Privacy Policy

1. Controller

Kadmo GmbH
Linienstraße 148
10115 Berlin
Germany

Represented by: Leopold zu Schleswig-Holstein Sonderburg-Glücksburg, Maksym Svistunov
Email: info@kadmo.ai
Phone: +49 151 229 829 86

We have not appointed a Data Protection Officer, as we are not required to do so under Art. 37 GDPR or § 38 BDSG. Data protection enquiries reach us at legal@kadmo.ai.

2. Access data and hosting

When you open a page, your browser necessarily transmits data to the servers that deliver it: IP address, date and time, the page requested, referrer URL, browser type and version, and operating system. We keep no access logs for kadmo.ai: this data is processed only for as long as it takes to deliver the page and to protect the delivery network against abuse.

Purpose and legal basis: delivering the page, and maintaining the security and stability of the delivery. This is our legitimate interest under Art. 6(1)(f) GDPR.

Hosting: the site is stored and delivered by Amazon Web Services. The files are kept in the AWS region Frankfurt (eu-central-1) and delivered through Amazon CloudFront, a content delivery network whose edge locations answer your request from the location nearest to you, which can be outside the EU. Our contracting party is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, which acts as our processor under the AWS Data Processing Addendum pursuant to Art. 28 GDPR. Where a request is answered outside the EU, the transfer rests on the EU Standard Contractual Clauses included in that addendum (Art. 46(2)(c) GDPR); Amazon Web Services, Inc. is also certified under the EU-US Data Privacy Framework.

3. Booking a call

The booking page embeds a scheduling calendar provided by HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland. When you open that page, the calendar is loaded from HubSpot's servers, which means your IP address and browser data are transmitted to HubSpot and HubSpot may set cookies in the embedded frame.

If you book an appointment, the name, email address and any message you enter are processed by HubSpot on our behalf and stored in our CRM so that we can hold the meeting you asked for.

Legal basis: Art. 6(1)(b) GDPR for arranging a meeting you requested, and Art. 6(1)(f) GDPR for our legitimate interest in offering online scheduling. Third-country transfer: HubSpot's parent company is based in the United States, so data may be transferred there on the basis of Standard Contractual Clauses under Art. 46(2)(c) GDPR. Retention: booking records are kept for as long as the business relationship is being pursued, and deleted on request.

Other pages on this site do not load anything from HubSpot.

4. Analytics

We use Umami, an open-source analytics tool that we host ourselves on our own server. Umami does not set cookies, does not store any identifier on your device, and does not track you across websites. It records aggregated page views, referrers, approximate region derived from the IP address, and browser and device type. IP addresses are not stored.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding which pages are useful. Because nothing is stored on or read from your device, no consent is required under § 25 TTDSG. Retention: aggregated statistics only; no personal profiles are built.

5. Contacting us by email

If you write to us, your address and the content of your message are processed to answer it. Our mailboxes are operated on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as our processor. Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or its initiation, otherwise Art. 6(1)(f) GDPR. Messages are deleted once the matter is settled and no retention obligation applies.

6. The trial waitlist

The trial page links to our waitlist, a form on Google Forms that opens in a new tab. The form asks for your work email and nothing else, and needs no Google sign-in. If you join, we use the address to write to you when your trial is ready, and for no other purpose. The form runs on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as our processor.

Legal basis: Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract. Third-country transfer: Google may process the data outside the EU; the transfer rests on the Standard Contractual Clauses in Google's data processing terms (Art. 46(2)(c) GDPR), and Google LLC is certified under the EU-US Data Privacy Framework. Retention: until we have written to you about your trial, or sooner if you ask us to delete it. The form's page is Google's, not part of this site: what Google itself collects there, cookies included, is governed by Google's privacy policy.

7. The Kadmo app

The Kadmo app at app.kadmo.ai is where our customers' teams work once they have signed in. This section covers what the app's pages measure and what they keep in your browser. How we process your account and your organisation's data in the app follows the agreement between your organisation and us.

Analytics. The app's pages are measured on the same self-hosted Umami as this site, without cookies (section 4). It counts kinds of page, never their contents: the address of a goal, a workspace, a role or a record is recorded as its pattern, such as /goals/g/[handle], so no goal title, name or email address reaches the statistics. It also records how fast the pages load, and whether a sign-up succeeded or was refused, with the domain of the email address alone. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding how the app is used.

Cookies and browser storage. To keep you signed in and to remember your workspace, the app sets the cookies it needs for the service you asked for (§ 25(2) no. 2 TDDDG), and it keeps your answer to its cookie notice in your browser's storage. With your consent only: if a link with campaign parameters (utm_* or an ad's click id) brought you to the app, it keeps them in a cookie for up to 90 days, so that a sign-up can be credited to that campaign (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Refusing in the notice removes that cookie. You can withdraw your consent at any time by deleting the app's cookies in your browser, after which the notice asks again.

8. The Kadmo browser extension

The Kadmo extension for Chrome lets the Kadmo runtime, a program you run on your own computer, drive your browser for the workflows you run there. The extension talks to one place only: that runtime, over a local connection on your computer (localhost). It sends nothing to us or to anyone else, contains no analytics or error reporting, and sets no cookies.

What it handles. When a workflow asks for it: the text, structure and screenshots of the page it drives, and that tab's address and title. While the page buttons are switched on, as they are by default, the host name of each site you open, so that the runtime can tell whether a workflow has a button there; you can switch them off in the extension's toolbar menu. Sign-in credentials your runtime hands over for one site, kept in the browser's session storage to answer that site's sign-in prompt until the browser closes. While you record: your clicks, what you type into form fields, password fields included, your scrolling and the pages you move to, kept in memory until the recording stops and then handed to your runtime, which saves the recording on your computer.

Where it goes. All of this goes only to the runtime on your computer and does not reach us. What happens to it next is decided by the workflows you run: if one passes data to a service, for example an AI model provider you set up or your organisation's Kadmo workspace (section 7), that service's terms, or the agreement between your organisation and us, apply. Apart from your choice for the page buttons, and those sign-in credentials until the browser closes, the extension keeps nothing; removing it removes what it stored. Its use of this data follows the Chrome Web Store User Data Policy, including the Limited Use requirements: the data serves only the extension's single purpose, and it is never sold or used for advertising or to determine creditworthiness.

9. No cookies from us

This website sets no cookies of its own and uses no cookie banner, because there is nothing to consent to. The single exception is the HubSpot calendar described in section 3, which only loads on the booking page. The Kadmo app's cookies are described in section 7; the browser extension sets none (section 8).

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• restrict processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21) — including the analytics described in sections 4 and 7

To exercise any of these, write to legal@kadmo.ai.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

11. Changes to this policy

We update this policy when the site changes — for example if we add a service that processes data. The date at the top always reflects the current version.

Related

• Legal Notice (Imprint) — who operates this site