Data processing addendum
Last updated
This data processing addendum (“addendum”) forms part of our terms of service between you, the customer, and Metamindz Limited (“we”, “us”). It applies when we process personal data on your behalf in providing Shmor, and sets out the terms that Article 28 of the UK GDPR requires. If this addendum and the terms conflict on data protection, this addendum wins.
1. Roles
1.1 For the personal data in the messages and emails you send to Shmor, in the records Shmor reads and writes in your CRM, and in the records you keep in ShmorCRM, the CRM built into Shmor (“customer personal data”), you are the controller and we are your processor.
1.2 For your own account, billing, support, security and analytics data, we are an independent controller, as described in our privacy notice. This addendum does not apply to that data.
2. Our obligations as processor
2.1 Instructions. We process customer personal data only on your documented instructions, which are: these terms and this addendum; your use of Shmor’s features (for example sending a message, tapping a button or changing a setting); and any further written instructions you give us that are consistent with them. We will tell you if we think an instruction breaks UK data protection law. If the law requires us to process customer personal data otherwise, we will tell you first unless the law forbids it.
2.2 Confidentiality. Everyone we authorise to process customer personal data is bound by a duty of confidentiality.
2.3 Security. We take the technical and organisational measures in Annex 2 to protect customer personal data, as Article 32 of the UK GDPR requires.
2.4 Sub-processors. You give us general authorisation to use the sub-processors listed on our sub-processors page. We will update that page, and tell account owners by email, at least 14 days before adding or replacing a sub-processor that processes customer personal data. You may object on reasonable data protection grounds within that period; if we cannot address the objection, you may end your subscription and we will refund any prepaid amount for the period after it ends. We impose data protection obligations on each sub-processor equivalent to those in this addendum, and remain responsible to you for their performance.
2.5 Your recipients. Your CRM (Attio or HubSpot) and, if you add your own key, Apollo receive customer personal data on your instructions under your own agreements with them. They are not our sub-processors.
2.6 Data subjects’ requests. Taking into account what Shmor stores (see 3.2), we will help you respond to requests from people exercising their rights. Where the people you capture are held in Attio or HubSpot, most requests will be answered there. Where they are held in ShmorCRM, you can find, correct, export and delete their records yourself in the app. If we receive a request directly, we will pass it to you without undue delay and will not respond ourselves unless you ask us to.
2.7 Assistance. We will give you reasonable help with your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the nature of the processing and the information available to us.
2.8 Personal data breaches. We will tell you without undue delay after becoming aware of a personal data breach affecting customer personal data, with the information we have and then further information as it becomes available.
2.9 Deletion at the end. When your account is closed, we delete the customer personal data we hold, including your ShmorCRM records, unless the law requires us to keep it. You can export your ShmorCRM records as a CSV file at any time before then, which is how we return them. Data Shmor wrote to Attio or HubSpot is already in that CRM, so there is nothing to return.
2.10 Information and audits. We will make available the information reasonably needed to show that we meet this addendum, and allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice, no more than once a year unless there has been a breach, and at your cost.
3. Processing details
3.1 The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are in Annex 1.
3.2 What Shmor keeps depends on the CRM you use:
- With Attio or HubSpot connected, Shmor is designed not to keep customer personal data. Its database holds CRM record IDs and message IDs for a limited time, and no names, contact details, images, audio or message text.
- With ShmorCRM, Shmor stores the people, companies, deals, tasks and notes in it, and the text of the messages, forwarded emails and voice transcripts that created or updated each person. It never stores images or audio. These records are kept until you delete them, or until your auto-delete setting (6, 12 or 24 months without an update) removes them. When your plan ends they become read-only and stay until you delete them.
Shmor does not store the bodies or attachments of emails you forward beyond processing them, except the capture text in ShmorCRM. Our email sub-processor, Resend, keeps received emails under its own retention policy. Some sub-processors hold message content for a limited time while it is processed, as set out in our privacy notice.
4. International transfers
We may transfer customer personal data outside the UK only under a lawful transfer mechanism: UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. The mechanism for each sub-processor is on our sub-processors page.
5. Your obligations
You are responsible for having a lawful basis to collect the personal data you send to Shmor and to hold it in your CRM, including ShmorCRM, for deciding how long to keep it there, for being entitled to forward the emails you send to Shmor, for telling the people concerned where the law requires it, and for the accuracy of your instructions.
6. Liability and law
The limits of liability in the terms apply to this addendum. This addendum is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.
Annex 1: Details of processing
| Item | Details |
|---|---|
| Subject matter | Adding people the customer has met, and their companies, to the customer’s CRM, and storing them in ShmorCRM where the customer uses it |
| Duration | For as long as the customer uses Shmor; ShmorCRM records until the customer deletes them or the customer’s auto-delete setting removes them; and the retention periods in the privacy notice afterwards |
| Nature of processing | Receiving messages through Telegram and emails forwarded to the customer’s Shmor address (received by Resend); checking the sender and the email’s authentication results; downloading images, audio and attachments; transcribing audio; extracting details with an AI model; searching, creating and updating records in the customer’s CRM; adding notes, tasks and deals; storing, showing, editing, exporting and deleting records in ShmorCRM; replying to the customer |
| Purpose | To keep the customer’s CRM up to date with the people they meet, on their instructions |
| Categories of data subjects | People the customer meets or is introduced to, such as prospects, clients, partners, investors and candidates; people named in the customer’s messages; senders, recipients and people named in the emails the customer forwards |
| Types of personal data | Name, job title, company, work and personal contact details (email, phone), LinkedIn URL, location, images of business cards, badges, profiles or email signatures, voice recordings that may contain these details, the text and attachments of forwarded emails, notes about the relationship and follow-up, deals, and, in ShmorCRM, the text of the messages, emails and voice transcripts behind each record |
| Special category data | Not required by the service. Customers must not send it (see the acceptable use policy) |
Annex 2: Security measures
- Encryption in transit (HTTPS) for all traffic to and from Shmor and between Shmor and its providers.
- CRM access tokens and Apollo keys encrypted at rest with AES-256-GCM, with versioned keys so they can be rotated, and not readable through the app by anyone.
- Data minimisation by design: with Attio or HubSpot, no storage of message content or captured people’s details in Shmor’s database; in ShmorCRM, text only (never images or audio), with deletion and auto-delete controlled by the customer; no storage of forwarded email bodies or attachments beyond processing; short, automatic retention for the identifiers Shmor keeps.
- Database row-level security on every table, denying access by default; each customer can reach only their own organisation’s rows; changes go through checked database functions.
- Verification of every incoming webhook from Telegram (secret token) and Resend (signature) before processing.
- Forwarded emails accepted only from the member’s account email or addresses they have confirmed; SPF, DKIM and DMARC results used to reject spoofed mail, with a DMARC pass required on the shared address in@emails.useshmor.com; per-member rate limits; a private forwarding address made of a random code that the member can replace.
- Application logs limited to event names, providers and error codes, never message text, contact details or tokens.
- Access to production systems limited to staff who need it.
- Sub-processors chosen for their security commitments and bound by data processing agreements.