Motivs.ai Privacy Policy
Effective date: 7 October 2026
This Privacy Policy explains how MOTIVS OÜ ("Motivs", "we", "us", or "our") handles personal data in connection with the Motivs.ai website, Motivs Flow, related communications, and our business operations.
MOTIVS OÜ is an Estonian private limited company registered in the Estonian Commercial Register under registry code 17567337. Its registered address is Rävala pst 7, Kesklinna linnaosa, Tallinn 10143, Harju maakond, Estonia. Its VAT number is EE103014074.
You can contact us about privacy matters at team@motivs.ai. Product-support enquiries may be sent to support@motivs.ai.
1. Scope and our role
This Policy applies to:
- visitors to our marketing website;
- prospective customers and business contacts;
- customer administrators and authorized users of Motivs Flow;
- people who contact us for support or exercise privacy rights; and
- personal data contained in files or other information that business customers provide to the service.
Motivs acts as a controller for its own website, account administration, access control, security, support, sales and business administration, legal compliance, and internal operations.
When a business customer uses Motivs to process its own files and business data, the customer normally determines the purposes of that processing. Motivs acts as a processor when processing that data on the customer's instructions. Roles depend on the particular processing activity. Customer-selected Anthropic and OpenAI providers are not automatically Motivs subprocessors. If your data appears in a customer's file and you want to exercise a privacy right, you should normally contact that customer first. We will assist the customer as required by applicable law and the parties' contractual arrangements.
2. Personal data we process
Depending on how you interact with us, we may process the following information.
2.1 Website and device information
Website delivery and security may involve your IP address, HTTP request and header information, User-Agent, TLS/request information, and referrer where applicable.
The marketing website uses Lovable Cloud Edge hosting, Cloudflare for delivery, security and CDN functionality, Lovable analytics functionality using Tinybird as an analytics backend, and externally hosted Google Fonts. These services receive information as described in Sections 7, 9 and 10.
Website analytics involves IP addresses at the receiving network/service, User-Agent, browser locale or language, timezone-derived country, referrer, full URL (including query parameters), pathname, timestamps, a randomly generated analytics session identifier, page-hit events, and web-vitals/performance events.
The marketing website currently has no web forms. Business enquiries are initiated through email links that open the visitor's email software; clicking a link does not submit a form to Motivs.
2.2 Business enquiries and correspondence
If you contact us, we may process your name, business email address, employer, role, message, attachments, and any other information you choose to provide. This includes sales, support, privacy, and legal correspondence.
2.3 Account and organization information
For customer administrators and authorized users, we may process:
- name, business email address, organization, role, and membership information;
- invitation information and account status;
- password hashes and authentication records;
- session and OAuth token records;
- service preferences and account timestamps; and
- actions recorded for security and accountability.
Passwords are stored as hashes rather than readable password text. Session and OAuth credentials are stored as hashes. Product session and security cookies are used to authenticate users and protect the service.
2.4 Customer files and workflow data
Business customers may upload spreadsheet examples, context files, run inputs, and other business data. The contents are chosen by the customer and may include personal data about the customer's employees, clients, suppliers, or other contacts.
To provide the service, Motivs may store and process:
- uploaded files and their contents;
- security-scan and quarantine information;
- structural information derived from files, such as file, sheet, field, and column names, data types, formats, formulas, ranges, and size bands;
- automation names, descriptions, instructions, build briefs, versions, and generated automation code;
- run inputs, generated outputs, status information, and technical logs; and
- information needed to diagnose, secure, or support a workflow.
Files are inspected by Motivs Guard before they proceed through the normal workflow. A file may be quarantined if the service detects a potential security or integrity concern.
2.5 Connected AI assistants
Customers may connect their own Anthropic or OpenAI account to use an AI assistant with Motivs tools. Motivs does not independently invoke an AI model API using customer data for this workflow. Instead, a user-connected AI assistant calls Motivs tools, and selected MCP responses are returned to that assistant and its provider.
Those responses may include structural information such as file, sheet, and field names; data types and size bands; formula-related metadata; automation descriptions and instructions; validation feedback; and generated automation code. Names and customer-authored text can themselves contain personal data.
The hosted workflow is designed to withhold raw spreadsheet rows, cell values, exact totals, run logs, generated reports, paths, and error detail that would quote or expose customer data from the connected assistant.
If a user separately uploads a file, pastes content, or otherwise provides information directly to Anthropic, OpenAI, or another AI provider, that provider processes the information under the user's or customer's relationship with it. Motivs does not control the provider's independent interface, retention settings, or data-use settings.
Motivs does not use customer content to train its own AI models. We do not make a universal promise about whether a customer-selected AI provider stores submitted information or uses it to improve its services; those matters depend on the customer's provider account, plan, settings, and agreement.
2.6 Security, audit, and operational information
We may process user and actor identifiers, invitation details, filenames, access events, security events, workflow actions, and technical logs to authenticate users, protect the service, investigate misuse, and maintain accountability. Customer automation code may write personal data to run logs if the customer configures it to do so.
2.7 Privacy-request information
If you exercise a privacy right, we may process your contact details, request, relevant account or organization information, correspondence, and limited identity-verification information where reasonably necessary. Requests are currently handled manually.
2.8 Legacy records
We may hold limited records from predecessor services, including customer, subscription, acceptance, analytics, or uploaded-file records, where those records have not yet been deleted or must be preserved for legal, accounting, contractual, or evidentiary reasons.
3. How we obtain personal data
We receive personal data:
- directly from you when you contact us, accept an invitation, create or use an account, upload files, configure an automation, or submit a privacy request;
- from a customer administrator who invites you or manages your organization membership;
- from business customers when their files contain information about other people;
- automatically from browsers, devices, authentication systems, security tools, and service activity; and
- from a connected AI assistant when it calls Motivs tools on your behalf.
4. Required and optional personal data
Some personal data is required to provide a requested service, while other data is optional:
- Account, organization, invitation, and authentication information is required to create or maintain authorized access to Motivs Flow. If the required information is not provided, we may be unable to create or maintain the account or provide the relevant service access.
- Information reasonably necessary to understand, verify, and respond to a support, privacy, legal, or sales request is required to process that request. If it is not provided, we may be unable to respond fully or verify that the requester is entitled to receive the requested information.
- Analytics data processed on the basis of consent is optional. Refusing or withdrawing optional analytics consent does not prevent access to necessary website functions.
- The business customer chooses and controls the customer-file content submitted to the Service. Whether particular content is required depends on the customer's workflow and instructions, not on a general requirement imposed by Motivs.
5. Why we process personal data and our legal bases
We use personal data for the following purposes and legal bases:
| Purpose | Categories commonly involved | Legal basis |
|---|---|---|
| Deliver and operate the website | IP address, browser and request information | Article 6(1)(f) GDPR: our interest in making a functional public website available and responding to requests for its content, subject to necessity and balancing against affected individuals' rights and interests |
| Protect the website and service | Security cookies, IP address, request and event data, account and audit records | Article 6(1)(f) GDPR: our interest in preventing abuse, protecting accounts and systems, and maintaining service integrity, subject to necessity and balancing |
| Website analytics | Online identifiers and page events | Consent under Article 6(1)(a) GDPR, where required |
| Administer business accounts, organizations, and invitations | Name, business email, organization, role, status, invitation and account records | Article 6(1)(b) GDPR where the individual is a party to the contract; otherwise Article 6(1)(f) GDPR based on our interest in administering authorized B2B access for the customer organization, subject to necessity and balancing |
| Authenticate users and maintain sessions | Password hash, token hash, session and security information | Article 6(1)(b) GDPR where necessary to perform a contract with the individual; otherwise Article 6(1)(f) GDPR based on our interest in authenticating authorized users and securing account access, subject to necessity and balancing |
| Provide support and respond to enquiries | Contact details, correspondence, attachments, account context | Article 6(1)(b) GDPR where necessary to take requested pre-contractual steps or perform a contract with the individual; otherwise Article 6(1)(f) GDPR based on our interest in answering legitimate B2B enquiries and supporting customers, subject to necessity and balancing |
| Maintain security and audit records | Actor identifiers, access and security events, technical logs | Article 6(1)(f) GDPR based on our interest in detecting and investigating misuse, protecting customers and systems, and maintaining accountability, subject to necessity and balancing; Article 6(1)(c) GDPR where a specific legal obligation applies |
| Maintain backups and operational resilience | Copies of relevant service and operational data | Article 6(1)(f) GDPR based on our interest in maintaining availability, integrity, recovery, and business continuity, subject to necessity and balancing |
| Keep accounting, contractual, and legal records | Identity, invoices, contracts, acceptance evidence, correspondence | Article 6(1)(c) GDPR where a specific accounting, tax, or other legal obligation applies; Article 6(1)(f) GDPR based on our interest in establishing, exercising, or defending legal claims, where necessary and appropriately balanced |
| Handle privacy requests | Request, contact and identity-verification information | Article 6(1)(c) GDPR where processing is necessary to comply with data-protection duties; Article 6(1)(f) GDPR based on our interest in preventing misuse of the request process, where necessary and appropriately balanced |
| Conduct internal security and reliability testing | Primarily synthetic or public test data and limited operator records | Article 6(1)(f) GDPR based on our interest in maintaining a secure and reliable service, subject to necessity, data minimization, and balancing |
When we rely on Article 6(1)(f) GDPR, we identify the specific interest pursued, consider whether the processing is necessary for that interest, and balance it against the rights and interests of affected individuals. We will maintain an appropriate legitimate-interest assessment where required.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. Refusing or withdrawing optional analytics consent will not prevent access to necessary website functions.
6. How we use personal data
We use personal data to:
- provide, secure, maintain, and support Motivs services;
- authenticate users and manage organization access;
- inspect files for security and integrity concerns;
- build, validate, and execute customer-directed spreadsheet automations;
- return selected metadata and workflow information to a connected AI assistant;
- provide generated reports and outputs to authorized users;
- respond to enquiries and privacy requests;
- detect, prevent, and investigate misuse or security incidents;
- maintain records required for business, accounting, legal, and evidentiary purposes; and
- improve service reliability and security using appropriately minimized, synthetic, or public test data where practicable.
7. Website technologies and consent
The marketing website uses service providers for hosting, delivery, security, analytics, and fonts. Strictly necessary security and routing technologies may operate without optional analytics consent, subject to applicable law. Nonessential analytics operates only with analytics consent. Necessary Cloudflare and Lovable routing and security functionality remains available independently of optional consent.
The website uses the following cookies, with the analytics cookie created only after analytics consent:
| Cookie | Function | Category | Approximate duration |
|---|---|---|---|
__cf_bm | Cloudflare bot management and security | Necessary/security | 30 minutes |
__dpl | Lovable deployment routing | Necessary/routing | 24 hours |
session-id | Randomly generated analytics session identifier | Analytics/nonessential | 30 minutes |
Lovable/Flock analytics functionality, using Tinybird as an analytics backend, uses /~flock.js and does not initialize before analytics consent. The session-id cookie is not created and page-hit and performance events are not sent through /~api/analytics before analytics consent.
Accept enables analytics. Reject keeps analytics disabled. Withdrawing consent stops future analytics. You can reopen the website's privacy/cookie choices and change your decision. Your analytics choice is remembered through the website's consent-preference mechanism.
Geist and Geist Mono are loaded externally through Google Fonts only after the applicable optional consent. Requests to fonts.googleapis.com and fonts.gstatic.com expose ordinary HTTP/network information such as IP address, User-Agent and referrer.
Motivs Flow also uses necessary session and security cookies to authenticate authorized users and protect the product. These are separate from marketing-site analytics.
8. AI and automated outputs
AI assistants and generated automations can produce code, calculations, reports, and other outputs. These outputs may be incomplete, inaccurate, or unsuitable for a particular purpose. Customers and users must review and validate outputs before relying on them, especially where a result may affect a person or lead to a consequential business decision.
The service is intended to automate spreadsheet workflows, not to make legal or similarly significant decisions about individuals on Motivs' own behalf. Customers determine how they use their workflows and outputs and remain responsible for any decision-making based on them.
9. When we share personal data
We may disclose personal data to the following recipients where necessary:
- Hosting providers, including DigitalOcean, for service infrastructure;
- Backup storage providers, including Google Cloud Storage, for encrypted offsite backups. The verified backup bucket is in the EU region
EUROPE-WEST1, using the Coldline storage class; - Website providers, including Lovable Cloud Edge for hosting, Cloudflare for delivery/security/CDN, Lovable analytics functionality using Tinybird as an analytics backend, and Google Fonts for typography;
- Email and communications providers, including Google Workspace, for support, privacy, sales, and legal correspondence;
- Customer-selected AI providers, including Anthropic and OpenAI, when a connected assistant receives selected MCP responses;
- Professional advisers and authorities, where disclosure is necessary to obtain advice, establish or defend legal claims, comply with law, or protect rights and security.
We may also disclose information within a customer's organization to authorized administrators and users according to their access rights.
10. International data transfers
Some recipients, including a customer-selected AI provider or a globally operated service provider, may process personal data outside Estonia or the European Economic Area. A provider's country of incorporation does not by itself establish where each processing operation occurs.
Where personal data is transferred outside the EEA, Motivs uses a transfer mechanism permitted by Chapter V GDPR, such as an applicable European Commission adequacy decision, Standard Contractual Clauses or another valid safeguard, depending on the recipient and circumstances. Information about the safeguards applicable to a particular transfer, and where available a copy of the relevant safeguard subject to appropriate redactions, may be requested at team@motivs.ai.
11. Retention
We keep personal data only for as long as necessary for the relevant purpose, taking account of contractual, legal, accounting, security, dispute, and evidentiary requirements.
| Data category | Retention |
|---|---|
| Generated outputs | Generated outputs are deleted on first download or after 15 minutes, whichever occurs first. |
| Quarantine evidence and rejected upload bytes | Accepted-upload sampled raw rows are removed immediately. Rejected uploads have a 48-hour appeal period, after which sampled rows and uploaded bytes are deleted. Pending uploads are automatically rejected after 30 days and then follow the rejected-upload deletion flow. |
| Run inputs | 30 days. |
| Gate/Guard copies | 30 days, except quarantine where the more specific quarantine lifecycle applies. |
| Account, organization, and ordinary operational data | During the active customer relationship, then deletion from ordinary primary systems within 30 days after closure/termination, except where applicable law or a justified legal/security hold requires longer retention. |
| Uploaded spreadsheet examples and context files | While required by an active workflow, then deletion within 30 days after the relevant automation or account is deleted. |
| Run logs | 90 days ordinarily. |
| Security and audit logs | 12 months ordinarily, with longer retention only through a controlled hold necessary for an actual incident, fraud/abuse investigation, dispute or legal obligation. |
| OAuth refresh tokens and related records | Refresh-token validity is 30 days; validity is distinct from database-row retention. Expired/revoked token, session and invitation records are subject to cleanup according to the Service lifecycle. |
| Ordinary backups | Ordinary cloud backup objects are scheduled for deletion after 90 days and may remain recoverable for up to a further 7 days under the configured soft-delete period, approximately 97 days in total. Host-copy rotation is configured for 14 days and operator sealed-copy rotation for 60 days. |
| Accounting, invoice, transaction, payment, and related statutory records | Certain accounting source documents, accounting records, invoices, transaction and payment records, and related records are retained for seven years where applicable Estonian accounting or tax law requires it. |
| Other contractual and legal records | We retain other records only for the period required by applicable law or reasonably necessary to establish, exercise, or defend legal claims. |
Where data is subject to a justified legal or security hold, we may retain the relevant data for longer than the ordinary period, but only for the purpose and duration of that hold.
12. Security
We use technical and organizational measures designed to protect personal data. Depending on the service component, these include encrypted transport, password hashing, hash-only token storage, OAuth security controls, tenant-scoped access, upload security inspection, isolated execution environments, access logging, and encrypted offsite backups.
No security measure can eliminate all risk. Customers are responsible for protecting their credentials, managing authorized users, reviewing outputs, and using the service consistently with their own security and legal obligations.
13. Your rights
Subject to applicable law and the circumstances of the processing, you may have the right to:
- request access to personal data about you;
- request correction of inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive certain data in a portable format;
- withdraw consent where processing is based on consent; and
- complain to a competent data-protection supervisory authority, including the Estonian Data Protection Inspectorate where applicable.
To make a request, email team@motivs.ai. We use the least intrusive verification reasonably sufficient, starting with logged-in/account context or a matching business email where appropriate. We request additional identification only where reasonably necessary or where identity or authority is genuinely in doubt. Requests are handled manually; we do not currently promise a self-service export or deletion portal.
We will respond without undue delay and, in any event, within one month of receiving your request. Where permitted by applicable law, we may extend that period by up to two additional months where necessary because of the complexity or number of requests. We will inform you of an extension and the reasons for it within the initial one-month period.
If Motivs processes the relevant information only on behalf of a business customer, we may refer the request to that customer or assist it in responding.
You may complain to the supervisory authority competent for your circumstances. This may include:
Andmekaitse Inspektsioon
Estonian Data Protection Inspectorate
Tatari 39
10134 Tallinn
Estonia
Email: info@aki.ee
Telephone: +372 627 4135
Website: https://www.aki.ee
14. Sensitive information in customer content
Motivs permits legitimate HR and similar business use. Where the GDPR applies, a customer processing special-category personal data through the Service must have both an applicable legal basis under Article 6 GDPR and an applicable condition under Article 9(2) GDPR, and must implement any additional safeguards required by applicable law. Motivs does not select an Article 9(2) condition for the customer and may request reasonable evidence that the customer has satisfied these requirements.
The Service does not automatically detect whether customer content includes special-category personal data.
Where Article 10 GDPR applies, the Customer must have an applicable legal basis under Article 6(1) GDPR, and personal data relating to criminal convictions or offences may be processed only under the control of official authority or where the processing is authorized by applicable Union or Member State law providing appropriate safeguards. Motivs' prior express written approval is an additional contractual requirement; it is not a legal basis or legal authorization for the processing.
15. Business service and children
Motivs is a B2B service intended for organizations and their authorized professional users. It is not offered as a consumer service for children. A customer remains responsible for determining whether information in its business files may lawfully include data about minors and for providing any required notices and safeguards.
16. Changes to this Policy
We may update this Policy to reflect changes in the service, law, or our processing practices. We will identify the version or effective date and provide any notice required by law or contract.
Acknowledging this Privacy Policy confirms that it has been made available; acknowledgment is not consent to processing that requires a separate consent choice.
17. Contact
MOTIVS OÜ
Registry code: 17567337
Commercial Register: Estonian Commercial Register
Registered address:
Rävala pst 7, Kesklinna linnaosa
Tallinn 10143, Harju maakond
Estonia
VAT number: EE103014074
Privacy and legal: team@motivs.ai
Product support: support@motivs.ai