Privacy policy
Effective 2026-10-26 · Recipients 2026-10-25
Who we are
Adduce Ltd runs Adduce and is the controller for the personal data described on this page. We decide what gets collected and what happens to it, and this page is our account of both.
Company number 17513997.
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Privacy contact: privacy@adducehq.com
What we collect
When you send us an enquiry
The enquiry forms and the design-partner application collect what you type into them: your name, how to reach you, your company and your message. We also keep the moment you agreed, the wording you agreed to, and the page and campaign link you came from. We use these to reply to you and, for the design-partner application, to run that programme.
Sending a form runs a bot check, which sees your IP address and some browser signals. Your IP address also limits how often a form can be sent.
When you have an account
Your account record holds your name, email address and profile image. Passwords and sign-in methods stay with our authentication provider. Card details go straight to our payment provider and never reach us; we send them the billing contact’s email address and your account and organisation identifiers. Inside the product, what you create is attributed to you: comments, uploads, and the record of AI usage your organisation runs up. Emails we send you are stored with their contents.
Content your organisation puts into the product, such as transcripts and files, is your organisation’s. We process it on your organisation’s instructions, as the terms describe. This notice covers the data we hold about you as a visitor, an enquirer or an account holder.
When you browse the site
Before you answer the cookie banner, and after you decline, we count page views without cookies. Our analytics providers see the page, your browser type and your IP address, and they use these to estimate visits. Nothing is stored on your device. If you accept, we record page views and events against a random identifier stored in a cookie. In the signed-in app they attach to your account. Your consent choice is stored on your device.
If you accepted analytics on our website and accept here too, we link your earlier website visits to your account. If you withdraw consent, that stops any further linking. A request for erasure deletes the linked record, website visits included.
When something breaks, an error report goes to our error-monitoring provider with your account and organisation identifiers, not your name, email address, cookies or IP address.
Legal basis for each of these
Enquiries rest on consent. The forms won’t submit without the tick box, and we keep a record of when we received it and which wording you were shown. You can withdraw consent whenever you like.
Analytics cookies rest on consent. They start only once you accept, and you can withdraw whenever you like.
Counting visits without cookies rests on our legitimate interests. We need to know how many people visit and which pages help them. It uses no cookies and the least data that does the job.
Your account rests on our contract with you. We need the account and billing data to run the service you signed up for and to charge for it.
Security, anti-abuse and error monitoring rest on our legitimate interests. Bot checks, rate limits and diagnostics are how the site stays up and stays usable. We’ve weighed that against your privacy: each uses the least data that does the job, and the diagnostics identify you by account identifier rather than by name or email address.
Nothing here is required by law. An account needs a name and an email address to work, and a form needs a way to reply to you. Leave those out and we cannot open the account or answer.
Who we share it with
We use a short list of providers to run Adduce. Each one processes personal data only to do the job in the table. The list carries its own date: changing a provider updates that date, not this whole notice.
Recipients list last updated 2026-10-25
| Who | What they do for us |
|---|---|
| Authentication provider | Signs you in and keeps track of who belongs to which organisation |
| Payment provider | Takes payment and runs subscriptions |
| Customer relationship system | Holds enquiries and design-partner applications so we can reply |
| Bot-protection provider | Checks that a form was sent by a person |
| Analytics provider | Counts visits without cookies, and records usage with cookies only after you accept |
| Error-monitoring provider | Collects error reports so we can fix faults |
| Infrastructure providers | Host the service and store its data |
| Email delivery provider | Sends the email we send you |
| AI model providers | Run the AI models that analyse content submitted for analysis |
These providers process data in the United Kingdom, the European Union and the United States. The bot check runs on a worldwide network. Where a provider holds an active certification under the UK Extension to the EU–US Data Privacy Framework, we rely on that. Otherwise we rely on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. Ask privacy@adducehq.com for a copy of the safeguard that applies.
How long we keep it
We retain enquiry records, including the message you wrote, for 24 months from last contact. Nothing clears them on a schedule. At the end of that period, or sooner if you ask, a person removes the record from each system that holds it.
Account and workspace data stays for as long as the account or workspace does. Deleting an organisation starts a 7-day grace period before its contents are purged. If a subscription is cancelled, the workspace is held for 30 days before the same purge runs. Closing your own account takes effect straight away, unless you’re the sole owner of an organisation — hand it over or delete it first.
When an account goes, the work made in it doesn’t: comments, transcripts and usage records stay in the workspace, no longer attached to a name.
Emails we’ve sent you are kept with their contents. There is no scheduled clear-out for those, but closing your account removes them with the rest of your account record.
Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct or erase it, ask us to restrict or stop a particular use, ask for it in a portable form, and withdraw any consent you have given.
Some of that you can do yourself. An organisation owner can export the workspace from inside the product, and the archive stays available for 7 days. An owner can also delete the organisation outright, which starts the 7-day countdown above. You can close your own account from your account settings.
Be clear about what that export is: your workspace content, not everything we hold about you. It does not include enquiries, billing records or notifications.
Everything else is done by hand. There is no self-serve tool for erasing an enquiry and no job that does it for us — someone opens each system holding the record and removes it. The same goes for access, correction, restriction and objection requests. Ask us and we’ll action it ourselves.
Send requests to privacy@adducehq.com.
How to complain
If you think we’ve handled your data badly, tell us first — we would rather fix it. You can also go straight to the Information Commissioner’s Office, the UK’s supervisory authority for data protection, at ico.org.uk.
Changes to this policy
This page carries an effective date at the top. When the policy changes, that date changes with it. The recipients list above is dated separately, so a change there doesn’t reissue the notice. We don’t send a notification for every edit — the date is the thing to check.