Privacy Policy

Last updated: 27 July 2026

This policy explains how Hojt Communication AB, organisation number 559017-1459, registered in Sweden (“Adamiro“, “we“, “us“) processes personal data when you visit our website at adamiro.com, use the Adamiro service, contact us, or interact with our marketing.

1. Who is the controller

For personal data we collect about you as a website visitor, account holder, prospect, or contact person at a customer organisation, Hojt Communication AB is the data controller.

For personal data you submit through the Service about other people (your colleagues, contacts, prospects, or end users), you are the controller and we are the processor. That relationship is governed by the Data Processing Addendum, which forms part of these Terms.

2. Scope

This policy covers personal data we process as controller, including:

• Visitors to adamiro.com and adam.hojt.se (staging).
• People who fill in forms, sign up for a free trial, or subscribe.
• Account holders and seat-level users on customer accounts.
• Contact persons at prospects, suppliers, and partners.
• People who email or call us.
• Job applicants who contact us via the website.

Where customers process personal data of third parties through the Service (for example, contacts referenced in Mentor / The Tank conversations, or people named in content created with Voice and published with Reach), we act as a processor on the customer’s behalf and the DPA governs that processing.

3. What personal data we process, why, and on what lawful basis

The table below lists each processing activity. “Lawful basis” refers to GDPR Art. 6(1) letters (a) consent, (b) contract, (c) legal obligation, (d) vital interests, (e) public task, (f) legitimate interest. Where we rely on legitimate interest, we have carried out a documented Legitimate Interest Assessment (LIA) and the assessed interests are summarised in the Why column.

3.1 Visitors to our website

We do not store the business idea you describe on that page. The offer text you type, any site text we read, and the board’s answer are processed only in the memory of your request — never written to a database, an option, a log file, or any other form of storage. The single exception is the report itself: emailing it to the address you give us is the one copy that leaves our systems, sent to you at your own request. That is a materially different promise from a normal contact form, where we do keep what you submitted — see the “Form submissions” row above.

The link in that report carries a signed reference to your lead record rather than your email address, so asking us to delete the record also breaks the link. Delete requests for this page are therefore satisfied by removing the single lead row; there is no second copy elsewhere.

3.2 Account holders and customer users

Confidential by default. Adamiro keeps your name, email, company, phone, and address out of anything a service generates or sends unless you opt that service in under Account → Privacy. Your Mentor and The Tank conversations are treated as confidential: they are not reused in other services unless you turn that on yourself, and they are never used to train a model without your written consent. See section 3.4 for model training and the Terms of Service section 13 for conversation confidentiality.

You decide how long conversations are kept. Under Account → Privacy you can set a retention window for your Mentor and The Tank transcripts — keep them until you delete them, or have Adamiro remove them automatically after 30, 90, 180, or 365 days (a daily job enforces your choice). The default is 365 days. You can also delete every transcript immediately with one click. Anything you deliberately saved to Memories is kept until you remove it there; retention covers raw conversation logs, not the knowledge you chose to keep.

Your presence marker, and when it is deleted. So that our team can see who is using the dashboard at any moment, we store one marker per person: the time you were last active, and the name of the screen you were on. Every visit overwrites the previous one. It is not a history. It cannot tell us where you were an hour ago, and there is no page-by-page trail behind it.

A job runs every hour and deletes both parts of any marker older than 24 hours. Nothing in the Service reads one that old. A closed or suspended account stops generating activity, so whatever else happens to the account, your marker is gone within 24 hours of the last time you used the dashboard. Deleting the account outright, or resetting its data at your request, removes the marker as part of that wipe instead of waiting for the hourly job. A copy may remain in our encrypted database backups for up to 30 days (section 11). After that it is gone.

3.3 People you contact through the Service (third parties)

When you use any feature where you submit data about real people — for example, people referenced in Mentor documents, The Tank sessions, or content you publish — you are the controller. The DPA governs that processing. We do not use those individuals’ data for our own purposes beyond delivering the Service to you.

3.4 Model training

We do not train on your data. Nothing you type into Adamiro, and nothing Adamiro generates for you, is used to train, fine-tune, or evaluate a machine-learning model unless you have given us explicit written consent for that use. No consent, no training. The rule covers our own models and every AI provider we send your data to.

We do not bundle this consent into the Terms, and we do not make it a condition of using the Service or of any price you are offered. Silence is not a yes. If you have not signed something that says otherwise, the answer on your account is no.

The AI providers we use may not train on your data either. Your prompts and the results pass through the language-model providers listed in section 9, because that is how the Service produces a result. Each of them is contractually barred from using your Input or Output to train or improve its own models. We run on their business API terms, where training on submitted content is excluded, and we hold a data-processing agreement with each provider. Your data does not go through a consumer AI product, where submitted content is often training data by default. If a provider changes its terms so that customer traffic could be used for training, we will get that removed in writing or stop using the provider, and we will tell you before the change takes effect (section 14).

If you do give written consent, this is what it covers:

Nothing is being captured today. No consent has been collected from anyone, the capture step is switched off in code, and the corpus is empty.

3.5 Connected social accounts (Reach publishing)

When you connect a social account to Reach so you can publish the content you create in Adamiro (for example, your own Instagram Business account connected via Facebook Login, or your LinkedIn account), we process the following:

We use these permissions only to (a) list the accounts you manage so you can choose where to publish, (b) publish the single image or multi-image carousel you composed, to your own account, when you click “Post now”, and (c) read engagement on the posts you published through Adamiro. We never post without an explicit action by you, never read other people’s content, never publish to a shared or Adamiro-owned account, and never use this data for advertising or model training.

Disconnecting and deleting this data. You can remove a connected account at any time, and there are three ways the stored data is deleted:

• In-app — click Disconnect in Reach → Connections. The access token and connected-account details are deleted immediately.
• From the platform — if you remove Adamiro from your Facebook or Instagram settings, the platform notifies us and we delete your stored token and account details automatically.
• By request — email privacy@adamiro.com, or use the platform’s data-deletion request flow; we delete the data and provide a confirmation you can check.

Meta Platforms Ireland Ltd. and LinkedIn Ireland Unlimited Company are the operators of the platforms you publish to; when you publish, your content is sent to your own account on their platform under their respective privacy policies. They act as independent controllers for the account you hold with them, not as our sub-processors.

4. Where we get personal data

We receive personal data from:

• You directly — when you sign up, fill in a form, send us an email, or use the Service.
• Your colleagues — when an account owner adds you as a seat or shares a workspace.
• Stripe — billing and payment data when you pay an invoice.
• Social platforms you connect — when you link an Instagram, LinkedIn, or other account to Reach, we receive the connection token and basic account details from that platform (see section 3.5).
• Public sources — when relevant for B2B prospecting on our side (LinkedIn profile pages, company websites, press releases).
• Cookies and similar technologies — see section 8.

5. Who we share personal data with

We share personal data only as needed to operate the Service:

• Sub-processors (see section 9 and the DPA Annex 2) — providers who process personal data on our behalf under written contracts that include GDPR Art. 28 obligations.
• Professional advisers — accountants, auditors, lawyers, under confidentiality obligations.
• Authorities — where required by Swedish or EU law, court order, or to defend our legal rights. We push back on overbroad requests.
• Acquirer or successor — in a corporate transaction (sale, merger, spin-out to a successor entity holding the Adamiro business); in that case the acquirer takes over as controller subject to this policy or a comparable one.

We do not sell personal data and do not share personal data with advertisers for cross-context behavioural advertising.

6. Children

The Service is intended for business users only. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us their data, contact privacy@adamiro.com and we will delete it.

7. Automated decisions and AI output

The Service uses generative AI to produce Output. We do not use the Service to make automated decisions producing legal or similarly significant effects on you within the meaning of GDPR Art. 22. Output is decision support — you remain responsible for any decision you make based on it.

We do run automated processes that may affect your account in operational ways (login throttling, fraud / abuse detection per TODO §2, billing-related suspensions). These are not Art. 22 decisions because a human can review them on request and they are necessary to perform the contract or to comply with law.

Assistant and agentic features (such as the in-dashboard Adam) are assistive and keep you in the loop: they prepare actions in the dashboard and carry them out only when you confirm them. They do not make automated decisions about you within the meaning of Art. 22.

8. Cookies and analytics

We use a small number of cookies and similar technologies, run by our own first-party consent manager (not a third-party plugin). They fall into two groups:

• Strictly necessary — required for sign-in, session security, and the basic functioning of the site/app. Set on the basis of legitimate interest; cannot be disabled without breaking the Service.
• Analytics — aggregate traffic measurement (Google Analytics, via Google Site Kit). Set only with your consent via the cookie banner, using Google Consent Mode: no analytics cookie is set, and no data reaches Google, until you choose “Accept all” or opt in under “Customize”.

The live, current cookie list — provider, purpose, and duration for every cookie in use — is:

You can change your choice at any time from the “Cookie settings” link in the site footer.

When you make a choice, we log it — a random identifier, the categories chosen, the action taken, and a hashed IP address (never the address itself) — so we can demonstrate consent under GDPR Art. 7. That log is kept for 24 months and then deleted automatically; it never contains your name, email, or any other directly identifying information.

9. Sub-processors

We use the following sub-processors. The current list with locations, roles, and transfer mechanism is also in DPA Annex 2; both lists must agree.

None of the AI providers above may use your data to train their own models. That is excluded in our contract with each of them, and it does not depend on any setting you choose. See section 3.4.

We will give you reasonable advance notice of new sub-processors in this list and offer you a right to object on documented data-protection grounds.

10. International transfers

The default position is to keep personal data inside the EU/EEA. Where a sub-processor processes data outside the EU/EEA (in particular for US- based AI providers and their parent companies), the transfer is covered by Standard Contractual Clauses (EU Commission decision 2021/914) and, where appropriate, supplementary measures (encryption in transit and at rest, access logging, contractual prohibitions on government access not strictly required by law).

You may request a copy of the relevant SCCs by writing to privacy@adamiro.com. Confidential commercial terms may be redacted.

11. Security

We apply technical and organisational measures appropriate to the risk of the processing, including:

• Transport encryption — TLS 1.2+ across all customer-facing endpoints.
• At-rest encryption — for databases, backups, file storage, and vector stores where supported by the provider.
• Access control — least-privilege role-based access; named-person admin accounts; multi-factor authentication required for production access.
• Secrets management — credentials and API keys are kept in a password manager / secrets store, not in source code.
• Logging and monitoring — application, security, and access logs with anomaly detection on the staging-to-production deploy pipeline.
• Backups — daily database backups retained for 30 days; recovery drills annually.
• Vulnerability management — dependency monitoring, patching on documented cadence; staging environment used for pre-production validation per DEVELOPMENT_PIPELINE.md.
• Personnel — confidentiality obligations for everyone with access; background checks for production access.
• Sub-processor diligence — contracts include GDPR Art. 28 and Art. 32 obligations.

A more detailed list of measures is in DPA Annex 3.

No system is perfectly secure. If you discover a vulnerability, please report it to security@adamiro.com — we operate good-faith vulnerability disclosure and won’t pursue researchers acting in good faith.

12. Your rights

Under GDPR Articles 15-22, you have the right to:

We will respond within one month of receipt of a verifiable request, extendable by two further months for complex requests with notice. We may need to verify your identity before disclosing data — usually by asking you to confirm a recent account action or email from the address on file.

We do not charge a fee for the first request in a 12-month period and will not refuse a request unless it is manifestly unfounded or excessive (in which case we will explain).

13. Right to complain

If you believe we have processed your data unlawfully, you may complain to the Swedish data-protection authority:

Integritetsskyddsmyndigheten (IMY) Box 8114, 104 20 Stockholm, Sweden imy@imy.se · imy.se

You may also complain to the supervisory authority of the EU/EEA member state where you live or work.

14. Changes to this policy

We may update this policy. Material changes will be notified by email or in-app at least 30 days before they take effect. Non-material changes (typo fixes, sub-processor additions of the same type) take effect on posting.

A change log is maintained at the bottom of this document.

15. Contact

Change log