Last updated October 25, 2026
Graabræk Data (org.nr. 938 746 346) runs Essos CRM and is responsible (the “controller”) for the personal data in your account. This page explains what we store, why, and what you can do about it.
Your account: name, email, a securely hashed password (we can't read it) and your language. Your organization's data: contacts, companies, deals or donations, tasks, activity notes, tags and custom fields, plus a log of who changed what. Feedback you send us from the app is stored with your account, your workspace and the page you were on. For security we briefly keep records of failed logins and password reset requests, identified only by one-way hashes of the email and IP address.
The people and companies your organization adds are its data. Your organization decides what to store and why, and is responsible for having a lawful basis for it (it is the controller). We store and process those records only on its behalf, to provide the service (we are its processor).
To provide the service you signed up for (our contract with you); to keep it secure and stop abuse (our legitimate interest); to send the emails the service needs, such as invites and password resets; and to handle payments and accounting as the law requires. We don't send marketing email, sell data or use it for advertising.
Only members of your organization. Data from different organizations is kept strictly separate. We look at it ourselves only when that's needed to run the service or when you ask us for help.
Vercel (hosting, servers in Frankfurt, Germany), Neon (database, Frankfurt, Germany), Resend (email delivery, Ireland) and Stripe (payments). Card details go straight to Stripe and never touch our servers. Some of these companies are based in the US; where data may leave the EU/EEA, they're bound by the EU's Standard Contractual Clauses.
One cookie keeps you logged in, one remembers your time zone so dates show correctly, and one remembers the language you picked. There are no tracking or advertising cookies, which is why there's no cookie banner.
Until you delete it. Deleting a record, a workspace or your account removes it from our database straight away; copies in our database provider's backups expire within 30 days. Records of failed logins are deleted after about a day. Feedback is kept until we delete it; if you delete your account, it is no longer linked to you. Stripe keeps payment records for as long as accounting law requires.
You can see and correct your details in Account settings and delete your account there at any time. Workspace owners can delete the whole workspace, and admins can download all of its data from Settings → Export data. You also have the right to object to or restrict how we use your data. For anything else, contact us at support@essoscrm.com.
If you think we're handling your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or the data protection authority where you live.