Who we are
Spolt AS (org. no. 935 789 192), Oslo, Norway, makes Spolt CRM and runs spolt.io. Contact us about privacy at privacy@spolt.io.
For the data your organisation puts into Spolt CRM, including connected mailboxes, your organisation is the controller and Spolt is its processor. We process that data only to provide the service and on your organisation's instructions. For account details, billing contacts and visits to this website, Spolt is the controller.
What we collect
- Account data: your name, email address and workspace membership. You sign in with a one-time code sent to your email.
- CRM data: the people, companies, deals, notes, tasks, meetings and files you and your colleagues add.
- Mailbox data: when you connect Gmail or Outlook, we import messages from the period you choose and then sync new ones. We store sender, recipients, subject, date, labels, the plain-text body and the names of attachments. We do not store attachments.
- Usage data: technical logs needed to run and secure the service, and records of AI usage for billing and limits.
This website sets no cookies and runs no analytics or advertising scripts.
Connected mailboxes
With Gmail we ask for the gmail.modify permission. With Microsoft 365 and Outlook we ask for Mail.ReadWrite, Mail.Send, User.Read and offline_access. We use them to:
- read messages so they appear on the right records in Spolt CRM;
- send, reply and save drafts as you, only when you or a workflow your workspace set up asks for it;
- keep the mailbox in sync after you connect it.
We do not use mailbox data for advertising, do not sell it, and do not let people read it except you, the colleagues your workspace settings allow, or our staff when you ask for support, when security requires it, or when the law requires it.
Spolt CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
AI processing
Spolt CRM uses AI models to sort and summarise mail, draft replies, answer questions about your data and search it. To do this, the relevant mail and CRM content is sent to the model providers below, through Vercel AI Gateway, and the result is returned to Spolt. The providers process it under commercial terms that do not allow them to train their models on it. Spolt does not train models on your data either.
If you add your own Anthropic API key, requests made with it go to Anthropic under your own agreement with them.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Stockholm, Sweden |
| Vercel | Hosting, application servers, AI Gateway | Stockholm, Sweden for servers; global network for the website |
| Anthropic | AI models (Claude) | United States |
| Amazon Web Services (Bedrock) | Search embeddings and ranking (Cohere models) | Processing only, nothing retained |
| Resend | Sign-in codes and notification email | EU (Ireland) |
| Google, Microsoft | Mailbox access you connect | According to your own account |
Transfers outside the EU and EEA rely on the EU Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. We will update this list before adding a new sub-processor.
Legal basis
We process account and CRM data to perform our contract with your organisation (GDPR art. 6(1)(b)), and logs and security data in our legitimate interest in running a safe service (art. 6(1)(f)). Mailbox data is processed on your organisation's behalf, on its legal basis.
How long we keep data
- Disconnecting a mailbox revokes our access at Google or Microsoft and deletes its synced messages and everything Spolt derived from them, such as summaries and search entries.
- Deleted records and files can be restored for 30 days and are then permanently removed.
- Closing an account or workspace: email privacy@spolt.io and we delete the data within 30 days. Database backups roll over within a further 7 days.
Security
See Security for how we protect data, including encryption of mailbox access tokens and workspace isolation.
Your rights
You can ask for access to, correction of, deletion of, or a copy of your personal data, and object to or restrict processing. If your data is in a workspace run by your employer, we will pass your request to them or handle it with them. Write to privacy@spolt.io. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or your local authority.
Children
Spolt CRM is a business service and is not meant for anyone under 16.
Changes
We will post changes here and update the date above. If a change matters for how we use your data, we will tell workspace owners by email first.