Personal CRM and privacy: what to look out for

A personal CRM is only as valuable as the details you keep in it: the name of someone's new partner, worries about an ill father, the dream of a sabbatical. But those same details make it one of the most sensitive places you can store data — because it's not just your data, but that of the people you care about.

This article covers what to look for when choosing and using a personal CRM. It doesn't replace legal advice, but it gives you solid orientation.

Why privacy matters so much here

A classic address book holds names and phone numbers. A personal CRM holds relationships, conversations and personal circumstances — sometimes things you were told in confidence. If such information falls into the wrong hands, is analysed for advertising or quietly shared with third parties, it doesn't just affect you but your whole circle.

So it's worth looking more closely when choosing the tool than you would for a to-do app.

Private or professional — what the GDPR says

The EU General Data Protection Regulation (GDPR) generally applies when personal data is processed. It contains an important exception, though: processing by individuals in the course of a purely personal or household activity is outside its scope (the so-called household exemption, Art. 2(2)(c) GDPR).

In practice, roughly:

• Friends and family, purely private: the household exemption usually applies. Still, treat the people you write about with respect.
• Clients, customers, business contacts: if you use your CRM professionally — for example as a freelancer or coach — the GDPR's obligations apply. Among other things, you need a legal basis, have to inform the people concerned and should check whether your provider offers a data processing agreement (DPA).

When in doubt, a short consultation is worthwhile, especially if you record particularly sensitive information (such as clients' health data).

Checklist: what to look for in a personal CRM

1. Where is the data stored?

A server location in the EU avoids many questions about transfers to third countries. Ask where the database actually lives — not just where the company is based.

2. How does the provider make money?

If a service is free and there's no visible paid model, it's worth asking how it earns money. Advertising and selling data don't fit a tool for personal relationships.

3. Who can see your data?

A personal CRM should be private by default: no public profiles, no feed, no visibility for other users. Anything you share (an invitation, for example) should be your deliberate choice.

4. How does the provider handle AI?

Many tools promise AI features. Check: is the AI optional? Who processes requests and where? Is your data used for training models? How long are requests stored?

5. Can you take your data with you and delete it?

A full export in open formats (such as CSV or JSON) and genuine account deletion are basic requirements. Your data should belong to you — not the provider.

6. Which connections are active?

Integrations (calendar, contacts, messengers) are convenient but widen the flow of data. It's good when they're voluntary, set up deliberately by you and can be disconnected at any time.

How peok handles these points

• Hosting in the EU, no ads, no selling of data.
• Private by design: only you can see your people and notes.
• AI is opt-in: the assistant is off by default. Once enabled, Mistral AI (France, EU) processes your requests; they are stored for 30 days for abuse monitoring and not used for training.
• Export and deletion: you can export your data as CSV or JSON at any time and delete your account completely.
• Integrations only on request: you connect Google Contacts and Telegram deliberately in the settings and can disconnect them at any time.

Details are in our privacy policy.

Good habits for respectful notes

Privacy isn't just a question of the tool but also of your own practice:

1. Note what helps you be a good friend or partner — not everything you know.
2. Write as if the person could read along. That keeps notes respectful and factual.
3. Tidy up regularly. You're allowed to delete outdated or no longer relevant details.
4. Be careful with particularly sensitive information such as health, religion or finances — especially when using the CRM professionally.

Conclusion

A personal CRM stores the most valuable things you know about other people. So choose a tool that takes privacy seriously — with EU hosting, no ads, optional AI and full export — and be careful with what you write down.

What a personal CRM does in general is explained in What is a personal CRM?. If you use it professionally, CRM for the self-employed helps you get started. And if you'd like to try peok: start for free.