Privacy policy: what we keep, and why.

This explains which information Adea processes about you, why, and for how long. We collect as little as we can, we never sell it, and we never use it to train AI models.

1. Who is responsible

Marcus Wilstrup, VAT no. PT310292522, Rua da Fonte 85 B, Capride, 2785-371 São Domingos de Rana, Portugal ("Adea", "we") is the controller of the information this policy covers. Adea is established in Portugal. Write to us at privacy@adea.app if you have questions.

If we transfer Adea to another company that we own or control, the information goes with it, and the new company becomes the controller. We will say so here before it happens.

2. Two roles: controller and processor

When a company uses Adea on its own data, code and services, that is the company's data. Adea is then a processor for the company, and the processing follows the data processing agreement. This covers, for example, the company's customers who appear in its database, and the people who see a page the company has shared with a public link. Questions about that data go to the company. This policy does not cover that part.

For information about you as a visitor, as a user of Adea and as a customer of ours, Adea is the controller. That is what is described below.

3. What we process, and why

Visitors to adea.app

• What: the address of the page you asked for, your IP address, your browser and the time. Nothing that identifies you over time.
• Why: to deliver the page, keep the site running and stop abuse.
• Basis: legitimate interest, Art. 6(1)(f).
• How long: at most 30 days in our servers' logs.

Visitors who try the demo

• What: the questions you ask, the answers and the time. You get your own copy of a sample company. We don't ask for your name or email address.
• Why: to show you how Adea works and answer your questions.
• Basis: legitimate interest, Art. 6(1)(f).
• How long: your copy is deleted when nobody has used it for 24 hours.

Don't enter personal data in the demo. It is for trying Adea on sample data.

People who sign up

• What: your email address, the company's name, what the business does, and the company's public website, which Adea reads at signup to set itself up for your kind of business. Only public pages are read.
• Why: to create the account and set it up.
• Basis: contract, Art. 6(1)(b).
• How long: an unfinished signup is deleted after 30 days. A finished one becomes the account.

Companies on the Free plan or the trial

• What: the domain of the email address (like company.com), or the whole address when it is with a common email provider such as Gmail, and when the Free plan or the trial started.
• Why: to give the Free plan and the trial only once per company.
• Basis: legitimate interest, Art. 6(1)(f).
• How long: as long as the account exists, and 3 years after it is deleted.

People whose AI agent asks for an account for them

• What: the email address, company name and agent name the agent sent, and the IP address the request came from.
• Why: to send the email where you confirm the account, and to stop abuse.
• Basis: legitimate interest, Art. 6(1)(f).
• How long: the link works for 24 hours, and the request is deleted after 30 days if you don't confirm. If you confirm, the details belong to the account.

Users of Adea

• What: your email address, name, language, role and settings; how you sign in (with Google or Microsoft, the account's ID; with a passkey, only its public key); the time, device and network address of each sign-in; your phone number if you add one; and what you ask and do in Adea.
• Why: to give you access, keep your account safe, send the sign-in links, notifications and reports you asked for, and show your company's administrators who did what.
• Basis: contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f), when your employer is our customer.
• How long: as long as you are part of the company in Adea. When an administrator removes you, your access ends at once. What you made for the team stays with the company.

Paying customers

• What: the name and email of the person who pays, the company's name, VAT number and address, and the payment history. Only Stripe handles card details.
• Why: to collect payment and keep our books.
• Basis: contract and legal obligation, Art. 6(1)(b) and (c).
• How long: invoices and payments are kept for as long as accounting law requires.

Former customers

• What: a short record that the company was a customer: its name, website domain, country, industry, plan and payment history, the dates of signup and deletion, and the reason given for leaving, if any. No names or email addresses of people.
• Why: to keep our books and understand why companies leave.
• Basis: legitimate interest, Art. 6(1)(f).
• How long: as long as we need it for those purposes.

People who write to us

• What: your name, your email address and what you write.
• Why: to reply to you.
• Basis: legitimate interest, Art. 6(1)(f).
• How long: up to 24 months after the last contact.

People we contact about Adea

• What: name, job title, work email and phone, company and notes about our contact. We get them from the Danish company register (CVR), the company's website and LinkedIn.
• Why: to contact companies that Adea may be useful for.
• Basis: legitimate interest, Art. 6(1)(f).
• How long: 12 months after the last contact.

If we contact you about Adea, we tell you the first time where we got your details and that you can say no. If you say no, we stop straight away and keep only the fact that we may not contact you again. We don't contact companies that have opted out of marketing in the Danish company register.

People who sign up for sub-processor notices

• What: your email address, optionally the company's name, the time and the text you agreed to.
• Why: to tell you before we add or replace a sub-processor, as the data processing agreement promises.
• Basis: consent, Art. 6(1)(a).
• How long: until you unsubscribe.

We don't send marketing emails unless you have said yes to them.

4. How Adea is used

We count how Adea is used, for example which setup steps people finish, how long an answer takes, and what fails, so we can make it better. These figures live in our own database, are looked at only in aggregate and never contain the content of a company's data, code, questions or answers. Adea has no third-party trackers or advertising pixels.

5. Cookies and storage in your browser

The website adea.app sets no cookies and has no cookie banner, because it has nothing that needs one.

When you sign in to Adea or open the demo, we set one necessary cookie that keeps you signed in. It is not used for statistics or advertising, and it does not need consent. If you work as a guest in a list shared with a public link, we set one necessary cookie that remembers you on that list for 30 days.

Adea also remembers a few choices in your browser's own storage, such as how you signed in last time and how you like a list sorted, so they are ready next time. They never leave your browser.

6. AI, voice and screenshots

Adea uses Anthropic's AI model, Claude, to understand questions and write answers. It receives the question and the parts of the company's data and code needed to answer it. Anthropic does not use it to train its models.

When you speak to Adea, your voice is sent to Cloudflare to be turned into text, and answers can be read aloud the same way. The recording is deleted as soon as it is text.

When you upload a screenshot to rebuild a report, it is deleted when the dashboard is built. Screenshots are never used to train AI models.

7. Notifications

Push notifications reach your device through your browser's or phone's push service (from Apple, Google or Mozilla). They are encrypted so the push service can't read them. If you add your phone number and turn texts or calls on, urgent findings reach you through Twilio. You can turn each of them off in Adea.

8. Who receives the information

We use selected suppliers for hosting, network, email, payment, AI, texts and error monitoring. They process information on our instructions and are listed on the sub-processors page. When your company connects Slack, Microsoft Teams or another service, the answers and notifications it asked for go there. Beyond that, we only pass information on when the law requires it.

9. Transfers outside the EU

Adea's servers and databases are in the EU, and backups are stored encrypted in the EU. Some suppliers are in the USA. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. If you want a copy of the basis, write to us.

10. Export and deletion

An administrator can export everything Adea holds for the company at any time: questions and answers, dashboards, lists, insights, the team and the security log.

When an administrator deletes the company in Adea, nobody can sign in from that moment. For 30 days an administrator can still restore it with the link in the mail we send. On day 30 everything is deleted and the company's encryption key is destroyed, so its data can't be read even in older backups, which are deleted on their normal schedule within 35 days. We keep only the invoices accounting law requires and the short record described under former customers.

11. Your rights

You have the right to see which information we hold about you, and to have it corrected or deleted. You can also ask us to restrict the processing, object to it and have your information handed over in a common format. If the processing relies on your consent, you can withdraw it at any time.

Write to privacy@adea.app. We reply within 30 days at the latest. If you are not satisfied, you can complain to the Portuguese Data Protection Authority, CNPD, as Adea is established in Portugal, or to the authority where you live, such as the Danish Data Protection Agency, Datatilsynet.

12. Security

We protect the information with encryption, access control and logging. Read more on the security page. Report a weakness to security@adea.app.

13. Changes

If we change this policy in a way that matters, we say so here and tell the administrators of every company in Adea before the change takes effect.