Sub-processors
Last updated
These are the third-party services that process personal data to run Shmor, what each one does, where it processes data and the legal mechanism for any transfer outside the UK. We require each of them, by contract, to protect personal data and use it only on our instructions. We will update this page, and tell account owners, before adding or replacing a provider that processes the details of the people you capture.
Current sub-processors
| Provider | Purpose | Personal data involved | Data location | Transfer mechanism |
|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd) | Database and sign-in | Account details, linked accounts, Shmor addresses and allowed sender addresses, encrypted CRM tokens, settings, usage records, conversation references, and ShmorCRM records (people, companies, deals, tasks, notes and capture text) | The region we choose for our project: London (eu-west-2) | Storage in the UK: no transfer. Access by Supabase from outside the UK: the UK Addendum to the EU Standard Contractual Clauses, in Supabase’s data processing agreement |
| Vercel (Vercel Inc.) | Website and application hosting, webhooks from Telegram and Resend | Requests to the site, including IP addresses; Telegram messages and the details of forwarded emails (such as sender, recipients and subject) passing through the webhooks | Functions run in London (lhr1). Vercel states its primary processing facilities are in the US | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge); Vercel Inc. is certified. The UK Addendum in Vercel’s data processing agreement for anything the certification does not cover |
| Trigger.dev (API Hero Ltd) | Background processing of each message and forwarded email | Message text and references to images and audio, while a message is processed and in run history | United States (AWS us-east-1) | The UK Addendum to the EU Standard Contractual Clauses, in Trigger.dev’s data processing agreement |
| OpenAI (OpenAI OpCo, LLC) | Reading images, transcribing voice notes and extracting details | Images, audio and text you send or forward, and what is extracted from them | United States | The UK Addendum to the EU Standard Contractual Clauses, in OpenAI’s data processing addendum |
| Telegram (Telegram Messenger Inc.) | Delivering messages between you and the Shmor bot | Your Telegram user ID, and the messages, images and voice notes you send to Shmor | Telegram states UK users’ data is stored in the Netherlands | Telegram’s own terms for bots; Telegram processes chats as an independent service you use |
| Stripe (Stripe, LLC and Stripe Payments Europe, Limited) | Payments and subscriptions | Billing details, email address, payment card details (held by Stripe) | US, and other countries where Stripe operates | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge); Stripe, LLC is certified |
| Resend (Plus Five Five, Inc.) | Sending email, such as sign-in links, billing notices and Shmor’s replies to forwarded emails; receiving the emails you forward to Shmor | Email addresses and message content, including the emails and attachments you forward. Resend keeps received emails under its own retention policy (it states 30 days for email data on its standard plans) | Sending from the EU (Ireland); receiving in the region of our receiving domain; account data and logs in the US | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge), and the UK Addendum in Resend’s data processing agreement |
| Sentry (Functional Software, Inc.) | Error monitoring | Error reports and technical data; message text, contact details and tokens are excluded | Event data in the region chosen for our account; account metadata in the US | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge); Sentry is certified. The UK Addendum as a fallback |
| Google (Google Analytics 4, Google LLC) | Website analytics, only with your consent | Pages visited with IDs removed, events, device and approximate location | US | The UK Extension to the EU-US Data Privacy Framework (UK-US data bridge); Google LLC is certified |
| Slack | Internal notifications to our team (new accounts, purchases and plan changes, payment problems, CRM connections, first captures and limits reached, integration requests) | Your account email address, organisation ID, plan and amounts, the name of the CRM workspace you connect, and the note in an integration request where relevant. Never message text or the details of the people you capture | UK | None needed: the data is held in the UK |
Planned
Shmor on WhatsApp is coming soon and is not available yet. When it is, messages will be delivered through Meta’s WhatsApp Business Platform, and we will add Meta to the list above, and tell account owners, before it processes any personal data for Shmor.
Services you choose
These receive personal data on your instructions, under your own agreements with them. They are not our sub-processors, but they are part of how Shmor works for you. ShmorCRM, the CRM built into Shmor, is not listed here: it is part of Shmor and its records are stored with Supabase, above.
| Service | What it receives | Who you contract with |
|---|---|---|
| Attio | The people, companies, notes, tasks and deals Shmor writes, if you connect Attio | Attio Limited (England and Wales), for customers outside the US |
| HubSpot | The contacts, companies, notes, tasks and deals Shmor writes, if you connect HubSpot | HubSpot UK Holdings Limited, for a UK address |
| Apollo | LinkedIn links you send, if you add your own Apollo API key | ZenLeads, Inc. (Apollo.io), US |
What the transfer mechanism column means
Where a provider is based in, or may access data from, a country outside the UK, UK law requires a lawful basis for the transfer. For each provider we rely on one of the following, as shown in the table:
- UK adequacy regulations, where the country is recognised by the UK as providing adequate protection;
- the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), where a US provider is certified under it; or
- the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
Questions
For more about how we handle personal data, see our privacy notice and data processing addendum, or contact us at hello@metamindz.co.uk.