Privacy Policy

EIKR Intelligence OÜ ("EIKR", "we", "us", or "our") is a company registered in Estonia under registration number 17486797, with its registered address at Ehitajate tee 140, Tallinn, Estonia. We operate the EIKR CRM platform available at crm.eikr.ee. For any privacy-related questions, please contact us at support@eikr.ee.

For visitors to our website and people who contact us directly, EIKR Intelligence OÜ acts as the data controller. For personal data entered into EIKR CRM by our business customers, the customer usually acts as the data controller and EIKR Intelligence OÜ acts as the data processor. In those cases, we process personal data only to provide the EIKR CRM service, according to the customer's instructions and our Data Processing Agreement.

When you use EIKR CRM, we may collect the following categories of personal data: Account Data: Your name, email address, password stored as a secure hash, role, workspace, and login information. Company Data: Company name, industry, website, billing details, workspace settings, integrations, and email settings if you choose to provide them. CRM Data: Client contact information, organizations, pipeline records, proposals, invoices, notes, activity history, reminders, projects, files, and other data entered into the platform. Communication Data: Emails, booking confirmations, proposal messages, support requests, and transactional messages sent through or about the platform. Payment Data: Payment processing is handled by Stripe. We do not store credit card numbers. We receive payment confirmation, customer identifiers, invoice information, and subscription status from Stripe. Usage and Security Data: Technical information such as IP address, browser type, device information, authentication events, logs, and pages visited for security, debugging, fraud prevention, and performance monitoring.

We use personal data to: - Provide, operate, secure, and improve EIKR CRM - Create and manage user accounts and company workspaces - Provide CRM features such as clients, deals, proposals, invoices, reminders, templates, and reports - Send transactional emails, reminders, booking confirmations, invoice deliveries, and support messages - Process subscription payments through Stripe - Provide AI-assisted CRM features when enabled - Troubleshoot technical issues and protect the platform from misuse - Comply with legal obligations under Estonian and EU law We do not sell personal data. We do not use client CRM data for third-party advertising.

Some EIKR CRM features use third-party AI providers, including OpenAI and Anthropic, to generate drafts, summaries, pre-call briefs, follow-up suggestions, client insights, enrichment assistance, and other CRM-related outputs. When an AI feature is used, relevant CRM content may be sent to these providers for processing. This may include notes, client context, activity history, message drafts, or other information needed to generate the requested result. EIKR does not use AI providers to sell client data. EIKR does not knowingly submit client CRM data for training public AI models. We aim to use business or API-based AI services with appropriate contractual and data protection safeguards. Customers should avoid entering unnecessary sensitive personal data into AI prompts or CRM notes unless it is needed for a lawful business purpose.

Depending on the situation, we process personal data based on one or more of the following legal bases: Contract: To provide EIKR CRM and related services. Legitimate Interests: To secure, improve, debug, and operate the platform, prevent misuse, and support customers. Legal Obligation: To comply with accounting, tax, regulatory, and legal requirements. Consent: Where a specific feature, cookie, integration, or communication legally requires consent.

EIKR CRM uses technical and organizational security measures designed to protect personal data against unauthorized access, accidental loss, misuse, alteration, or destruction. These measures may include HTTPS/TLS encryption in transit, password hashing, access controls, workspace-based permissions, restricted administrative access, backups, logging, and infrastructure security controls. No online service can guarantee absolute security, but we work to keep client and user data protected with practical, risk-based safeguards.

We use trusted subprocessors and service providers to operate EIKR CRM. These may include providers for hosting, database infrastructure, payments, email delivery, AI processing, analytics, integrations, monitoring, and support. Examples may include OpenAI, Anthropic, Supabase, Hetzner, Vercel, Stripe, Google services, Slack, and email delivery providers, depending on the features used. Our Subprocessor List is available at /subprocessors. We may update this list when we add or replace service providers.

Some providers may process personal data outside Estonia or the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards such as Data Processing Agreements, Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms under GDPR.

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer period is required by law. Typical retention periods: Account data: For as long as the account is active, then deleted or anonymized after account closure unless legally required longer. CRM data: Controlled by the business customer. It is retained until deleted by the customer, exported, or removed after contract termination according to the applicable agreement. Billing and accounting records: Retained as required by Estonian accounting and tax law. Support messages: Usually retained for up to 3 years unless a longer period is needed to resolve a dispute, legal issue, or security matter. Security logs: Usually retained for 6 to 12 months unless longer retention is required for security, debugging, or legal reasons. AI prompts and outputs: Retained only where needed to provide CRM functionality, maintain feature history, troubleshoot issues, or comply with customer configuration and legal obligations.

Depending on your role and the data involved, you may have the following rights under GDPR: Right of access: Request a copy of personal data held about you. Right to rectification: Request correction of inaccurate or incomplete data. Right to erasure: Request deletion of personal data in certain circumstances. Right to restriction: Request that processing is limited in certain circumstances. Right to portability: Request personal data in a structured, commonly used, machine-readable format. Right to object: Object to certain processing based on legitimate interests. Right to withdraw consent: Withdraw consent where processing is based on consent. To exercise these rights, contact us at support@eikr.ee. If your data was entered into EIKR CRM by one of our business customers, we may redirect your request to that customer because they are usually the controller of that CRM data. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate or your local EU/EEA data protection authority.

EIKR CRM uses essential cookies and local storage required for login, authentication, security, preferences, and basic platform functionality. We do not use third-party advertising cookies on EIKR CRM. If we add optional analytics or marketing cookies in the future, we will update this policy and, where required, request consent.

EIKR CRM is a business software platform and is not intended for children. We do not knowingly collect personal data from children through the platform.

We may update this Privacy Policy from time to time. We will notify users or customers of significant changes by email, in-app notice, or another appropriate method. The updated version will be published on this page with a new last updated date.

For any questions about this Privacy Policy or personal data: EIKR Intelligence OÜ Registration: 17486797 Address: Ehitajate tee 140, Tallinn, Estonia Email: support@eikr.ee