Privacy policy

Who we are#

Shuttio (shuttio.com) is operated by VentuRise LLC, a limited liability company organized under the laws of the State of Wyoming, USA (Wyoming filing ID 2026-002092905), with its registered address at 30 N Gould St Ste R, Sheridan, WY 82801, USA. For the account data described below, VentuRise LLC is the controller under the EU General Data Protection Regulation (GDPR), which applies to us because we offer Shuttio to people in the EU and EEA.

For anything in this policy, write to help@shuttio.com. We have not appointed a Data Protection Officer; the same address reaches the person responsible for data protection.

Two roles: your account, and your CRM data#

We hold two different kinds of personal data, and our role differs between them.

• Your account. Your email address, your sign-in details and the settings of your migrations. We decide how this is used, so we are its controller.
• The records you migrate. Contacts, companies, deals, notes, tasks, meetings, calls, messages (SMS, WhatsApp, LinkedIn), logged emails, other activities and list memberships in your source CRM or CSV. You (or your organisation) remain the controller of that data. We process it only on your instructions, to move it into the Attio, Clarify, Odoo, HubSpot, Pipedrive, Breakcold, Twenty, Capsule, HighLevel, ActiveCampaign, Zendesk Sell, Zendesk Support, HubSpot Service Hub, folk, Ashby, Lever, Greenhouse, ClickUp, Asana or Trello destination you connect, which makes us your processor. Business customers get our Data Processing Addendum under Article 28 GDPR, which applies with the Terms.

What we collect#

Account data

• Your email address, and your name and profile picture if Google provides them.
• If you sign up with a password: a salted scrypt hash of it. We never store the password itself.
• If you sign in with Google: your Google account identifier and the sign-in tokens Google returns for it.
• Single-use tokens for confirming your address (valid 24 hours) and resetting your password (valid 1 hour), stored only as a SHA-256 hash.
• Rate-limit counters for failed sign-ins, sign-ups and account emails, keyed by email address or IP address, so the sign-in form cannot be brute-forced.

Business profile

Shuttio no longer asks questions about your business. If you answered the earlier intake questionnaire (company name, business type and the rest of that form), those answers are still stored with your account, but nothing reads or uses them.

Connections to your destination and your source CRM

When you connect Attio, HubSpot or Pipedrive we receive an OAuth access token (and, where the provider issues one, a refresh token). Affinity has no OAuth, so it takes an API key you paste in. Clarify takes a workspace slug and a Personal API key, and Odoo takes an API key when you connect with one. Each of these is encrypted before it is stored: sealed under its own data key, which is itself wrapped by a master key held outside the database. We also keep non-secret details that identify the connection, such as the Attio workspace name and id, the HubSpot portal domain, the Pipedrive company name, the Affinity tenant name. Each connection belongs to the one migration you made it for; no other migration can use it.

WooCommerce connects when you type your store's address and approve read access on your store's own page; your store then creates a read-only REST API key and sends it to us. We check it against the store address you typed, send it to that address only, over https, and store it encrypted with the store's address. We delete our copy 14 days after the migration finishes. WooCommerce gives apps no way to delete a key, so to remove access delete the key "Shuttio - API" in WooCommerce under Settings, Advanced, REST API.

Asana connects when you sign in to Asana and allow Shuttio read access (OAuth); we store the name of your first workspace and of the user who signed in with the connection. The access is stored encrypted and revoked and deleted 14 days after the migration finishes, and you can remove Shuttio in Asana at any time. Tasks and their comments carry personal data: they are read from Asana and written to your Odoo inside the migration job, not stored by us.

Trello connects when you sign in to Trello and allow Shuttio read access (Trello OAuth 2.0); we check the access against Trello before we keep it, and we store the id and name of your first Trello Workspace, and no Trello member data: no member id, name, email, avatar or username. The access is stored encrypted; 14 days after the migration finishes we delete it, and you can remove Shuttio sooner in Trello under your account settings, Applications. Cards and their comments carry personal data: they are read from Trello and written to your Odoo inside the migration job, not stored by us. The one exception is the owner list a migration into Odoo reads to match card members to Odoo users by email: it is kept on the migration while it runs and removed when it ends.

ClickUp connects when you sign in to ClickUp and allow Shuttio into the Workspaces you tick (OAuth); we store the name of your first Workspace and of the user who signed in with the connection. The access is stored encrypted and deleted 14 days after the migration finishes; Shuttio only reads from ClickUp. Tasks and their comments carry personal data: they are read from ClickUp and written to your Odoo inside the migration job, not stored by us.

Toggl Track connects with an API token you paste; we check it against Toggl before we keep it, and we store your Toggl user id, the names of your workspaces and your name with the connection. The token is stored encrypted and deleted 14 days after the migration finishes, and you can reset it at any time in your Toggl profile. Time entries carry personal data (who worked when, on what): they are read from Toggl and written to your Odoo inside the migration job, not stored by us.

Clockify connects with an API key you paste; we check it against Clockify before we keep it, and we store your Clockify user id, the names of your workspaces, your name and the Clockify region you chose with the connection. The key is stored encrypted and deleted 14 days after the migration finishes, and you can generate a new key at any time in your Clockify profile settings. Time entries carry personal data (who worked when, on what): they are read from Clockify and written to your Odoo inside the migration job, not stored by us.

HubSpot Service Hub is read through the same HubSpot sign-in as the CRM. For tickets it also asks, as optional permissions you can leave unticked, to read conversations, feedback submissions and email bodies; Shuttio never writes to the portal it reads from. Tickets, emails, notes, calls, meetings, conversation messages and attachments carry your customers' personal data: they are read from HubSpot and written to your helpdesk inside the migration job, not stored by us. The access is deleted 14 days after the migration finishes.

Freshdesk connects with an API key you paste, for the one account whose freshdesk.com address you type; we check the key against that account before we keep it, and we store the address and the name of the agent it belongs to with the connection. The key is stored encrypted and deleted 14 days after the migration finishes; Freshdesk has nothing to revoke, and you can reset the key at any time in Freshdesk under Profile Settings. Tickets and their conversations carry your customers' personal data: they are read from Freshdesk and written to your Odoo inside the migration job, not stored by us.

HubSpot Service Hub as a destination connects through the same HubSpot sign-in as the CRM, with the write permissions asked as optional boxes you tick on HubSpot's screen. We store the portal id and the granted permissions with the connection, the encrypted token in the vault, deleted 14 days after the migration finishes; you can remove the app in HubSpot at any time. Tickets, emails, notes and attachments carry your customers' personal data: they are read from the source helpdesk and written to your HubSpot portal inside the migration job, not stored by us. A migration is pinned to the portal it first wrote to.

BambooHR connects with an API key you paste, for the one company whose name you type (acme in acme.bamboohr.com); we check the key against that company before we keep it, and we store the company name with the connection. The key is stored encrypted and deleted 14 days after the migration finishes; BambooHR has nothing to revoke, and you can delete the key at any time under API Keys in BambooHR. HR data is special, so Shuttio reads only the fields an employee record needs. It asks BambooHR for exactly these fields, in one request: first, last and preferred name, work email, work phone, mobile phone, job title, department, division, location, manager, hire date and employment status. It never asks for national id or SSN, date of birth, gender, ethnicity, marital status, home address, personal email and phone, pay and compensation, bank details, emergency contacts, time off, performance, benefits, photo and custom fields; they do not leave BambooHR. BambooHR keeps one mobile number and does not say whether it is work or personal, so it is copied to Odoo's work mobile as it is. The employee rows are read from BambooHR and written to your Odoo inside the migration job, not stored by us. No Odoo user is created, and the Odoo app and the import package do not carry employees.

Brevo connects with an API key you paste; the key is sent only to api.brevo.com. We check the key against your account before we keep it, and we store the account's company name and login email with the connection. The key is stored encrypted and deleted 14 days after the migration finishes; Brevo has nothing to revoke, and you can delete the key at any time in Brevo under SMTP & API, API Keys. Lists and their contacts carry your subscribers' personal data: they are read from Brevo and written to your Odoo inside the migration job, not stored by us.

Lever connects with a Data API key you paste, that you create in Lever under Settings, Integrations and API, API credentials. We check it against Lever before we keep it, and we store a fingerprint of your Lever account with the connection. The key is stored encrypted and deleted 14 days after the migration finishes; you can delete the key at any time in Lever. Recruiting data is personal data about people who are not your customers, so this is what Shuttio reads, in paged requests: postings with their team, department, locations, commitment, hiring team, content and requisitions; opportunities with the contact's name, email addresses, phone numbers, links, location, headline, tags, sources, owner, stage, archive reason and applications with their answers; notes (private ones too), feedback forms with every field, interviews, interview panels, offers, referrals, profile forms, and the names of files and resumes with the schools and positions parsed from them; EEO self-identification answers (gender, race or ethnicity, veteran and disability status), with every answer including "decline to self-identify". It does not read the files themselves (only their names) and Lever users. The rows are read from Lever and written to your Odoo inside the migration job, not stored by us. No Odoo user is created, and the Odoo app and the import package do not carry recruitment records.

Greenhouse connects with Harvest V3 (OAuth) credentials you paste: a Client ID and a Client Secret that you create in Greenhouse under API Credentials. We check them against Greenhouse before we keep them, and we store the Client ID with the connection. The secret is stored encrypted and deleted 14 days after the migration finishes; you can delete the credentials at any time in Greenhouse. Recruiting data is personal data about people who are not your customers, so this is what Shuttio reads, in paged requests: jobs with their departments, offices, hiring team and openings; candidates with their names, email addresses, phone numbers, addresses, websites, social links, company, title, tags, educations, employments and custom fields; applications with their job, stage, status, source, referrer, rejection reason, recruiter, answers, attachment file names and custom fields; notes, interviews, offers and scorecards with their question answers and ratings; EEOC and demographic self-identification answers (gender, race or ethnicity, veteran and disability status and any other question), with every answer including "declined to answer". It does not read attachment files themselves (only their names) and Greenhouse users. The rows are read from Greenhouse and written to your Odoo inside the migration job, not stored by us. No Odoo user is created, and the Odoo app and the import package do not carry recruitment records.

Workable connects with an account API access token you paste, together with your Workable subdomain. You create the token in Workable under Integrations, Generate new token, and tick the read scopes. We check it against Workable before we keep it and store the subdomain with the connection. The token is stored encrypted and deleted 14 days after the migration finishes; you can revoke it in Workable at any time. Recruiting data is personal data about people who are not your customers, so this is what Shuttio reads, in paged requests: jobs in every state with their description, department, locations, stages, hiring team and requisitions; members, recruiters and disqualification reasons; candidates with their name, email, phone, address, headline, summary, cover letter, education, experience, skills, social profiles, tags, answers to the job's questions, source, stage, disqualification and dates; each candidate's activity history (stage moves, comments, ratings, messages), interviews and events, offer, and files and resume. It does not read EEO answers and the talent pool (Workable's API reference has no endpoint to read either). The rows are read from Workable and written to the ATS you chose inside the migration job, not stored by us. Resumes and attachments are downloaded one at a time, held in memory for the upload only, and never written to our storage.

Recruitee connects with a personal API token you paste, together with your Recruitee company id. You create the token in Recruitee under Settings, Apps and plugins, Personal API tokens. The token carries your own permissions, so Shuttio reads only what your user can see. We check it against Recruitee before we keep it and store the company id with the connection. The token is stored encrypted and deleted 14 days after the migration finishes; you can delete it in Recruitee at any time. Recruiting data is personal data about people who are not your customers, so this is what Shuttio reads, in paged requests: job offers in every status with their description, requirements, department, locations and pipeline stages; the company's admins, departments, locations, sources and disqualification reasons; candidates with their name, email, phone, social links, tags, source, cover letter, education, experience, custom fields and answers to open questions; each candidate's placements on jobs with the current stage, disqualification and hiring dates, and the stage history; notes and replies, interview events, evaluations and scorecard answers, offer letters, and attached files, CV and cover letter. It does not read EEO answers (Recruitee's API gives only which placements lack them) and email conversations. The rows are read from Recruitee and written to the ATS you chose inside the migration job, not stored by us. CVs and attachments are downloaded one at a time, held in memory for the upload only, and never written to our storage.

SmartRecruiters connects with a credential your administrator makes in SmartRecruiters under Credential Manager: an OAuth client (a Client ID and Client secret you paste, with the read scopes you choose) or, as a fallback, an API key. We check it against SmartRecruiters before we keep it. The secret or key is stored encrypted and deleted 14 days after the migration finishes; you can revoke it in Credential Manager at any time. Recruiting data is personal data about people who are not your customers, so this is what Shuttio reads, in paged requests: jobs in every status with their job ad, department, location, compensation, properties and hiring team; users, departments and rejection and withdrawal reasons; candidates with their name, email, phone, location, links, tags, education, experience, source and dates; each application's status and sub-status history, screening answers (EEO answers among them), messages, reviews, interviews, offers, and attachments and resumes. It does not move offer documents, candidate consent records, onboarding status, candidate property values and the pipeline's custom sub-statuses as stages (SmartRecruiters' API gives a sub-status as free text, so it goes into the details note). The rows are read from SmartRecruiters and written to the ATS you chose inside the migration job, not stored by us. Resumes and attachments are downloaded one at a time, held in memory for the upload only, and never written to our storage.

Teamtailor connects with an API key you paste, together with the region of your account (EU or North America). You create the key in Teamtailor under Settings, Integrations, API keys, with the Admin read scope. We check it against Teamtailor before we keep it and store the region with the connection. The key is stored encrypted and deleted 14 days after the migration finishes; you can revoke it in Teamtailor at any time. Recruiting data is personal data about people who are not your customers, so this is what Shuttio reads, in paged requests: jobs in every state with their description, department, locations, stages and recruiter; users, departments, locations and rejection reasons; candidates with their name, email, phone, address, LinkedIn link, summary, tags, custom fields, answers to application questions and form answers; each application with its stage, the stage moves, rejection and dates; notes, comments and reviews; interviews with their scorecards; job offers; and uploaded files and resumes. It does not read EEO answers, emails and messages, todos, onboardings and requisition approvals (Teamtailor's API reference has no endpoint to read EEO answers or sent emails). The rows are read from Teamtailor and written to the ATS you chose inside the migration job, not stored by us. Resumes and attachments are downloaded one at a time, held in memory for the upload only, and never written to our storage.

Ashby is a destination for Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor. You connect it with an Ashby API key, made in Ashby under Admin, Integrations, API keys. We check the key against Ashby before we keep it. It is stored encrypted and deleted 14 days after the migration finishes; you can delete the key in Ashby at any time. Recruiting data is personal data about people who are not your customers. A move from Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor reads jobs with their department and office, candidates with their names, emails, phones, links and tags, applications with stage history, source, recruiter and rejection reason, notes and logged emails, scorecards and interview feedback, interviews with date, place and panel and offers with status, dates and fields, and writes them to your own Ashby account inside the migration job. We do not store the rows. Files: resumes and attachments are downloaded from Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor one at a time and uploaded to Ashby (as candidate files). A file is held in memory for the upload only, never written to our storage. EEO: the gender, race or ethnicity, veteran and disability answers candidates gave Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor are read when the key may read them, and written to Ashby as a private note on the candidate. They are not used for anything else and are not kept by us. Ashby is not our subprocessor: it is the system you connect, under your own agreement with it.

Lever is a destination for Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor. You connect it with a Lever API key with read and write access to opportunities, postings, notes and files, made in Lever under Settings, Integrations and API. We check the key against Lever before we keep it. It is stored encrypted and deleted 14 days after the migration finishes; you can delete the key in Lever at any time. Recruiting data is personal data about people who are not your customers. A move from Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor reads jobs with their department and office, candidates with their names, emails, phones, links and tags, applications with stage history, source, recruiter and rejection reason, notes and logged emails, scorecards and interview feedback, interviews with date, place and panel and offers with status, dates and fields, and writes them to your own Lever account inside the migration job. We do not store the rows. Files: resumes and attachments are downloaded from Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor one at a time and uploaded to Lever (as candidate files). A file is held in memory for the upload only, never written to our storage. EEO: the gender, race or ethnicity, veteran and disability answers candidates gave Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor are read when the key may read them, and written to Lever as a private note on the candidate. They are not used for anything else and are not kept by us. Lever is not our subprocessor: it is the system you connect, under your own agreement with it.

Greenhouse is a destination for Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor. You connect it with Harvest v3 credentials (Client ID and Client Secret), made in Greenhouse under Dev Center, API Credential Management. We check the key against Greenhouse before we keep it. It is stored encrypted and deleted 14 days after the migration finishes; you can delete the key in Greenhouse at any time. Recruiting data is personal data about people who are not your customers. A move from Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor reads jobs with their department and office, candidates with their names, emails, phones, links and tags, applications with stage history, source, recruiter and rejection reason, notes and logged emails, scorecards and interview feedback, interviews with date, place and panel and offers with status, dates and fields, and writes them to your own Greenhouse account inside the migration job. We do not store the rows. Files: resumes and attachments are downloaded from Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor one at a time and uploaded to Greenhouse (as candidate files). A file is held in memory for the upload only, never written to our storage. EEO: the gender, race or ethnicity, veteran and disability answers candidates gave Greenhouse, Lever, Workable, Recruitee, SmartRecruiters and Teamtailor are read when the key may read them, and written to Greenhouse as a private note on the candidate. They are not used for anything else and are not kept by us. Greenhouse is not our subprocessor: it is the system you connect, under your own agreement with it.

In Attio, Shuttio asks only for the permissions listed on shuttio.com/attio, each with what it is used for. They include reading and writing activities (activity_configuration:read-write and activity_record:read-write), so calls, messages and logged emails land in Attio as Phone calls and activities rather than notes. Shuttio does not request Attio's comments, email, call recording or webhook permissions.

Migration data

For each migration you create, we keep the bookkeeping that makes it re-runnable and reversible:

• its settings: source, object, sample size and status (and, for older migrations, the row filter and target list);
• the structure mirrored from your source (or, for older migrations, proposed for you) and the version you approved;
• the field mapping you reviewed, including any names and types you changed (and, for older migrations, any value rewrites);
• a ledger of every object, attribute, option, record, note, task, meeting and list entry the migration created in your destination, identified by the destination's id;
• a map from each source record id to the destination record id it became;
• a per-record receipt for every row that failed or was skipped, with the reason. A reason can quote the value the destination rejected, such as a malformed email address or phone number;
• run counts and a summary of the outcome;
• the field list the Fields step read from your source and your destination, with up to three example values per field. It is encrypted, used for at most 24 hours, and deleted within 48 hours by a daily purge, together with the migration's credentials.

What we do not keep

• Your records. Rows from HubSpot, Pipedrive, Zendesk Sell, folk, Close, Insightly, Bitrix24, Capsule, HighLevel, SugarCRM, SuiteCRM, Salesflare, Vtiger, ActiveCampaign, OnePageCRM, Freshdesk, BambooHR, Greenhouse, Lever, Brevo, Toggl Track, Clockify or Affinity are read from the source and written to your destination inside the migration job. They are not stored in our database, apart from the three example values per field described above. When you ask to look up a failed row in the results view, we fetch it live from the source and do not save it.
• Your uploaded CSV. A CSV imports in full, with no sample. The file is stored encrypted and deleted when the import finishes or you roll it back. A run that is paused or stopped on an error keeps it until you resume, retry or roll back. A CSV sample started before CSV imports ran in full keeps its file for up to 30 days; then it is deleted.

Why we use it, and our legal basis#

• To provide the service (Art. 6(1)(b) GDPR, performance of a contract): creating your account, connecting your systems, mirroring your structure and mapping, running, pausing, resuming and rolling back migrations, and emailing you when one finishes.
• To keep the service secure (Art. 6(1)(f), legitimate interests): confirming email addresses, rate-limiting sign-in attempts, and investigating errors.
• To give you support (Art. 6(1)(b) and (f)): a small number of VentuRise LLC staff can view your account email and a migration's settings, status and failure receipts in an internal admin view when helping you or diagnosing a failure. They cannot see your credentials in readable form.

We do not sell personal data, use it for advertising, or use your records to train any model. Shuttio loads no advertising trackers. Its one analytics tool is described under Product analytics below.

What reaches the AI model#

Shuttio uses Anthropic's Claude for two things. First, when you upload a CSV, it guesses what each column holds (an email, a date, a choice from a list). For each column it receives the column name, at most three sample values, each truncated to 80 characters, and, for a column with 25 or fewer distinct values, how many there are. Those sample values can contain personal data from your file. Second, the help chat: when you use it, Claude receives our product documentation, the messages you type and, on a migration page, a summary of that migration made of counts, statuses, option choices and error groups, never a record value, name, email or source id. We keep what you type in the help chat, and the answers you were given, for 12 months, with the page it was sent from, the migration number if there was one and your account; a visitor who is not signed in is identified only by a random id stored in their browser. We use it to answer follow-up questions and to improve the help content, and we do not use it to train a model. When a conversation starts or an answer fails, a message goes to our team in a private Telegram chat with the page, the first question (cut to 500 characters) and, for a signed-in user, the email address. A visitor who is not signed in may leave an email address in the chat to get a personal reply; we use it only to answer that question. Please do not type record data into the chat. Nothing from a connected CRM's records reaches the model: its structure is mirrored from the CRM's own schema by code, and the record stream never passes through the model either. Anthropic processes these requests as our subprocessor under its commercial terms: it does not use API inputs or outputs to train its models, and it deletes them within 30 days.

Product analytics#

We use PostHog to see which pages are visited and where people stop on the way from sign-up to a finished migration. In the browser it records page views with the page address, the referring site, campaign tags in the address (utm_source and the like), and the browser and country. It sets no cookie and stores nothing in your browser, so a visit is not linked to the next one until you sign in. It does not record sessions, captures only clicks on links and buttons (never what you type), notes when you leave a page, and honours the Do Not Track setting.

On each page load our server looks up the network owner of your IP address with IPinfo (ipinfo.io), a service that tells us the organisation, its domain, its network number and the country. We use it to see which organisations visit and to filter out cloud servers and bots. We keep the result with the visit in PostHog; we do not keep your IP address, and IPinfo gets it only to answer. For visitors in the EU, EEA, UK and Switzerland, and where we cannot tell the country, we store the organisation only after you accept in the banner; without it we keep only the country and whether the visit comes from a cloud server. If you leave your email in the help chat, we join your visits to that address in PostHog (under a coded id, with the email as a property), again only after you accept where the banner applies. When you sign in, we join your visits to your account.

When you are signed in, events are tied to your internal Shuttio user id, not to your email address. Our servers also send the steps of the flow: signed up, email confirmed, a system connected, a sample started or finished, checkout, payment, full run started or finished, rollback started. Each carries the source and destination system names and, for payment, the price band and amount. None carries your records, credentials, tokens or the text of an email. PostHog Inc. processes this for us on its EU cloud in Frankfurt.The legal basis is our legitimate interest in understanding and improving the service (Art. 6(1)(f) GDPR). To object, write to help@shuttio.com.

Visitor identification on our website#

On our public pages (home, pricing, guides, comparisons and this policy), not in the signed-in app or the admin area, we try to learn which companies visit, so that we can reply to people who may need a migration. We do this in two ways.

Company lookup by IP address

A script from a visitor identification provider (a service that matches an IP address to the company that owns it) runs on these pages. It sees the page you open, the referring site, your IP address and the time, and it may set cookies. The provider tells us the company, not you, and for office networks that is usually all it can say. Our legal basis is our legitimate interest in knowing which companies are interested in Shuttio (Art. 6(1)(f) GDPR). Visitors in the EU, EEA, United Kingdom and Switzerland, and visitors whose country we cannot tell, are shown a banner, and the script loads only after they click Accept. Reject takes one click and costs nothing. We load a company-level provider only when we have configured one, and we list it on the subprocessors page with its location, retention period and transfer mechanism before it loads. To object, write to help@shuttio.com.

Person-level identification for visitors in the United States

For visitors in the United States we also use RB2B. Its script can match a visit to a business profile and a work email address from RB2B's network of publicly available and licensed business data, and tell us who visited. We then may email that person about Shuttio. We show no banner to US visitors. If your browser sends the Global Privacy Control signal, we do not load RB2B. RB2B is never loaded for visitors outside the United States, whatever they choose. To opt out and have us delete what we hold about you, email help@shuttio.com; RB2B's own opt-out is at rb2b.com/opt-out.

Your choice

If you saw the banner, the "Cookie settings" link in the footer of every public page reopens it. You can change your choice at any time; we remember it for 12 months in a cookie called shuttio_consent. If you withdraw consent, the page reloads without the script.

Subprocessors#

These are the only third parties that process personal data on our behalf. The subprocessors page lists the data and location of each.

Attio, Clarify, Odoo, HubSpot, Pipedrive, Zendesk Sell, folk, Close, Insightly, Bitrix24, Capsule, HighLevel, SugarCRM, SuiteCRM, Salesflare, Vtiger, ActiveCampaign, OnePageCRM, Freshdesk, BambooHR, Greenhouse, Lever, Brevo, Toggl Track, Clockify and Affinity are not our subprocessors: they are the systems you connect, under your own agreements with them. We read from your source and write only to the destination you authorise.

International transfers#

VentuRise LLC is based in the United States, and so are several of our subprocessors. Personal data is therefore processed outside the European Economic Area. Where a transfer to a subprocessor needs a safeguard, we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses.

Our database (Neon) runs on AWS us-east-2 in Ohio, and our application servers (Vercel) in Cleveland, Ohio. Vercel, Databricks (Neon), Stripe, Google, Anthropic and Resend are certified under the Data Privacy Framework. Telegram, which only alerts our team about help chat questions, is not. Each subprocessor is also bound by its own data processing agreement that includes the Standard Contractual Clauses. PostHog stores our analytics data in Frankfurt. The job queue runs on our own server at Amazon Web Services and holds migration ids and step progress only.

How long we keep it#

• Import packages for Odoo: an import package is kept encrypted and deleted 7 days after it is built, or when you finish the load guide, whichever comes first. Its download links work for 24 hours, and only for you.
• The Odoo app: if you use our Odoo app, the records waiting for your Odoo are kept encrypted, and deleted as soon as your Odoo confirms them, and after 24 hours at most. The app's access is stored only as a fingerprint, and you can disconnect it from Odoo or from Shuttio at any time.
• Uploaded CSV files: stored encrypted; deleted when the import finishes or you roll it back; a paused or failed run keeps it until you resume, retry or roll back. A CSV sample started before CSV imports ran in full keeps its file for up to 30 days.
• Credentials: each belongs to one migration and is deleted 14 days after the migration finishes (done, failed or rolled back), and revoked with the provider where the provider allows it. A migration that is running or paused keeps its access. If you need the migration again later, you reconnect it on the migration's page.
• Values that could not be written: When a single value could not be written to your destination (a malformed email, a number that is not a number), the migration's Errors tab lists it with the object, the field, the source record's id, our own explanation, the destination's error code and HTTP status, and up to 200 characters of the value. The destination's error message is never stored. The value is deleted 14 days after the migration finishes, at the same time as its credentials; the rest of the line stays with the migration.
• Ledger, id map and failed-row receipts: kept with the migration for as long as your account exists, so that you can roll it back or run it again. No automatic job deletes them earlier. The value a receipt quotes is deleted 14 days after the migration finishes (see "Values that could not be written" above); the rest of the receipt stays. To remove them sooner, use "Delete organization data" on your Account page (described below) or email help@shuttio.com.
• Account, business profile and migration data: for as long as your account exists, so you can re-run or roll back a migration later. When your account is deleted, all of it is deleted with it. You can do this yourself at any time ("Delete organization data" below); if you email us instead, within 30 days of your request. Deleted data can stay in our database host's restore history for up to 6 hours. We do not delete inactive accounts automatically; you can ask us to delete yours at any time.
• Sign-in rate-limit counters and email links: rate-limit counters are cleared when you next sign in successfully. Email confirmation links expire after 24 hours and password-reset links after 1 hour, and each is deleted once used.
• Server logs: our application logs record ids and counts, not your records or credentials, and our hosting provider keeps them for no more than 3 days.

Cookies#

The service sets these cookies because it needs them to work:

• a session cookie that keeps you signed in;
• short-lived cookies (ten minutes) that protect an OAuth connection against forgery and remember which page to return you to afterwards.

Because they are strictly necessary, they do not require consent.

On the public pages, two more things can be stored in your browser. The first is the consent cookie (shuttio_consent, 12 months) that remembers your choice in the cookie banner. The second is the cookies that the visitor identification provider sets, if you accepted them. See Visitor identification on our website. The help chat also keeps a random id in your browser's local storage once you send a message.

Security#

Credentials are encrypted at rest under envelope encryption, and only one module in the codebase can decrypt them. Background jobs carry a migration id and nothing else. Every request re-checks that you own the migration it touches. The full detail is on our security page.

Your rights#

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing based on legitimate interests;
• receive your data in a portable format;
• withdraw any consent you have given, without affecting earlier processing.

Access to your systems ends on its own 14 days after the migration finishes; email us if you want it ended sooner. To exercise any other right, including deleting your account, email help@shuttio.com from the address on your account. We answer within one month.

Delete your data yourself#

The owner of an organization can delete its data at any time from the Account page("Delete organization data"). You confirm by typing your email address (your own account) or the organization's name. We refuse while a migration is running, paused or rolling back, and name it: let it finish, cancel it or roll it back first. After you confirm we sign you out and delete in a background job, usually within minutes, and send one email when it is done.

A shared organization has a grace period. Its owner asks for the deletion on the Account page; we email every other member at once, naming the organization, the owner who asked and the time it runs. The deletion runs 24 hours later. Until then nothing new can start in the organization, and the owner can cancel on the Account page. We check again before deleting and stop if a migration is running by then. The members keep their own accounts and personal organizations; only their membership of this organization and its data are removed. A member can leave an organization at any time from the Account page, which removes the membership only. To close your own account you first leave the organizations you belong to and delete the data of the shared organizations you own, because ownership cannot be handed over yet.

What is deleted: the organization's migrations with their ledger, id maps and failure receipts, uploaded files, Odoo import packages and Odoo app queue, saved connections (each token is revoked at the provider where the provider allows it, then deleted), Odoo app and MCP access tokens, and the organization itself. For your own account we also delete your sign-in, your help chat history and any pending email links, so the account is closed.

What stays: records a migration already wrote into your destination CRM (they belong to you; roll the migration back first if you want them gone); payment records at Stripe, which Stripe keeps under its own rules; server logs at Vercel (no more than 3 days) and job history on our migration server (migration ids only), deleted after 30 days; analytics events at PostHog, which carry your coded user id (when you close your account we ask PostHog to delete that profile and its events; if that request fails or is not available to us, the email we send you says so, and you can write to help@shuttio.comto have them deleted by hand); and our database host's restore history, up to 6 hours. We also keep one row with the organization id, the date and a count, as proof the deletion ran. It holds no name, email or record.

Deleting your Shuttio account does not remove records a migration already created in your Attio, Clarify, Odoo, HubSpot, Pipedrive, Breakcold, Twenty, Capsule, HighLevel, ActiveCampaign, Zendesk Sell, Zendesk Support, HubSpot Service Hub, folk, Ashby, Lever, Greenhouse, ClickUp, Asana or Trello destination; those belong to you. Roll the migration back first if you want them gone. We delete our copy of each token 14 days after the migration finishes and revoke it where the provider allows; you can also remove Shuttio in your Attio, HubSpot or Pipedrive settings at any time.

If you believe we have handled your data unlawfully, you can complain to the data protection supervisory authority in the EU or EEA country where you live or work, or where the alleged breach took place.

Children#

Shuttio is a business tool and is not intended for anyone under 16.

Changes to this policy#

If we change how we handle personal data, we will update this page and the date at the top. For material changes we will also email account holders before they take effect.

Contact#

VentuRise LLC (Wyoming filing ID 2026-002092905), 30 N Gould St Ste R, Sheridan, WY 82801, USA · help@shuttio.com