Privacy Policy

Admitura is operated by Admitura – Pieter Beirnaert, Nieuwstraat 14, 9280 Wieze, Belgium, enterprise number BE 1043.126.419. Privacy questions: privacy@admitura.com or the form at the bottom of this page.

Two roles. For the accounts, billing, and usage data we need to run Admitura itself, we are the controller and this policy applies. For everything inside a workspace — the forms an organization builds, the requests people submit to it, reviews and scores — that organization is the controller and we only process the data on its behalf as a processor, under our Data Processing Agreement.

Admitura stores the data you and your organization put into it: workspace and account details (name, work email, a hashed password), the intake forms your organization builds, the requests people submit through them (including the submitter's name and email), and the reviews, scores, comments, and workflow history your team creates while processing those requests.

We also keep operational records needed to run the service securely and to bill for it: sign-in verification codes, audit log entries, email delivery state, server logs with IP addresses (kept briefly for security and abuse prevention), and billing details held by our payment provider — we never see full card numbers. We do not sell data, and we do not use your data to train AI models.

If you try the free template preview on our public page, the form we build from your file is kept for 48 hours (or until you create an account and keep it) and then deleted; the file itself is never stored. IP addresses are only stored as a one-way hash, to limit how often the preview can be used.

If a workspace admin imports existing requests from a spreadsheet, the uploaded rows are held for up to 24 hours while the import is set up and are deleted as soon as it finishes; the file itself is never stored. To suggest how the columns map onto the form, the AI step is shown only the column headings and five sample rows with email addresses, phone numbers and names replaced by placeholders. Imported requests send no email to anyone.

• To provide the service you signed up for (contract): accounts, workspaces, notifications, support.
• To bill and keep records (contract and legal obligation): invoices and payment state.
• To keep the service secure and prevent abuse (legitimate interest): rate limiting, sign-in verification, audit logs, server logs.
• To tell you about important changes to the service or these terms (contract / legitimate interest). We do not send marketing email without your consent.

Application data is stored in a managed PostgreSQL database in the EU/EEA and the application runs on managed cloud infrastructure in the EU. Access to production data is limited to the operator of the service. We share data only with the providers we need to run Admitura, each bound by a data-processing contract:

• Vercel Inc. — Application hosting, edge network, file (blob) storage, and cookieless usage analytics (EU (Frankfurt) compute; US-headquartered).
• Railway Corp. — Managed PostgreSQL database hosting (EU (europe-west4) region; US-headquartered).
• Resend Inc. — Transactional email delivery (verification codes, notifications) (US-headquartered; EU sending region where available).
• Paddle.com Market Ltd. — Online reseller and Merchant of Record for paid plans: checkout, payment processing, VAT, and invoices (billing contact and payment data only) (UK; EU and US payment processing).
• OpenRouter Inc. and its underlying model providers — Optional AI features (draft assessments, form-building assistance), and the free template preview on the public site. Used inside the app only when an organization turns AI features on; only the content of the request or uploaded template being processed is sent (for a backlog import: the column headings and a few sample rows with emails, phone numbers and names masked) (US; requests are routed only to model providers that neither train on nor retain the data).

Where a provider is outside the EEA, transfers are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We may also disclose data where the law requires it or to protect the rights, safety, or property of Admitura, its customers, or others. If the business or its assets are transferred (for example on incorporation, sale, or merger), account and billing data pass to the buyer or successor, which takes over this policy; we will tell you in advance.

Admitura uses only the cookies required to sign you in and keep your session secure. There are no advertising or cross-site tracking cookies, so no cookie banner is needed.

If you arrive through one of our own campaign links, the campaign labels in that link stay in the address of the pages you visit next, so that if you create a workspace we can see which post led to it. Nothing is stored on your device for this, and the labels say nothing about you.

We measure page views using our hosting provider's built-in analytics. It sets no cookies, stores nothing on your device, and does not follow you across other websites. To count visits it processes your IP address and browser user agent, which it discards after deriving an anonymous, non-reversible visit identifier. We rely on our legitimate interest in understanding how the service is used.

If you submitted a request to an organization using Admitura, that organization decides how your submission is processed and for how long it is kept. Requester accounts can view and update their own submissions through the portal. For questions about a specific submission, contact the organization you submitted to — they administer the workspace that holds your data. If you contact us instead, we will point you to them and help them respond.

Workspace data is kept for as long as the workspace exists. When a workspace is deleted it is scheduled for permanent erasure after a short grace period (currently 7 days) and then removed from production along with any files uploaded to it; backup copies rotate out within 30 days.

When someone in a workspace deletes an individual request it goes to that workspace's trash, where it can be restored for 30 days. After that it is permanently deleted, together with its attachments. Messages sent through our feedback and privacy request forms are kept for 24 months so we can show how a request was handled, then deleted.

Each workspace keeps an administrative audit trail (who changed what, and when) so its admins can review activity; those entries are kept for 90 days and then deleted. Server logs are kept for at most 30 days. Technical error reports, which we store with personal details stripped out, are deleted 30 days after the error is fixed and at the latest 90 days after it last occurred. Invoicing records are kept for the period Belgian tax law requires (currently 7 years). Unverified sign-ups that never complete are removed periodically.

Under the GDPR you can ask to access, correct, delete, or export the personal data we hold about you, to restrict or object to certain processing, and to withdraw consent where processing is based on it. Use the form below or email privacy@admitura.com. We answer within 30 days. If you are unhappy with our answer you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, www.dataprotectionauthority.be) or your local supervisory authority.

You can ask for your personal data or your organization's entire workspace to be deleted at any time — no account required. Self-service deletion is on our roadmap; until it ships, use the request form below and we'll handle it manually and promptly:

• Workspace owners: submit the request from your admin email address to have your workspace and all its data permanently deleted.
• Individual accounts and submitters: ask to have your account or a submission's personal data removed. Where a submission belongs to an organization's records, we will coordinate with that organization.

Every request is confirmed by email and completed within 30 days.

We will update this page when our practices change and note the date at the top. For significant changes we notify workspace administrators by email or in-app.

Use this form for any privacy question, data request, or deletion request. It goes straight to the operator of the service, and you'll get a confirmation by email.