Legal
Privacy Policy
Last updated: September 29, 2026
Adapt is a workplace communication and knowledge platform. This policy explains what personal data we collect when you visit adaptworkplace.com, create an account, or use the Adapt application - and what we do with it.
1. Who we are
The data controller for adaptworkplace.com and for the account, signup, and billing data described in this policy is:
【LEGAL_NAME】
CVR: 【CVR】
【ADDRESS】, Denmark
Email: hello@adaptworkplace.com
We are a Danish business, and this policy is governed by Danish law and Regulation (EU) 2016/679 (the GDPR). Our supervisory authority is the Danish Data Protection Agency (Datatilsynet).
2. What this policy covers
Adapt handles personal data in two distinct roles, and it matters which one applies:
We are the controller for data about website visitors, people who sign up, account holders, and billing contacts. That data is covered by this policy in full.
We are a processor for the content your organisation puts into its Adapt workspace - such as articles, posts, comments, files, and the profile data of workspace members. For that data, your employer (or whichever organisation owns the workspace) is the controller and decides why and how it is used. We process it only on their instructions. See section 5.
If you have a question about content inside a workspace - the right first stop is your workspace administrator. We support them in meeting their obligations.
3. The data we collect
When you visit the website - our hosting infrastructure keeps standard server logs, such as IP address, browser type, pages requested, and timestamps. We use these for security and to keep the site running. The website sets no tracking cookies (see section 13).
When you sign up - the details you provide in the signup form, such as the user's name, work email address, and company name (which becomes your workspace name). If you sign up with a password, the user's password is stored only as a salted hash - we never see or store the password itself. If you sign in with Microsoft or Google, we receive the user's name, email, and a unique identifier from that provider; we never receive the user's Microsoft or Google password. The signup form is protected by Cloudflare Turnstile, which analyses browser signals to block bots.
When you use Adapt - profile information (such as name, email, photo, and job title where provided), the content you create, and usage events the product needs to function - including, but not limited to, which items you have read or bookmarked, view counts, notification history, and device/browser push-notification subscriptions if you enable them.
When you pay - billing details such as your subscription plan, billing contact, and invoice history. Card details go directly to our payment provider, Stripe. We never receive or store full card numbers.
When you contact us - the correspondence and contact details you choose to share.
4. Why we process it (purposes & legal bases)
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Providing the service - accounts, workspaces, content delivery, notifications | Account, profile, usage data | Contract (6(1)(b)) |
| Billing and subscription management | Billing data | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Security - abuse and bot prevention, incident investigation, server logs | Log data, Turnstile signals | Legitimate interest (6(1)(f)): keeping the service safe |
| Service emails - invitations, verification, important account notices | Name, email | Contract (6(1)(b)) |
| Product improvement - aggregated, de-identified usage analysis | Usage data | Legitimate interest (6(1)(f)) |
| Marketing emails, if you opt in | Name, email | Consent (6(1)(a)) - withdrawable at any time |
| Bookkeeping records | Invoices, billing data | Legal obligation (6(1)(c)): Danish Bookkeeping Act |
Where we rely on legitimate interest, we have weighed our interest against your rights and freedoms, and you can object at any time (section 12). We do not sell personal data, and we do not use your data for third-party advertising.
5. Your workspace content - our role as processor
Everything your organisation and its members put into a workspace - including, but not limited to, articles, posts, comments, reactions, attachments, knowledge-base documents, and member profile data synced from Microsoft 365 - is processed by Adapt strictly as a processor on the workspace owner's behalf.
In that role we commit to the following:
- We process workspace content only to provide and support the service - never for advertising, profiling, or resale.
- Workspace data is logically isolated per customer (each workspace has its own database).
- We engage only the sub-processors listed in section 8, under written data-processing terms.
- We notify affected workspace owners without undue delay after becoming aware of a personal data breach affecting their data.
- On termination, workspace data is deleted in line with section 10.
A signable Data Processing Agreement (DPA) reflecting these commitments is available on request via privacy@adaptworkplace.com.
6. AI features
Adapt includes AI-assisted writing tools (such as drafting, proofreading, rephrasing, translation, and summarisation). These run on Azure OpenAI Service inside Microsoft's cloud in the European Union.
- Text is sent to the model only when you actively invoke an AI feature.
- The user's content is not used to train foundation models - Microsoft's Azure OpenAI terms prohibit it, and we have not opted into any data-sharing programme.
- AI output is a draft shown to you; nothing is published without your action.
7. Sign-in options and Microsoft 365 integration
You can sign in to Adapt in three ways, and what we receive differs by method:
Email and password - we store the user's email address and a salted hash of the user's password. We use the email address to verify the account and send essential account notices. We cannot see the password itself.
Sign in with Microsoft - Microsoft Entra ID confirms the user's identity and shares the user's name, email address, and a unique account identifier with us. We never receive the user's Microsoft password, and signing in does not by itself give us access to your Microsoft 365 data.
Sign in with Google - Google confirms the user's identity and shares the user's name, email address, and a unique account identifier with us. We never receive the user's Google password, and we do not access the user's Gmail, Drive, Calendar, or any other Google service data. Data received from Google is used only to create and secure the user's Adapt account, in line with the Google API Services User Data Policy.
Microsoft 365 workspace integration - separately from sign-in, your organisation can connect its Adapt workspace to Microsoft 365. In that case we access Microsoft Graph with the permissions the workspace administrator consents to - typically the user's basic profile (name, email, job title), profile photo, and, if enabled, group memberships used to organise workspace access. We request read-only access to this data, use it solely to operate the workspace, and never modify the organisation's Microsoft 365 data.
8. Sub-processors
We use a deliberately short list of vendors to run Adapt:
| Vendor | Purpose | Location of processing |
|---|---|---|
| Microsoft (Azure) | Cloud hosting, database, file storage, real-time messaging, transactional email, Azure OpenAI | EU (West Europe region) |
| Stripe | Payment processing and invoicing | EU (Stripe Payments Europe); limited transfers to the US under the EU-US Data Privacy Framework |
| Cloudflare | Bot protection on signup (Turnstile) | EU/US; EU-US Data Privacy Framework |
| Tinify (TinyPNG) | Image compression for uploaded pictures | EU (Netherlands) |
| Microsoft Entra ID / Google | Sign-in, only when you choose that provider | Per the provider you choose |
We will update this list before adding or replacing a sub-processor that handles personal data.
9. International transfers
Adapt is hosted in Microsoft Azure's West Europe region, and your data stays in the EU/EEA by default. Where a sub-processor involves a transfer outside the EEA (see section 8), it is protected by an EU adequacy decision - such as the EU-US Data Privacy Framework - or by the European Commission's Standard Contractual Clauses.
10. How long we keep data
| Data | Retention |
|---|---|
| Account and workspace data | For the life of the account. Deleted within 90 days after account or workspace deletion. |
| Backups | Rolled off automatically within 30 days after deletion from live systems. |
| Abandoned signups (never activated) | Deleted within 30 days. |
| Server and security logs | Up to 12 months. |
| Billing and bookkeeping records | 5 years from the end of the financial year, as required by the Danish Bookkeeping Act. |
| Support correspondence | Up to 24 months after the case is closed. |
11. Security
We protect personal data with measures appropriate to the risk, including: encryption in transit (TLS) and at rest, per-workspace database isolation, role-based access control, authentication through Microsoft Entra ID / Google / salted-and-hashed passwords, bot protection on public forms, and the security programme of Microsoft Azure as our hosting platform. Access to production data is restricted to what is necessary to operate and support the service.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet and, where required, affected users and workspace owners without undue delay.
12. Your rights
Under the GDPR you can, at any time:
- Access the personal data we hold about you, and get a copy.
- Rectify data that is inaccurate or incomplete.
- Erase your data ("right to be forgotten"), where no legal basis requires us to keep it.
- Restrict or object to processing based on legitimate interest.
- Port the data you provided to another service in a machine-readable format.
- Withdraw consent where processing is based on it - without affecting prior processing.
Write to privacy@adaptworkplace.com and we aim to respond within 5 working days - and in any case within one month, as the GDPR requires. For data inside a workspace, we may refer you to - or coordinate with - your workspace administrator, who is the controller of that data.
You also have the right to lodge a complaint with a supervisory authority.
14. Children
Adapt is a workplace product intended for professional use. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.
15. Changes to this policy
We will update this policy as the product and the law evolve. The "Last updated" date at the top always reflects the current version. For material changes - new purposes, new categories of data, or a new sub-processor handling personal data - we will notify account holders by email or in-app notice before the change takes effect.
16. Contact
Questions, requests, or concerns about privacy at Adapt:
privacy@adaptworkplace.com
【LEGAL_NAME】, 【ADDRESS】, Denmark