later open an Adamiro account. Deleting that account removes your lead record from The First Round and from Sounds Like Them too. It does not remove the follow-up record or the marketing-list entry. Use the unsubscribe link or write to us for those.

If you tick the marketing box on either tool. We keep a second record holding your email address, which tool you used, the language you used it in, and where you are in a series of three follow-up emails. We send those emails ourselves over about nine days. They are about the subject of the tool you used, and they stop when the series ends, when you unsubscribe, or when you open an Adamiro account. Every one of them carries an unsubscribe link. The link opens a page with one button, and pressing it stops the series, clears the marketing choice on your lead record, and unsubscribes you from our marketing list at Mailjet.

Your entry on that marketing list carries four labels besides your email address: the tool you came from, the topic it is about, your language, and whether you are a lead or a customer. We use them to send you emails that match what you asked about and to stop sending trial offers to people who already have an account. Your name is not sent. The lawful basis is your consent (Art. 6(1)(a)), and you can withdraw it at any time with the unsubscribe link or by emailing us.

If you ask for a document. The documents at adamiro.com/downloads open once you confirm a subscription to Adamiro Signals. When you ask for one, we store your email address with each step: the request, the confirmation, the unlock and every download. Each of those records also holds the time and a hashed version of your IP address, never the address itself. We keep these records for 24 months, after which they are deleted automatically, and we delete them with the rest of your data if you ask us to.

Everyone who asks for a document gets a few follow-up emails about it, over about nine days. The form and the confirmation email say so before you confirm. Each follow-up carries an unsubscribe link. It stops those emails and leaves your Adamiro Signals subscription as it is; every briefing has its own unsubscribe link for that. We send the series once per address, and not at all to an address that already has an Adamiro account. The lawful basis for the follow-up emails is your consent (Art. 6(1)(a)), given when you confirm after the form and the confirmation email have told you about them, and you can withdraw it at any time with the unsubscribe link or by emailing us.

3.2 Account holders and customer users

Confidential by default. Adamiro keeps your name, email, company, phone, and address out of anything a service generates or sends unless you opt that service in under Account → Privacy. Your Mentor and The Tank conversations are treated as confidential: they are not reused in other services unless you turn that on yourself, and they are never used to train a model without your written consent. See section 3.4 for model training and the Terms of Service section 13 for conversation confidentiality.

You decide how long conversations are kept. Under Account → Privacy you can set a retention window for your Mentor and The Tank transcripts — keep them until you delete them, or have Adamiro remove them automatically after 30, 90, 180, or 365 days (a daily job enforces your choice). The default is 365 days. You can also delete every transcript immediately with one click. Whichever way a conversation goes, the whole stored conversation is removed, not only the entry in your list. Anything you deliberately saved to Memories is kept until you remove it there, and removing it deletes it for good, including the copy our search uses. Retention covers raw conversation logs, not the knowledge you chose to keep.

Transferring an account to someone else. When an account owner transfers the account (Account → Transfer ownership), the content stores listed under Usage and Service data move to the new owner’s login; your consent records, sign-in history and security settings stay with you. The email address the owner invites is kept on the transfer record for 90 days after the transfer completes, is cancelled or expires, then removed. If the old login is erased as part of the transfer, it is deleted the same way as any deleted account (see “When your account is deleted” below), with one difference: the account’s files stay with the account for its new owner. Today that includes any files of yours that sat in the same folder and that you chose not to hand over. They are kept for as long as the new owner’s account exists and are deleted with it. Write to us if you want them removed sooner.

When your account is deleted. You cannot close or delete your account from the dashboard today. Write to privacy@adamiro.com and we do it for you. We do it in two steps. We close the account first, and we erase it after a waiting period.

Closing. When we close an account, its paid plan is stopped with our payment provider at once and the saved card is removed, so no further payment is taken. Nothing is refunded automatically. If you are owed a refund, say so when you write to us. If the payment provider cannot be reached, the account is not closed until it can.

A closed account does nothing. No scheduled post is published, no scheduled briefing or check runs, and nothing in it can be changed. Co-Editors lose access, and the account leaves the account list. If you sign in with that account’s own login, you can no longer sign in. If it is an additional account under a login you also use for other accounts, the login keeps working for those. We send the owner one email that confirms the closure and names the date the account will be erased.

The waiting period. A closed account waits 30 days. Nothing in it is deleted during that time, and you can ask us to reopen it. A reopened account gets its content back as it was. It does not get its paid plan back: you choose a plan again.

Erasing. We erase a closed account on its erase date or within 7 days after it. If you do not want to wait, tell us in writing and we erase it before the date. An erased account cannot be brought back.

If the account has paid us. An account that has made a payment to us, including one that was later refunded, is not erased on its erase date. It stays closed, and is never billed again, until you ask us in writing to erase it. We ask you this when we close the account. Before we erase it, we tell you what that means for the records of your purchases.

A hold. We can put an erase date on hold, for example while a question about the account is open. We tell you when we do, and why. An account on hold stays closed and is not erased until we release the hold.

Client workspaces of an agency. A client workspace follows a different clock. When an agency archives a client workspace, the agency can restore it for 7 days. After that the workspace is closed, and a closed client workspace cannot be reopened. It is erased 90 days after it closed, on that date or within 7 days after it.

A login that does not own an account. A login that owns no account, for example a Co-Editor’s, is deleted either at once or 30 days after we lock it. We tell you which of the two applies to you. A locked login cannot sign in, and we can restore it during the 30 days if the request was a mistake. A restored login gets its data and its Task balance back but not its paid plan.

Erased from our database with the account: your Voice drafts, voice profile and writing samples; your Signals setup and Buyers research; your Radar briefings and the search index built from them; your AI Visibility prompts, answers and history; your campaign plans; your Reach posts, their numbers and your connected social accounts; your Mentor and The Tank conversations and what they stored about you; your Memory; your notifications; your run history; your two-step sign-in settings; your privacy choices with their consent record; and the account itself, with its name, member list and history of changes. Scheduled briefings and checks are cancelled. Your lead record from The First Round or Sounds Like Them, if you used either with the same email address before you signed up, is deleted too. If the erased account was an additional account, your login is kept for your other accounts, and what belongs to the login and not to the account stays with it, such as your two-step sign-in settings.

Your files are deleted in the same step. That covers the images, carousels, PDFs and infographics you uploaded or that Adamiro made for you, your brand assets such as logos and an uploaded font, and your profile picture. Some copies are not removed by this step. A file that a colleague in the same account still uses in a post, in their library or as a logo is kept for them. Files in a Team account stay with the account (see Team accounts and Co-Editors below). Copies in backups stay until each backup is deleted (section 11). We also cannot recall a copy that LinkedIn or Instagram collected when you published, or one already saved in somebody’s browser. Posts you published stay on those platforms until you delete them there.

If you ask us to reset your account instead, which empties it and keeps your login, the same work and files are deleted. Your profile picture, your sign-in settings and your privacy choices are kept.

Team accounts and Co-Editors. What belongs to the company stays with the company. If a Co-Editor is removed, or their own login is deleted, their drafts and posts in that account move to the account owner first in most cases, together with the files they made there. Anything they approved or taught stays in place without their name on it. Tasks they spent stay in the account’s Task ledger, shown as “Removed member”. If you work in someone else’s account and your own login is deleted, you are taken out of that account first, and what you made there stays with its owner. When an account is closed and then erased, the whole account goes, including what its Co-Editors made in it and the files they left, with the one exception named under “Co-Editors when an account is closed and erased” below. If an account is handed to a new owner, its files stay with the account and are deleted when the new owner’s account is deleted.

Co-Editors when an account is closed and erased. Co-Editors lose access on the day the account is closed. Nothing of theirs is deleted during the waiting period, so a reopened account gives them their access and their work back. When the account is erased, what happens to a Co-Editor depends on how they were added to it:

• Most Co-Editors work through a seat that exists only for that account. The seat and the work made with it are erased with the account. The Co-Editor’s own login is not deleted by this. Write to us if you want it deleted too.
• A Co-Editor who works in the account under their own login, and has no plan of their own, is taken out of the account, and what they made there is erased with it. Their login is kept if they have another account or work in another one. If they do not, the login is locked and deleted 30 days later, and we can restore it during those 30 days.
• A Co-Editor who works in the account under their own login and has a plan of their own is only taken out of the account. What they made there stays with them under their own login. Adamiro cannot tell it apart from their own work, so it is not erased with the account.

Write to us if you want to know which of the three applies to you.

What we keep after a deletion, and for how long.

• The sign-in log (times, IP address, device fingerprint): 12 months.
• Abuse incidents: up to 24 months.
• The redacted Adam activity log: until its 60 days have run out.
• The record of a change to a model-training consent (section 3.4), if you ever gave one: seven years after your account ends. No customer has given such a consent so far.
• Two bookkeeping records, which we keep for seven years: that an account was handed from one owner to another, and that an agency pays for a client workspace. They hold account and user numbers, dates and the payment provider’s reference. When a closed account is erased, every name and email address on its two records is removed in the same step, and so are the user numbers on the agency record. On a handover record the numbers stay but point at nobody once the logins are gone. For a handover that is not part of an erased account, the invited email address is removed 90 days after the handover ended.
• A receipt of the erase, with no name and no address. It holds the account’s number and its owner’s number, which point at nobody once the account is gone, the kind of account, the dates it was closed and erased, counts of what was removed, whether it was erased on request, whether it had paid us, and the number of the administrator who did it. We keep the newest 200 receipts.
• Invoices and payment history, which our payment provider Stripe holds (see the Billing data row above).
• Cookie choices you made on the website: 24 months (section 8). That log never held your name or email.
• Files a colleague still uses, and files that stay with a Team account (see above).
• Copies in backups, for as long as section 11 says.

Your presence marker, and when it is deleted. So that our team can see who is using the dashboard at any moment, we store one marker per person: the time you were last active, and the name of the screen you were on. Every visit overwrites the previous one. It is not a history. It cannot tell us where you were an hour ago, and there is no page-by-page trail behind it.

A job runs every hour and deletes both parts of any marker older than 24 hours. Nothing in the Service reads one that old. A closed or suspended account stops generating activity, so whatever else happens to the account, your marker is gone within 24 hours of the last time you used the dashboard. Deleting the account outright, or resetting its data at your request, removes the marker as part of that wipe instead of waiting for the hourly job. A copy may remain in backups for as long as section 11 says.

3.3 People you contact through the Service (third parties)

When you use any feature where you submit data about real people — for example, people referenced in Mentor documents, The Tank sessions, or content you publish — you are the controller. The DPA governs that processing. We do not use those individuals’ data for our own purposes beyond delivering the Service to you.

3.4 Model training

We do not train on your data. Nothing you type into Adamiro, and nothing Adamiro generates for you, is used to train, fine-tune, or evaluate a machine-learning model unless you have given us explicit written consent for that use. No consent, no training. The rule covers our own models and every AI provider we send your data to.

We do not bundle this consent into the Terms, and we do not make it a condition of using the Service or of any price you are offered. Silence is not a yes. If you have not signed something that says otherwise, the answer on your account is no.

The AI providers we use may not train on your data either. Your prompts and the results pass through the language-model providers listed in section 9, because that is how the Service produces a result. Each of them is contractually barred from using your Input or Output to train or improve its own models. We run on their business API terms, where training on submitted content is excluded, and we hold a data-processing agreement with each provider. Your data does not go through a consumer AI product, where submitted content is often training data by default. If a provider changes its terms so that customer traffic could be used for training, we will get that removed in writing or stop using the provider, and we will tell you before the change takes effect (section 14).

If you do give written consent, this is what it covers:

Nothing is being captured today. No consent has been collected from anyone, the capture step is switched off in code, and the corpus is empty.

3.5 Connected social accounts (Reach publishing)

When you connect a social account to Reach so you can publish the content you create in Adamiro (for example, your own Instagram Business account connected via Facebook Login, or your LinkedIn account), we process the following:

We use these permissions only to (a) list the accounts you manage so you can choose where to publish, (b) publish the single image or multi-image carousel you composed, to your own account, when you click “Post now”, and (c) read engagement on the posts you published through Adamiro. We never post without an explicit action by you, never publish to a shared or Adamiro-owned account, and never use this data for advertising or model training.

We read other people’s content in one case only, and you start it. When you press Check for replies on a post you published to a Company Page you manage, we read and store the comments on that post: the text, the time and the commenter’s LinkedIn identifier, never a name. Those comments are deleted with the post or with your account.

Disconnecting and deleting this data. You can remove a connected account at any time, and there are three ways the stored data is deleted:

• In-app — click Disconnect in Reach → Connections. The access token and connected-account details are deleted immediately.
• From the platform — if you remove Adamiro from your Facebook or Instagram settings, the platform notifies us and we delete your stored token and account details automatically.
• By request — email privacy@adamiro.com, or use the platform’s data-deletion request flow; we delete the data and provide a confirmation you can check.

Disconnecting removes the connection only. The posts you published through Adamiro, and their numbers, stay in your account until you delete the post or the account.

The public copy made for Instagram. Instagram collects an image from a web address, so when you publish an image to Instagram we place a copy of it at a public address on our server. The address is long and is not listed anywhere, and anyone who has it can open the copy while it exists. We delete the copy within eight days, and at once if your account is deleted sooner.

Meta Platforms Ireland Ltd. and LinkedIn Ireland Unlimited Company are the operators of the platforms you publish to; when you publish, your content is sent to your own account on their platform under their respective privacy policies. They act as independent controllers for the account you hold with them, not as our sub-processors.

3.6 Adamiro’s own Instagram account (@adam.adamiro)

Adam, Adamiro’s AI assistant, runs our own Instagram account, @adam.adamiro. Adam drafts posts and replies, and a person at Adamiro reads and approves every one before it is published or sent. When you comment on, mention or message that account, we process the following:

Google’s Gemini model, one of our sub-processors (section 9), reads the text to sort it and to draft a reply. We never use this data for advertising or model training. Instagram is run by Meta, which processes what you post and send there as an independent controller under its own privacy policy. You can ask us to delete your data at any time (section 15).

4. Where we get personal data

We receive personal data from:

• You directly — when you sign up, fill in a form, send us an email, or use the Service.
• Your colleagues — when an account owner adds you as a seat or shares a workspace.
• Stripe — billing and payment data when you pay an invoice.
• Social platforms you connect — when you link an Instagram, LinkedIn, or other account to Reach, we receive the connection token and basic account details from that platform (see section 3.5).
• Public sources — when relevant for B2B prospecting on our side (LinkedIn profile pages, company websites, press releases).
• Cookies and similar technologies — see section 8.

5. Who we share personal data with

We share personal data only as needed to operate the Service:

• Sub-processors (see section 9 and the DPA Annex 2) — providers who process personal data on our behalf under written contracts that include GDPR Art. 28 obligations.
• Professional advisers — accountants, auditors, lawyers, under confidentiality obligations.
• Authorities — where required by Swedish or EU law, court order, or to defend our legal rights. We push back on overbroad requests.
• Acquirer or successor — in a corporate transaction (sale, merger, spin-out to a successor entity holding the Adamiro business); in that case the acquirer takes over as controller subject to this policy or a comparable one.

We do not sell personal data and do not share personal data with advertisers for cross-context behavioural advertising.

6. Children

The Service is intended for business users only. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us their data, contact privacy@adamiro.com and we will delete it.

7. Automated decisions and AI output

The Service uses generative AI to produce Output. We do not use the Service to make automated decisions producing legal or similarly significant effects on you within the meaning of GDPR Art. 22. Output is decision support — you remain responsible for any decision you make based on it.

We do run automated processes that may affect your account in operational ways (login throttling, fraud / abuse detection per TODO §2, billing-related suspensions). These are not Art. 22 decisions because a human can review them on request and they are necessary to perform the contract or to comply with law.

Assistant features (such as the in-dashboard Adam) are assistive and keep you in the loop: they answer questions about the Service and point you to the screen where an action can be taken, and you carry out that action yourself. They do not act on your behalf and do not make automated decisions about you within the meaning of Art. 22.

8. Cookies and analytics

We use a small number of cookies and similar technologies, run by our own first-party consent manager (not a third-party plugin). They fall into two groups:

• Strictly necessary — required for sign-in, session security, and the basic functioning of the site/app. Set on the basis of legitimate interest; cannot be disabled without breaking the Service.
• Analytics — aggregate traffic measurement (Google Analytics, via Google Site Kit). Set only with your consent via the cookie banner, using Google Consent Mode: no analytics cookie is set, and no data reaches Google, until you choose “Accept all” or opt in under “Customize”.

The live, current cookie list — provider, purpose, and duration for every cookie in use — is:

You can change your choice at any time from the “Cookie settings” link in the site footer.

When you make a choice, we log it — a random identifier, the categories chosen, the action taken, and a hashed IP address (never the address itself) — so we can demonstrate consent under GDPR Art. 7. That log is kept for 24 months and then deleted automatically; it never contains your name, email, or any other directly identifying information.

9. Sub-processors

We use the following sub-processors. The current list with locations, roles, and transfer mechanism is also in DPA Annex 2; both lists must agree.

Some of the advice in Mentor and The Tank comes from Claude models made by Anthropic, hosted by Google Cloud in Google Cloud’s EU regions only, with the exact region chosen by Google per request. For those calls Google Ireland Ltd. is the sub-processor, under the same Google Cloud agreement that covers Gemini. Anthropic supplies the model and does not receive your data from us. Neither company may use your text to train its models.

Some of the reading, sorting and drafting behind the modules, and some of the advice in Mentor and The Tank, may come from Mistral models made by Mistral AI, hosted by Google Cloud in its Netherlands region (europe-west4). For those calls Google Ireland Ltd. is the sub-processor, under the same Google Cloud agreement that covers Gemini. Mistral AI supplies the model and does not receive your data from us. Neither company may use your text to train its models.

None of the AI providers above may use your data to train their own models. That is excluded in our contract with each of them, and it does not depend on any setting you choose. See section 3.4.

We will give you reasonable advance notice of new sub-processors in this list and offer you a right to object on documented data-protection grounds.

10. International transfers

The default position is to keep personal data inside the EU/EEA. Where a sub-processor processes data outside the EU/EEA (in particular for US- based AI providers and their parent companies), the transfer is covered by Standard Contractual Clauses (EU Commission decision 2021/914) and, where appropriate, supplementary measures (encryption in transit and at rest, access logging, contractual prohibitions on government access not strictly required by law).

You may request a copy of the relevant SCCs by writing to privacy@adamiro.com. Confidential commercial terms may be redacted.

11. Security

We apply technical and organisational measures appropriate to the risk of the processing, including:

• Transport encryption — TLS 1.2+ across all customer-facing endpoints.
• At-rest encryption — for databases, backups, file storage, and vector stores where supported by the provider.
• Access control — least-privilege role-based access; named-person admin accounts; multi-factor authentication required for production access.
• Secrets management — credentials and API keys are kept in a password manager / secrets store, not in source code.
• Logging and monitoring — application, security, and access logs with anomaly detection on the staging-to-production deploy pipeline.
• Backups: we keep copies of the database for recovery. We take a copy before each release. We keep every copy from the last 30 days and, after that, one copy per month for 12 months. We keep these copies ourselves, off the web server. A copy made on the server is deleted once we have downloaded it, and none stays there longer than 30 days. Our hosting provider makes its own daily backups of the database and of uploaded files and keeps them for up to four months. Data and files you delete, or that are deleted with your account, stay in these copies until each copy is deleted. Recovery drills annually.
• Vulnerability management — dependency monitoring, patching on documented cadence; staging environment used for pre-production validation per DEVELOPMENT_PIPELINE.md.
• Personnel — confidentiality obligations for everyone with access; background checks for production access.
• Sub-processor diligence — contracts include GDPR Art. 28 and Art. 32 obligations.

A more detailed list of measures is in DPA Annex 3.

No system is perfectly secure. If you discover a vulnerability, please report it to security@adamiro.com — we operate good-faith vulnerability disclosure and won’t pursue researchers acting in good faith.

12. Your rights

Under GDPR Articles 15-22, you have the right to:

We will respond within one month of receipt of a verifiable request, extendable by two further months for complex requests with notice. We may need to verify your identity before disclosing data — usually by asking you to confirm a recent account action or email from the address on file.

We do not charge a fee for the first request in a 12-month period and will not refuse a request unless it is manifestly unfounded or excessive (in which case we will explain).

13. Right to complain

If you believe we have processed your data unlawfully, you may complain to the Swedish data-protection authority:

Integritetsskyddsmyndigheten (IMY) Box 8114, 104 20 Stockholm, Sweden imy@imy.se · imy.se

You may also complain to the supervisory authority of the EU/EEA member state where you live or work.

14. Changes to this policy

We may update this policy. Material changes will be notified by email or in-app at least 30 days before they take effect. Non-material changes (typo fixes, sub-processor additions of the same type) take effect on posting.

A change log is maintained at the bottom of this document.

15. Contact

Change log