Who we are and how to contact us
This policy covers Cmora at heycmora.com and its email writing and design app. Cmora is operated by Telman Gadimov, an individual, who is responsible for the account and service data described here. Our contact address is 23 Ahmad Rajabli, Baku 1005. For privacy questions or requests, email hello@heycmora.com.
Information we collect
- Accounts and sign-in. Your email address, account dates, sign-in activity and team membership. If you set a password, we store a password hash, not the password. Email sign-in codes and links are stored as hashes. If you use Google, we receive your verified email address and Google account identifier; we do not request access to your Gmail inbox.
- Your brands and work. Website addresses, public page text and images, logos, colours and fonts; brand settings, company and footer details, writing samples and notes you provide; saved email subjects, designs, templates, versions and sharing settings. Instructions and recent conversation context are processed when you ask AI to write or edit.
- Connected tools. Credentials you enter, the provider and account name, and choices such as sender and audience identifiers. We store connection credentials encrypted and use them to perform the actions you request.
- Purchases and support. Subscription and license identifiers, payment status, credit balances and usage records, plus information you send us for support or integration requests. Payment providers collect payment and billing details; Cmora does not store your full card number.
- Technical data. Requests reach our hosting and service providers with information such as an IP address and browser details. Our application uses a salted hash of your IP address for network abuse limits. Hosting logs and analytics may process technical information separately, as described below.
How we use information
We use this information to sign you in, read your website, generate and save emails, enable team work, connect your tools, manage purchases and credits, answer support requests, prevent abuse, and understand how the service is used.
We send service emails such as sign-in codes, team invitations, and a notification when your first emails are ready. Signing in does not itself subscribe you to a marketing newsletter. We do not sell your personal information.
Where data protection law requires a legal basis, we process data to provide the service you request, meet legal obligations, and pursue legitimate interests in security, support and service improvement. If we ask for your consent to a particular use, you can withdraw that consent.
AI writing and editing
We send Anthropic the content needed for your request: relevant website text and image previews, brand details and writing samples, your email design and words, and editing instructions or recent conversation context. Content you include can contain personal information, so only provide information you are entitled to share.
We use Anthropic's commercial API. Anthropic says commercial inputs and outputs are not used for model training by default. Its retention and exceptions are described in its commercial data policy and retention policy.
Service providers and connected tools
We use Vercel for hosting, MongoDB for database storage, Anthropic for AI, Resend for service email, Google for optional sign-in, Polar for website purchases, and AppSumo for purchases made there. These services receive the information needed for their role. For example, Resend processes your address and service email content; Polar receives your account identifier, email address and order information. See Polar's privacy policy for its payment processing.
When you connect a sending tool or webhook, we use its API to read the account, sender or audience options needed and send the content you choose as a draft, template or post. This does not move your subscriber list into Cmora. That provider handles the copy it receives under its own policies. Disconnecting removes the saved connection from Cmora; it does not delete drafts already created in the other service. You can also revoke the key at the provider.
We may disclose information when required by law or necessary to protect the service and its users. Providers may process information in countries other than yours. Where required, international transfers must use the safeguards applicable under data protection law.
Cookies, browser storage and analytics
Cmora uses cookies to keep you signed in, protect sign-in flows, remember your last brand and carry a pending AppSumo activation through sign-in. Blocking these cookies can prevent those features from working.
We use DataPulse analytics to measure page visits, time on pages, referral sources, campaign parameters and browser viewport width. It stores a random visitor identifier in local storage and session information in session storage. When you start a purchase, we may include that visitor identifier in Polar checkout metadata to connect a visit with a purchase.
The current DataPulse script skips collection when your browser sends Do Not Track. You can also block the analytics script and clear its local and session storage through your browser settings. Clearing storage alone does not prevent a new identifier on your next visit. To ask about deleting analytics records, contact us.
Retention and deletion
We keep account details and saved work while your account is open so you can return to it. You can delete saved work and connections in the app, or delete your account in Settings. Account deletion ends its running subscriptions and removes its saved brands, emails, versions, templates, connections, credit records and profile from the active application database. If you are a team member, this applies to your personal account rather than the team owner's data.
Some information remains outside that deletion: payment providers retain their transaction records; support messages and operational logs may be retained for support, security or legal needs; and backup copies may remain until their retention cycles end. We retain a hash of website domains used for free AI allowances, without account identifiers, to prevent repeated trials. AppSumo license records retain usage and starter-credit history so deleting an account does not reset an entitlement.
Deleting your account does not delete content you exported, shared with others, or sent to a connected tool, or automatically erase records held independently by payment or AI providers. Contact us for help with a deletion request or data left from an earlier version of Cmora.
Your choices and rights
You can edit your brand settings, export emails, disconnect tools, disable preview links, leave a team and delete your account. Email hello@heycmora.com to request access, correction or deletion of personal data, or a portable copy. Depending on your location, you may also have rights to object to processing, restrict it, withdraw consent or complain to your local data protection authority. We may need to verify that the request is yours and retain information where the law allows or requires it.
Cmora is intended for adults using it for their work. If you believe a child has provided personal information, contact us so we can investigate and remove it where appropriate.
Changes to this policy
We update the date above when this policy changes. We will give notice of material changes through the service or by email where appropriate, and obtain consent where required. Purchase and refund rules are in our Terms of service.