Security
Your contacts, kept where you choose.
Shmor is designed to keep as little as possible. With Attio or HubSpot connected, it reads each message, writes the result to your CRM, and keeps only the IDs and counts it needs to work and to bill you. With ShmorCRM, it stores your contacts for you, as text only, until you delete them.
Not stored
What Shmor’s database never holds.
- The photos, screenshots and voice notes you send, whichever CRM you use.
- The emails and attachments you forward, once they are processed (ShmorCRM keeps only the capture text).
- With Attio or HubSpot connected: the text of your messages, the names, emails, phone numbers or other details of the people you capture, and the notes, tasks or anything else Shmor writes to your CRM.
Stored
What it does hold, and for how long.
- Your account
- Email address, display name, which version of the terms you accepted, and your settings.
- Linked chat apps
- Your Telegram user ID and chat ID, so messages from you reach your account. WhatsApp, coming soon, will store your number and chat ID the same way.
- ShmorCRM, if you use it
- People, companies, deals, tasks and notes, and the text of the message, email or voice transcript behind each capture. Never the photos or audio. Kept until you delete them: export them as CSV, delete everything at once, or have records with no update for 6, 12 or 24 months deleted automatically. If your plan ends, they stay, read-only.
- Email channel
- Your private forwarding address and the extra addresses you forward from. The IDs of forwarded emails are deleted after 7 days.
- CRM connection
- Which CRM you use and, for Attio or HubSpot, the workspace or portal name and the access token, encrypted.
- Apollo key
- Only if you add one, encrypted, and never shown again after you save it.
- Conversation references
- The CRM record ID behind each card Shmor sends you, and that card’s message ID, deleted after 30 days. They let a reply reach the right person.
- Duplicate guard
- Delivery keys made of channel, chat and message IDs, deleted after 7 days, so a message delivered twice is processed once.
- Usage and activity
- Counts, costs, timestamps, outcome codes such as “created” or “updated”, and the CRM record ID involved. No names or message text.
- Billing
- Your plan and Stripe references. Card details are held by Stripe, not us.
In transit
Where a message goes on its way to your CRM.
Your message passes through a few providers. Each processes it for us under contract; some keep it for a limited time.
- Telegram
- Delivers your message to Shmor. Telegram stores chats under its own privacy policy. WhatsApp is coming soon; once it is available, Meta will keep WhatsApp Business Platform messages for up to 30 days.
- Resend
- Receives the emails you forward to in@emails.useshmor.com or your private address, and sends Shmor’s replies. Resend keeps received emails under its own retention policy (it states 30 days for email data) and offers no way for us to delete them sooner.
- Trigger.dev
- Runs the background job that processes each message. The job’s input (your message text and references to any photo or audio) is kept in its run history for a limited period.
- OpenAI
- Reads the image, audio or text and returns the details. Under OpenAI’s API terms, the data is not used to train models, and may be kept for up to 30 days for abuse monitoring.
- Your CRM
- ShmorCRM, Attio or HubSpot, where the result is written. That is where the contact lives from then on.
The full list, with locations and transfer safeguards, is on the sub-processors page.
Controls
How it is protected.
- CRM access tokens and Apollo keys are encrypted at rest with AES-256-GCM, with versioned keys so they can be rotated.
- Credentials cannot be read back through the app or its API by anyone, including you.
- Every database table is locked down by default. Each account can only reach its own rows, and changes go through checked functions.
- Webhooks from Telegram and Resend (and from WhatsApp, once available) are verified (secret token or signature) before anything is processed.
- Forwarded emails are accepted only from your account email or addresses you have confirmed. Mail to in@emails.useshmor.com must also pass DMARC, and SPF, DKIM and DMARC results are used to reject spoofed mail.
- ShmorCRM records can be reached only by members of your organisation.
- Application logs record event names and error codes, never message text, contact details or tokens.
- All traffic is encrypted in transit (HTTPS).
UK GDPR
Who is responsible for what.
For the people you capture, you are the controller and Shmor is your processor: we act only on your instructions, which are to write them to your CRM, or to keep them in ShmorCRM until you delete them. Our data processing addendum sets that out. For your own account data, Shmor’s operator, Metamindz Limited, is the controller; see the privacy notice.
Found a security issue? Email hello@metamindz.co.uk and give us reasonable time to fix it before disclosing it.
Related
- Privacy noticePrivacy notice under UK GDPR, including the retention schedule.
- Data processing addendumData processing addendum (UK GDPR Article 28) for customers.
- Sub-processorsList of sub-processors, purposes, data locations and transfer mechanisms.
- How it worksSetup (ShmorCRM or Attio or HubSpot; Telegram or email), what Shmor reads from each kind of message, what it writes to the CRM, follow-up questions and duplicates.
- FAQConsolidated answers about inputs, ShmorCRM and other CRMs, chat apps and email, captures, privacy, billing and cancelling.
- ContactSupport, billing, privacy and security contact details.
See it work on your next contact.
14 days and 25 captures free, no card. Start in ShmorCRM or connect your CRM, link Telegram or forward an email, and send your first contact.