Privacy notice
Last updated
This notice explains what personal data Shmor processes, why, on what lawful basis, how long it is kept, who receives it and what rights you have under UK data protection law, including the UK GDPR and the Data Protection Act 2018. It covers the website, the app (including ShmorCRM, the simple CRM built into Shmor), the Shmor bot on Telegram, the emails you forward to Shmor (in@emails.useshmor.com or your private forwarding address), and the emails we send. Shmor on WhatsApp is coming soon and is not available yet; we will update this notice before it is.
Who is responsible for your data?
Shmor is operated by Metamindz Limited, a company registered in England and Wales with company number 11831397, registered office 71-75 Shelton Street, London, WC2H 9JQ. We are registered with the Information Commissioner’s Office under registration number ZB187231.
We play two different roles:
- Controller, for our customers’ data. For your account, billing, support, security and analytics data, we decide how and why it is used, and we are the controller.
- Processor, for the people our customers capture. When you send Shmor a message or forward an email about someone you met (a business card, a screenshot, a voice note, a LinkedIn link, an introduction or text), the personal data about that person is processed on your behalf. You, the customer, are the controller of it, and we process it only to save it to the CRM you chose and, if that is ShmorCRM, to store it there for you, on the terms of our data processing addendum.
If your details were captured by one of our customers, they are in that customer’s CRM. If the customer uses Attio or HubSpot, we do not keep them. If the customer uses ShmorCRM, we store them on the customer’s behalf, but the customer still decides how they are used and how long they are kept. Please contact the person or business who met you first, since they decide how your details are used. You can also contact us and we will pass your request on and help them respond.
You can reach us about privacy at hello@metamindz.co.uk.
What data do we collect about our customers?
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Email address, display name, the version of the terms you accepted and when | You |
| Linked messaging accounts | Your Telegram user ID and the chat ID | You, when you link an account, and Telegram |
| Email channel | Your private forwarding address (a random code you can replace), the extra addresses you add to forward from, a fingerprint (hash) of each confirmation link while it is valid, and the Resend ID of each email you forward | You, our service and Resend |
| CRM connection | Which CRM you use (ShmorCRM, Attio or HubSpot), and for Attio or HubSpot the workspace or portal name and ID, your CRM user ID, and an access token (encrypted) | You and your CRM |
| Apollo key | Your own Apollo API key, if you add one (encrypted; it cannot be read back) | You |
| Settings | Timezone, follow-up preferences, a short description of your business, transcription keywords, field mappings, and ShmorCRM settings such as deal stages, custom fields and auto-delete | You |
| Usage records | Captures used, the processing cost of each message, outcome codes such as “created” or “updated”, CRM record IDs, and timestamps | Our service |
| Conversation references | The CRM record ID behind each reply card Shmor sends you, the card’s message ID and chat ID, and delivery keys made of message IDs | Our service |
| Billing details | Your Stripe customer reference, plan, subscription status and invoices. Stripe handles your card details; we never see your full card number | You and Stripe |
| Security and technical data | IP address, request logs and error reports | Your device and our service providers |
| Analytics data, only with your consent | Pages visited with any IDs removed, events such as signing up, starting a checkout, a purchase (plan and amount, without payment details), connecting a CRM or linking a chat, approximate location, device and browser type | Google Analytics, through cookies, if you accept them |
| Messages to us | Emails and support requests you send us, and our replies | You |
What happens to the details of the people you capture?
- Shmor receives your message through Telegram, or an email you forward to Shmor through our email provider, Resend. It sends the image, audio or text to OpenAI to read the details, and writes the result to the CRM you chose: ShmorCRM, Attio or HubSpot.
- If you use Attio or HubSpot, Shmor’s own database does not store the images, audio or text of your messages or emails, or the names, contact details or other information about the people you capture. It keeps only the CRM record IDs and message IDs described above, and passes everything else through to your CRM.
- If you use ShmorCRM, Shmor stores the people you capture for you, as your processor: people, companies, deals, tasks and notes, and the text of each message, forwarded email or voice transcript that created or updated a person. It never stores the images or audio. You and the members of your organisation can view, edit, export (as CSV) and delete these records in the app at any time. They stay until you delete them, or until your auto-delete setting removes them: see “How long do we keep it?” below. ShmorCRM and Attio or HubSpot never sync, so records in one are not copied to the other.
- Emails you forward are accepted only from your account email address or another address you have confirmed, and Shmor uses the SPF, DKIM and DMARC results that Resend reports to reject mail that appears to be spoofed. Shmor reads the text and up to 5 attachments. It does not store the email or its attachments after processing, except the capture text in ShmorCRM described above. Resend keeps received emails under its own retention policy: see below.
- While a message or email is being processed, it passes through some of our providers, which hold it for a limited time: see “How long do we keep it?” below.
- We never use your messages or the people in them to train AI models. Under OpenAI’s API terms for our account, OpenAI does not use our API data to train its models.
- Our staff do not look at your messages unless you ask us to as part of a support request, or we must do so to investigate a security incident, abuse of the service or a legal requirement.
Why do we use your data, and on what lawful basis?
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing Shmor: linking your messaging accounts, giving you a Shmor address, processing your messages and forwarded emails, writing to your CRM, replying to you | Account, linked accounts, email channel, CRM connection, settings, conversation references | Contract: we need it to provide the service you asked for |
| Checking that forwarded emails really come from you: allowed sender addresses, SPF, DKIM and DMARC results, duplicate and rate-limit checks | Email channel data, Resend email IDs | Legitimate interests in protecting your account and our service from misuse |
| Metering captures, enforcing plan limits and cost limits | Usage records | Contract |
| Taking payments, managing subscriptions and keeping accounting records | Billing and account details | Contract, and legal obligation to keep tax records |
| Sending service emails, such as sign-in links, trial and billing notices | Email address | Contract |
| Keeping Shmor secure: verifying webhooks, preventing abuse, investigating misuse | Security and technical data, usage records | Legitimate interests in protecting our customers and our service |
| Fixing errors and improving the service | Error reports and logs, which exclude message text, contact details and tokens | Legitimate interests in running a reliable service |
| Understanding how visitors use the website and app | Analytics data | Consent, which you can withdraw at any time |
| Answering your messages | Messages to us, account details | Contract or legitimate interests, depending on the request |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against yours. You can object; see “Your rights” below.
This table covers the data we control. For the people you capture, including the records you keep in ShmorCRM, you are the controller and decide the lawful basis; we process that data only on your instructions.
How long do we keep it?
| Data | Kept for |
|---|---|
| One-time link codes for Telegram | 15 minutes |
| CRM sign-in state during connection | 10 minutes |
| “Waiting for your reply” markers | 15 minutes |
| Delivery keys (to ignore duplicate deliveries) | 7 days |
| Resend IDs of forwarded emails (to ignore duplicates and apply rate limits) | 7 days |
| Email confirmation link fingerprints | Until the link is used, or up to 24 hours |
| Conversation references (CRM record ID and message ID of each reply card) | 30 days |
| ShmorCRM records: people, companies, deals, tasks, notes and the text of the messages, emails and transcripts behind them | Until you delete them, delete all records, or close your account. If you switch on auto-delete, records with no update for 6, 12 or 24 months (your choice) are deleted automatically. Deleting a person also deletes the message text kept with them. Records stay when your plan ends (read-only) and when you switch to Attio or HubSpot |
| Account details, linked accounts, Shmor address and extra sender addresses, CRM connection, settings | Until you delete your account or disconnect, replace or remove them |
| Usage records | Until you delete your account |
| Stripe invoices and billing records | 6 years, as tax records |
| Messages to us | 24 months after our last contact with you |
| Analytics data | 2 months (Google Analytics’ data retention setting) |
Held by our providers while a message is processed:
| Provider | What | Kept for |
|---|---|---|
| Telegram | Your chat with the Shmor bot | Under Telegram’s own privacy policy, as for any Telegram chat |
| Resend | Emails you forward to Shmor, with their attachments, and the replies Shmor sends you | Under Resend’s own retention policy. Resend states that it keeps email data, including content, for 30 days on its standard plans. Resend offers us no way to delete a received email sooner |
| Trigger.dev | The job that processes each message or forwarded email, which may include its text and references to any image or audio | Up to 30 days, the run history period of our Trigger.dev plan |
| OpenAI | The image, audio or text sent for reading | Up to 30 days, for abuse monitoring under OpenAI’s API terms |
| Vercel | Request logs, including IP addresses | Vercel’s log retention for our plan |
When you delete your account, we delete your account data, linked accounts, Shmor address, CRM connection and ShmorCRM records. Export your ShmorCRM records first if you want to keep them. Billing records are kept for the period above because the law requires it.
Who do we share it with?
- Service providers that host and run Shmor for us, under contracts that require them to protect your data and use it only on our instructions. They are listed, with what each one does and where it processes data, on our sub-processors page.
- The services you choose: if you connect Attio or HubSpot, it receives what Shmor writes, and Apollo receives the LinkedIn links you send if you add your own Apollo key. These act on your instructions under your own agreements with them. ShmorCRM is part of Shmor, so records kept there are not shared with another CRM.
- Professional advisers, such as lawyers and accountants, where needed.
- Authorities, where the law requires us to.
- A buyer or successor, if our business or Shmor is sold or reorganised, under the same protections.
We do not sell personal data.
Is data transferred outside the UK?
Some of our service providers are based in, or process data in, the United States, the European Economic Area or other countries. Where data leaves the UK, we rely on a lawful transfer mechanism: UK adequacy regulations (for example for the EEA), the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where a US provider is certified, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. The mechanism for each provider is shown on our sub-processors page.
How do we protect it?
- Data is encrypted in transit.
- CRM access tokens and Apollo keys are encrypted at rest with AES-256-GCM before they are stored, and cannot be read back through the app.
- Database access is restricted so that each account can reach only its own data. ShmorCRM records can be reached only by members of your organisation.
- Webhooks from Telegram, and from Resend for forwarded emails, are verified before anything is processed.
- Forwarded emails are accepted only from addresses you have allowed, and mail whose SPF, DKIM or DMARC results show it is likely to be spoofed is dropped.
- Our logs record event names and error codes, never message text, contact details or tokens. For forwarded emails they record Resend’s email ID and the outcome only.
Your rights
You have the right to:
- access the personal data we hold about you;
- correct data that is wrong or incomplete;
- erase your data;
- restrict how we use it;
- object to our use of it where we rely on legitimate interests;
- data portability: receive data you gave us in a reusable format; and
- withdraw consent at any time, where we rely on consent. Withdrawing does not affect processing before you withdrew.
To make a request, email hello@metamindz.co.uk from the address on your account. If you use ShmorCRM, you can also see, correct, export and delete the records you keep there yourself, in the app.
If you are someone a customer captured and they keep your details in ShmorCRM, the customer is the controller and handles your request. If you contact us, we will pass it on to them and help them respond, as our data processing addendum requires. We will respond within one month, and tell you if we need longer for a complex request, as the law allows.
You can change your cookie choice at any time using “Cookie settings” at the bottom of any page.
Automated processing
Shmor uses an AI model to read the details in your messages and forwarded emails and decide what to write to your CRM. These decisions are about filling in records you asked for. We do not make decisions about people that have legal or similarly significant effects on them.
Children
Shmor is intended for adults using it for their work. You must be 18 or over to use it.
Complaints
If you are unhappy with how we handle your data, please contact us first at hello@metamindz.co.uk. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, telephone 0303 123 1113.
Changes to this notice
We will update this notice when our practices change and show the date of the latest version at the top. If a change materially affects you, we will tell you by email or in the app.