Privacy Policy
Shamir by Morris Legacy · Last updated 31 October 2026
Shamir is a business portal operated by Morris Legacy LLC, a Wyoming limited liability company (“Morris Legacy”, “we”). This policy explains what we collect, what we do not, and how we protect it.
The short version
Shamir reads your business data (mail, calendar, files, accounting, customers) live from the systems you connect, shows it to you, sends your changes back, and never keeps a copy. It stores only what it needs to run your service: your account and users, the Service Records you create, your support requests, and the health of the devices we manage for you.
What we collect
| Account | Name, email, company name, and the role and license of each user you invite |
| Billing | Handled by Stripe. We receive your plan, license count and payment status; we never see or store full card numbers |
| Service Records | Requests, changes, notes and follow-up logs you create in Shamir |
| Connection tokens | Authorization tokens for the systems you connect (for example Microsoft 365, Google, QuickBooks), held server-side and used only to fetch and update data at your request |
| Support | Support requests, their messages, the people who raised them and time we record against them, held by Morris Legacy to deliver and bill support |
| Managed devices | For managed endpoint clients: device names, signed-in user names, health, patch and antivirus status, collected by our monitoring provider (N-able) |
| Technical logs | Security and error logs, kept without passwords, tokens or business content |
What we do not do
We do not copy your mail, calendar, files, accounting or customer data into our database. We do not sell or rent personal information, and we do not use your data to train AI models. Where AI features are enabled, requests are processed by our AI provider (Anthropic) under terms that prohibit training on your data.
Connected services
When you connect a system, Shamir requests only the permissions it needs. You can disconnect at any time in Shamir or in that system's own settings, which ends our access. Data from Google APIs is used only to provide the features you see, in line with the Google API Services User Data Policy, including its Limited Use requirements.
Where it runs and how it is protected
Each customer runs in its own isolated instance with its own database. Traffic is encrypted in transit (HTTPS). Access to customer instances is limited to Morris Legacy LLC staff who need it to provide support.
Retention and deletion
Service Records are kept while your subscription is active and for the backup window of your plan. When you cancel, we delete your instance and its data after the backup window, or sooner on request.
Your rights
You can ask to see, correct, export or delete your personal information by emailing us. If you are in the EU, UK or Israel, you also have the rights given by local data protection law.
Changes
We will post updates here and notify account Owners of material changes.
Morris Legacy LLC · 30 N Gould St Ste N, Sheridan, WY 82801, USA · contact@morris.is · Morris Legacy privacy policy