Data processing terms

Roles

For personal data in the content you or your AI put into Admode (“your personal data”, described in Annex 1), you are the controller and HV Digital AB is your processor. If you act for a client, you are their processor and we are your subprocessor.

These terms don’t cover the data we handle as a controller ourselves, such as your account, membership, billing and logs, and Admode’s ad library: the ads we collect from public ad libraries and the breakdowns and prompts banked from them (terms of service, section 9). Our privacy policy covers those. When we use your content to make Admode better (section 8), we are a controller for that use too, and these terms still protect it.

Your instructions

We process your personal data only to provide Admode as our terms describe and as you direct through it: what your AI asks Admode’s tools to do, what you or your AI render through Admode, and what you do in the dashboard; and to make Admode better as section 8 describes. These are your complete instructions. Anything beyond what Admode does needs our written agreement first. We process your personal data otherwise only when EU or Member State law requires it, and then we tell you first unless that law forbids it.

If we think an instruction breaks data protection law, we tell you.

Your duties

You’re responsible for what you put into Admode and for your instructions being lawful. You make sure that:

• you have a lawful basis for the personal data, and you’ve told the people concerned what the law requires;
• you put in only what your ads and research need, as Annex 1 describes;
• you don’t put in special categories of personal data, criminal records or children’s data, except what Annex 1 allows;
• you may let us use the personal data in what your AI sends to Admode’s tools to make Admode better (section 8), or you turn that off for the brand;
• you answer the people concerned when they use their rights, with our help (section 9).

Confidentiality

Everyone who can access your personal data on our side is bound to keep it confidential.

Security

We protect your personal data with the measures in Annex 2. We may improve them over time, but never lower the overall protection.

Subprocessors

You allow us to use the subprocessors in Annex 3. We give them the same data protection duties as these terms, by contract, and we remain responsible for them.

We tell you by email at least 14 days before we add or replace a subprocessor. If you have a reasonable data protection objection, tell us within that time. If we can’t solve it, you can end your plan, and we refund what you paid for the rest of the period.

Transfers

Some subprocessors are outside the EU and EEA. We transfer your personal data there only with a lawful safeguard: an adequacy decision such as the EU–US Data Privacy Framework and its UK and Swiss extensions, or the European Commission’s standard contractual clauses, with the UK’s addendum for data from the UK and extra measures where needed. You authorise these transfers. Write to us for a copy of the safeguards.

AI and making Admode better

The AI service that runs Admode’s pick and checks keeps nothing after answering and doesn’t train on what it receives. When you or your AI render through Admode, the AI services that make the file receive what the render needs, and keep it with the file for a short time.

We also keep a record of each ad job, its steps and the texts your AI sends to the pick and the check, and use it to make Admode better, including to train and test the AI models that run Admode (privacy policy, section 9). It holds personal data only as far as those texts do. We never show it to other members, and nothing we make from it identifies the people in it. You allow this use, and you can turn it off for a brand by writing to us; we then delete what was kept for that brand.

We don’t use your personal data to train AI models in any other way.

Helping you

Taking into account what we process and the information we have, we help you:

• answer people who use their data protection rights. The dashboard lets you find, download, correct and delete data yourself, and we pass on any request we receive for you without answering it ourselves;
• keep your personal data secure;
• handle personal data breaches;
• carry out data protection impact assessments and consult supervisory authorities, where you need to.

Personal data breaches

If a personal data breach affects your personal data, we tell you without undue delay, and where feasible within 72 hours of becoming aware of it. We tell you what happened, which data and roughly how many people are concerned, what it’s likely to lead to, what we’ve done and are doing about it, and who you can talk to. We add details as we learn more, and we take steps to limit the harm. Telling you isn’t an admission of fault.

At the end

You can download and delete your personal data at any time in the dashboard. When your plan ends, we keep it for 30 days so you can return or download it, then delete it automatically, with the record of your ad jobs, unless the law requires us to keep it. Ask us and we delete it sooner, and confirm in writing once it’s done. Deleted data can stay in backups until they’re overwritten.

Information and audits

We give you the information you reasonably need to show these terms are followed, for example answers to your security questionnaire. If that isn’t enough, you can audit us, or have an independent auditor do it, once a year and with 30 days’ notice, at your own cost. You agree the plan with us in advance, the auditor is bound by confidentiality and isn’t our competitor, and the audit takes place in working hours. An audit must not disturb Admode or expose other members’ data. Supervisory authorities can always audit as the law allows.

US state privacy laws

Where US state privacy laws, such as California’s, apply to your personal data, we act as your service provider or processor. We don’t sell or share it, don’t use it for anything outside our business relationship with you, and don’t combine it with other data, except as those laws allow, such as to build and improve Admode (section 8). We tell you if we can no longer meet these duties.

Liability and precedence

The liability rules in our terms of service apply to these terms, but they don’t limit the rights people have under the GDPR. Where these terms and the terms of service differ about personal data, these terms apply.

Earlier versions: 24 October 2026, 18 October 2026, 6 October 2026.

Annex 1: the processing

Subject

Providing Admode to you, and making it better (section 8).

Duration

While you have a plan, and the time in section 11.

Nature

Storing, organising, reading and showing your content; reading your Meta ad account once you connect it; checking it with AI; making the renders you ask for with AI; keeping a record of each ad job; sending it to your AI app; deleting it.

Purpose

To build, check, render and keep your ad prompts, ad copy, research and brand content, and to make Admode better.

Personal data

Whatever your content holds, typically: the words of people quoted from public reviews and forums, with the date and the link to where they wrote them; photos and videos showing people, also those you render from; names and contact details in brand material; and Meta ads data, whose pictures and videos can show people.

People concerned

Your customers and reviewers, people in your images, and your staff and contacts named in your content.

Sensitive data

Admode isn’t meant for special categories of personal data. VOC research can still hold what people wrote in public about themselves, and for some products that touches on health. Keep only the quotes your ads need, never add names or other details about the people who wrote them, and remove a quote when its writer asks you to.

Annex 2: security measures

• Encrypted connections only.
• Sign-in with a confirmed email or Google, passwords checked against known breaches and stored only as hashes, and a check of the sign-in and an active plan on every request.
• Each account reaches only its own brands.
• Files kept in private storage and reached only through short-lived signed links.
• Secrets kept out of code.
• Limits and input checks against abuse.
• Automatic deletion 30 days after a plan ends, with safeguards against deleting by mistake.
• Access to our systems only for the people who run Admode, who are bound to keep it confidential.

Annex 3: subprocessors

Write to support@admode.ai for more about a subprocessor and the terms we have with it.