Data processing terms

Roles

For personal data in the content you or your AI put into Admode (“your personal data”, described in Annex 1), you are the controller and HV Digital AB is your processor. If you act for a client, you are their processor and we are your subprocessor.

These terms don’t cover the data we handle as a controller ourselves, such as your account, membership, billing and logs, and Admode’s ad library: the ads we collect from public ad libraries and the breakdowns and prompts banked from them (terms of service, section 9). Our privacy policy covers those.

Your instructions

We process your personal data only to provide Admode as our terms describe and as you direct through it: what your AI asks Admode’s tools to do, and what you do in the dashboard. These are your complete instructions. Anything beyond what Admode does needs our written agreement first. We process your personal data otherwise only when EU or Member State law requires it, and then we tell you first unless that law forbids it.

If we think an instruction breaks data protection law, we tell you.

Your duties

You’re responsible for what you put into Admode and for your instructions being lawful. You make sure that:

• you have a lawful basis for the personal data, and you’ve told the people concerned what the law requires;
• you put in only what your ads and research need, as Annex 1 describes;
• you don’t put in special categories of personal data, criminal records or children’s data, except what Annex 1 allows;
• you answer the people concerned when they use their rights, with our help (section 9).

Confidentiality

Everyone who can access your personal data on our side is bound to keep it confidential.

Security

We protect your personal data with the measures in Annex 2. We may improve them over time, but never lower the overall protection.

Subprocessors

You allow us to use the subprocessors in Annex 3. We give them the same data protection duties as these terms, by contract, and we remain responsible for them.

We tell you by email at least 14 days before we add or replace a subprocessor. If you have a reasonable data protection objection, tell us within that time. If we can’t solve it, you can end your plan, and we refund what you paid for the rest of the period.

Transfers

Some subprocessors are outside the EU and EEA. We transfer your personal data there only with a lawful safeguard: an adequacy decision such as the EU–US Data Privacy Framework, or the European Commission’s standard contractual clauses with extra measures where needed. You authorise these transfers. Write to us for a copy of the safeguards.

AI and your data

We don’t use your personal data to train AI models. The AI service that runs Admode’s checks works under zero data retention: it keeps nothing after answering and doesn’t train on what it receives. Prompts sent for checking aren’t stored by us either.

Helping you

Taking into account what we process and the information we have, we help you:

• answer people who use their data protection rights. The dashboard lets you find, download, correct and delete data yourself, and we pass on any request we receive for you without answering it ourselves;
• keep your personal data secure;
• handle personal data breaches;
• carry out data protection impact assessments and consult supervisory authorities, where you need to.

Personal data breaches

If a personal data breach affects your personal data, we tell you without undue delay, and within 48 hours of becoming aware of it. We tell you what happened, which data and roughly how many people are concerned, what it’s likely to lead to, what we’ve done and are doing about it, and who you can talk to. We add details as we learn more, and we take steps to limit the harm. Telling you isn’t an admission of fault.

At the end

You can download and delete your personal data at any time in the dashboard. When your plan ends, we keep it for 30 days so you can return or download it, then delete it automatically, unless the law requires us to keep it. Ask us and we delete it sooner, and confirm in writing once it’s done. Deleted data can stay in backups until they’re overwritten.

Information and audits

We give you the information you reasonably need to show these terms are followed, for example answers to your security questionnaire. If that isn’t enough, you can audit us, or have an independent auditor do it, once a year and with 30 days’ notice, at your own cost. You agree the plan with us in advance, the auditor is bound by confidentiality and isn’t our competitor, and the audit takes place in working hours. An audit must not disturb Admode or expose other members’ data. Supervisory authorities can always audit as the law allows.

US state privacy laws

Where US state privacy laws, such as California’s, apply to your personal data, we act as your service provider or processor. We don’t sell or share it, don’t use it for anything outside our business relationship with you, and don’t combine it with other data, except as those laws allow. We tell you if we can no longer meet these duties.

Liability and precedence

The liability rules in our terms of service apply to these terms, but they don’t limit the rights people have under the GDPR. Where these terms and the terms of service differ about personal data, these terms apply.

Annex 1: the processing

Subject

Providing Admode to you.

Duration

While you have a plan, and the time in section 11.

Nature

Storing, organising, reading and showing your content; reading your Meta ad account once you connect it; checking it with AI; sending it to your AI app; deleting it.

Purpose

To build, check and keep your ad prompts, ad copy, research and brand content.

Personal data

Whatever your content holds, typically: the words of people quoted from public reviews and forums, with the date and the link to where they wrote them; photos and videos showing people; names and contact details in brand material; and Meta ads data, whose pictures and videos can show people.

People concerned

Your customers and reviewers, people in your images, and your staff and contacts named in your content.

Sensitive data

Admode isn’t meant for special categories of personal data. VOC research can still hold what people wrote in public about themselves, and for some products that touches on health. Keep only the quotes your ads need, never add names or other details about the people who wrote them, and remove a quote when its writer asks you to.

Annex 2: security measures

• Every connection uses HTTPS, and browsers are told to use nothing else.
• Sign-in through Clerk, with Google or with an email and password; a one-time code sent by email confirms new accounts, new devices and password resets. Passwords are checked against known breaches and stored only as hashes, and repeated wrong passwords lock the account for a while. Every request to Admode’s tools checks the sign-in and an active plan.
• Each account reaches only its own brands.
• Prompts sent for checking aren’t stored. The AI service that runs the checks works under zero data retention.
• Prompts, sign-in tokens and email addresses are kept out of our application logs.
• Images, videos and other files reach your AI’s tools through signed links that expire within 24 hours.
• Admode runs in containers as an unprivileged user and writes nothing to disk; your content lives in the database, and the videos, images and music you upload in private file storage, reached only through signed links.
• Secrets are kept in the hosting platform’s settings, never in code.
• Limits and input checks protect Admode against abuse.
• Data is deleted automatically 30 days after a plan ends, with safeguards that stop a fault from deleting anyone by mistake.
• Only the people who run Admode can access our systems.

Annex 3: subprocessors

Write to support@admode.ai for more about a subprocessor and the terms we have with it.