Privacy Policy

The controller is Leonia GmbH, Gabriele-Münter-Straße 3, 82110 Germering, Germany, represented by its managing director Leonhard Benkert (“we”). For anything about privacy, write to support@personalcrm.me; a person reads and answers every request.

• Data about you: your account, how you sign in, your settings, your payments, your support emails and the technical data that comes with using a website and an app. We decide how this is processed and are the controller for it.
• Data about the people in your CRM: the contacts, notes and reminders you create. You decide what goes in; we store it and process it only to provide the Service to you. If you use PersonalCRM privately, this is your private address book and the choices are yours, while we remain responsible for keeping it safe. If you use PersonalCRM for your business, you are the controller of that data and we act as your processor under section 15 of the Terms of Service.

We never use the people in your CRM for our own purposes: no advertising, no profiling, no selling, no training of machine learning models, no combining of data across accounts.

If you do not use PersonalCRM but a user has stored your details, the following applies. A user may have stored your name, contact details, birthday, employer and role, links to your public profiles, a photo, and notes about your interactions, taken from their own knowledge, from files they imported (for example their phone contacts), or, if they added your LinkedIn URL, from the public part of that profile via our provider Bright Data (section 8). We process it solely to provide that user with their personal CRM (Art. 6(1)(b) and (f) GDPR). Only that user, the AI apps they chose to connect and our infrastructure providers (section 14) can see it; it is never shown to other users or made public. It is kept until the user deletes it or their account, and is gone from our systems within 30 days after that. You can ask for access, correction or deletion and object to the processing by writing to support@personalcrm.me; tell us what you know about who might have stored you. We act on it ourselves where we can and otherwise pass it to the user and help them answer. You can also complain to a supervisory authority (section 19).

When you open personalcrm.me, our hosting provider Vercel receives the technical data every web request carries (IP address, page, referrer, browser, time) to deliver the page and protect the site against attacks (Art. 6(1)(f) GDPR). Request logs are kept by Vercel for a few days and are not linked to your account by us.

We measure how the website and the app are used with Vercel Web Analytics. It sets no cookies and stores nothing on your device; it counts page views and derives a short-lived hash from your request that cannot be turned back into you and is discarded after the day. We see aggregate numbers, never individual profiles (Art. 6(1)(f) GDPR). Because nothing is stored on your device, no consent under § 25 TDDDG is needed and there is no cookie banner. The website loads no third-party fonts, embeds, trackers or advertising.

To run your account we process your email address; with the email code, a single-use code that expires shortly after it was sent; with Google or Apple sign-in, the identity token they return, from which we take your email address, your name if you shared it, and a stable identifier (if you use Apple’s Hide My Email, we only see the relay address); your name, taken from Google or Apple if you shared it, otherwise the part of your email address before the @ as a placeholder you can change; your time zone, detected from your browser or device so reminders arrive at the right hour; your notification settings; and a session cookie or, in the iOS app, a session token so you stay signed in. There are no passwords. Legal basis is the contract with you (Art. 6(1)(b) GDPR). The only emails the app itself sends are the sign-in code, through our authentication provider Supabase, and the confirmations for the contact, cancellation and withdrawal forms, through our email provider Resend. Google and Apple are independent controllers for the sign-in on their side; see Google’s and Apple’s privacy policies.

For each contact you can store a name, a short description, birthday, locations, interests, phone numbers, email addresses, a postal address, links to profiles (LinkedIn, Instagram, X, GitHub, Facebook, YouTube, TikTok, website), a photo, how often you want to be in touch, a priority, when you last contacted or met them, and the networks you sorted them into; plus notes and reminders linked to any number of people, saved views and your own note types. All of this lives in our database in Frankfurt (section 14). Photos are stored in a private bucket that only your account can read, through links that expire after 24 hours. We process this data solely to provide the Service: to show it to you, compute who is due for a check-in, send the reminders you asked for, back it up, and hand it to the apps you connect (Art. 6(1)(b) GDPR towards you, Art. 6(1)(f) GDPR towards the people concerned). We do not read or analyse Your Content except when the law requires it or you ask us to look at a problem.

Import files (CSV, Excel, vCard) are parsed in your browser; we only receive the contacts you confirm. In the iOS app, the address book import shows your device contacts locally and nothing leaves your phone until you pick someone. You can export all contacts and notes as CSV in Settings and everything as JSON through the API at any time.

PersonalCRM reminds you about birthdays, reminders you set, people you are falling out of touch with, and job changes it detected through the LinkedIn lookup. Every reminder is written to your in-app inbox, kept for 90 days. If you enable push notifications in the iOS app, the same reminders are sent to your device through the Apple Push Notification service; for that we store the device token Apple gives us and delete it when you sign out. Push notifications contain the names of the people they are about and are therefore visible to Apple in transit. You choose the reminder types and the hour in Settings and can turn them off (Art. 6(1)(b) GDPR and the permission you grant on your device).

When a contact has a LinkedIn profile URL, whether you pasted it into the autofill field, typed it into the contact or it came in through an import, PersonalCRM fetches the public part of that profile through Bright Data Ltd., a web data provider, and keeps it current:

• What we send: only the LinkedIn profile URL. Never the contact’s name, your name or anything else from your account.
• What comes back and is stored: the profile’s name, headline, about text, location, current company and title, the public lists of experience, education, volunteering, certifications, projects and honours, and the profile photo, stored as a snapshot attached to the contact. Headline and location are copied into the contact only if you left those fields empty; the photo only if you did not upload one. Your own entries are never overwritten.
• When: when you add the link, when you press refresh on the contact, and automatically about once a week for every contact with a link, so job changes and photos stay current.
• How to stop it: remove the LinkedIn link from the contact. Deleting the contact deletes the snapshot.
• Legal basis: our and your legitimate interest in keeping the record of someone you know accurate, using only information that person chose to make public (Art. 6(1)(f) GDPR). We fetch nothing that requires a login, and we build no database of profiles: each snapshot belongs to one contact in one account. Bright Data is based in Israel, which the European Commission recognises as providing adequate data protection; its US affiliate acts under EU standard contractual clauses; Bright Data may keep public profile data under its own terms (see Bright Data’s privacy policy).

Paid plans are sold through Stripe’s reseller Sold through Link, LLC and processed by Stripe. We never see or store your card or bank details. When you start a checkout, we pass your email address and account ID to Stripe so the purchase can be matched to your account; Stripe collects the payment details, billing address and tax information on its own pages, sends receipts and invoices, and handles refunds. Stripe and Link are independent controllers for that (see Stripe’s and Link’s privacy policies). From Stripe we store only a customer ID, a subscription ID, your plan and, if you cancelled, when it ends (Art. 6(1)(b) GDPR). Payment records stay with Stripe and Link for as long as tax law requires.

You can let other software work with your data in two ways, and nothing is connected by default. API keys you create in Settings: we store a hash of the key, a short prefix, when it was created and last used, and count requests for rate limiting; a request with your key can read and write everything in your account. Connected AI apps: AI assistants and other MCP clients connect through a consent screen that tells you which app is asking and what it will be able to do (read your contacts, notes, reminders and networks, create, change and delete any of them, and see your name and email address). When a connected app calls a tool, we hand it the data that tool returns, and it may send that data to the AI provider it runs on (such as Anthropic, OpenAI or a model you host yourself). You choose the app and the provider, and their privacy policies govern what happens next. We do not receive your conversation with the assistant, only its tool calls, and we do not log their content beyond what is needed to run and secure the Service. Connected apps have no background access, and you can revoke every connection in Settings (Art. 6(1)(b) GDPR).

When you write to support@personalcrm.me, we process your email address and what you write to answer you (Art. 6(1)(b) and (f) GDPR) and keep the conversation as long as we need it to follow up.

All connections use TLS and data is encrypted at rest. Every row in the database carries a row-level access rule so that an account can only ever read its own data, enforced by the database itself. API keys are stored as hashes, photos live in a private bucket behind short-lived signed links, no passwords are stored, and tokens issued to connected apps are locked out of the database. Production and staging are separate systems; access to production is limited to the managing director. Nightly backups are encrypted with a key only we hold before they leave our infrastructure and are deleted after 30 days. If a breach of personal data happens that is likely to put your rights at risk, we notify the supervisory authority within 72 hours and, if the risk is high, you directly.

Your account and CRM data are stored in Frankfurt, Germany. The web app and API run on Vercel, whose compute for this project also runs in Frankfurt (eu-central-1), behind a global edge network that forwards requests. Where a provider below is outside the European Economic Area, the transfer rests on an EU adequacy decision (Israel; the EU-US Data Privacy Framework for certified US companies) or on the EU Commission’s standard contractual clauses, with encryption on top. You can ask us for a copy of the clauses.

We do not sell personal data and do not share it with anyone for their own purposes. We use these companies to run the Service; they process data on our behalf under data processing agreements, except where noted as independent controllers.

Beyond that, we disclose data only if the law obliges us to, for example to a court or authority with a valid order, and we tell you unless we are legally prohibited from doing so.

You can delete your account yourself in Settings on the web or in the iOS app. Deletion is immediate and cannot be undone.

We use only what is needed to run the Service, nothing tracks you across sites, and there is no consent banner because none is required for strictly necessary storage (§ 25(2) TDDDG): session cookies (prefixed sb-) that keep you signed in; a sidebar_state cookie that remembers whether the sidebar is collapsed, for one week; local storage in your browser for your theme, board layout, recent emoji and dismissed hints; session storage for your contact list filters while a tab is open; and, on Stripe’s checkout pages, Stripe’s own fraud-prevention cookies.

Under the GDPR you can, at any time and free of charge, ask what personal data we hold about you and get a copy (Art. 15), have inaccurate data corrected (Art. 16), have your data deleted (Art. 17), which you can also do yourself by deleting your account, have processing restricted (Art. 18), receive the data you provided in a machine-readable format (Art. 20), which the export in Settings and the API give you directly, and withdraw a consent you gave with effect for the future (Art. 7(3)).

Most of these rights you can exercise yourself in the app. For everything else, email us; we may ask you to confirm from the email address on your account, and we answer within one month. You do not have to give us any personal data, but without an email address we cannot create an account. We make no automated decisions about you with legal or similarly significant effects and do not profile you; the reminders you get follow the rhythm you chose for each person.

Everything above applies to you too, and we honour the rights in section 17 for everyone, wherever you live. We do not sell personal information, do not share it for targeted advertising, and do not track you across websites; we therefore do not respond to Do Not Track or Global Privacy Control signals, as there is no tracking to disable. If you are in the United Kingdom or Switzerland, the UK GDPR or the Swiss Data Protection Act give you the same rights, and you can complain to the ICO or the FDPIC as well as to us.

If you believe we are processing your data unlawfully, please contact us first at support@personalcrm.me; we take every complaint seriously and respond to it. You also have the right to complain to a data protection supervisory authority, either where you live or with the authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

PersonalCRM is not directed at children. You must be at least 16 to create an account. We do not knowingly collect data from anyone younger and delete such accounts when we learn of them.

We update this policy when the Service, our providers or the law change, and tell you in the app or by email before changes that matter to you take effect; the date at the top shows the last revision. Contact: Leonia GmbH, Gabriele-Münter-Straße 3, 82110 Germering, Germany, support@personalcrm.me. Company details are in the Legal Notice.