Data Processing Addendum

In short: When your customers message you, comment on your posts or end up in your contact list, that personal data belongs to you, and we process it only to run Open Motives for you. This addendum sets out the promises data protection law requires: we follow your instructions, keep the data confidential and secure, use only approved sub-processors, help you answer privacy requests, tell you quickly about a breach, and delete the data when you leave. It applies automatically when you accept our Terms. If you need a signed copy for your records, email [email protected] and we’ll send you a countersigned version.

About this addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between Open Motives, of the registered address available on request from [email protected] (“Open Motives”, “we”, “us”), and the customer that accepts the Agreement (“Customer”, “you”). It applies from 28 October 2026, or from the date you accepted the Agreement if later.

It applies whenever we process Customer Personal Data on your behalf in providing the Service. If this DPA conflicts with the Agreement, this DPA takes priority for anything to do with personal data.

Definitions

Data Protection Law means all laws on privacy and personal data that apply to the processing, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the CPRA (“CCPA”).
Customer Personal Data means personal data in Customer Content that we process on your behalf under the Agreement.
Sub-processor means a third party we engage to process Customer Personal Data.
Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
“Controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings given in the GDPR.

Scope and roles

Roles

You are the controller of Customer Personal Data (or a processor acting for your own client, in which case you confirm you have your client’s authority). We are your processor. Under the CCPA, we act as your service provider.

For the personal data we collect about you and your users to run our own business, such as account, billing and usage data, we are an independent controller and our Privacy Policy applies.

Details of the processing

Item	Description
Subject matter	Providing the Open Motives social media workspace under the Agreement
Duration	The term of the Agreement, plus the period until deletion as described in this DPA
Nature and purpose	Hosting, storing, organising, transmitting, displaying, analysing and deleting data so that you can run your inbox, publish content, run workflows and AI features, view analytics, manage ads and use the API and MCP server
Data subjects	Your end customers, leads and contacts; people who message or comment on your connected accounts; your clients and their staff; your teammates
Categories of data	Names, usernames, profile details, phone numbers, email addresses, message and comment content, attachments, voice notes, contact tags, notes and custom fields, order details from connected stores, conversation metadata and similar data you choose to process
Special category data	None intended. You should not ask people to send special category data unless you have a lawful basis and appropriate safeguards. We recognise that people may include it in messages they send to you

Your responsibilities

You are responsible for having a lawful basis for the processing, for giving people the information the law requires, for collecting any consents needed (including messaging opt-ins), and for making sure your instructions comply with Data Protection Law.

Processing on your instructions

We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we’ll tell you before processing unless the law forbids it.

Your instructions are set out in the Agreement and this DPA, and in how you configure and use the Service, including the channels you connect, the workflows and AI Employees you set up, the integrations you enable and the API calls you make. Further instructions must be agreed in writing.

We will tell you if we believe an instruction breaks Data Protection Law. We are not required to carry out an instruction we reasonably believe is unlawful.

CCPA terms

As your service provider, we will not sell or share Customer Personal Data, as those terms are defined in the CCPA. We will not retain, use or disclose it for any purpose other than providing the Service, or outside our direct business relationship with you, and we will not combine it with personal data from other sources except as the CCPA allows. We will tell you if we can no longer meet our CCPA obligations.

Confidentiality

We make sure that everyone authorised to process Customer Personal Data, including our staff and contractors, is bound by a duty of confidentiality. We limit access to the people who need it to provide, support or secure the Service. Our staff do not access the content of your workspace unless you ask us to (for example in a support case), it is needed to keep the Service secure, or the law requires it.

Security measures

We implement appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. Our measures currently include:

Encryption of credentials at rest. Access tokens, channel credentials, AI provider keys and webhook URLs are encrypted at rest with AES-256-GCM.
Hashed API keys. API keys are stored only as hashes, and each key is scoped to one workspace and the connected accounts you choose.
Two-factor authentication. Users can sign in with an authenticator app and recovery codes, and organisations can require 2FA for everyone.
Tenant isolation. Isolation between customers is enforced at the database layer, with permission checks on every page, socket and API call.
Roles and permissions. Built-in and custom roles, with rights set per connected account, so people see only what they need.
Activity logs. A log of who did what, when and from where, with filters and CSV export.
Private-network egress blocking. Workflow HTTP steps, MCP servers, site crawls and webhooks are blocked from reaching private networks.
Signed webhooks. Outgoing webhooks are signed so the receiver can check they came from us.
Monitoring. Connection health checks every six hours, and pre-flight checks on posts that are due soon.
Encryption in transit. Data is sent over encrypted connections.
Approvals for AI actions. Write actions taken by AI on connected apps wait for a teammate’s approval, and what is approved is exactly what runs.

We review these measures regularly and may update them, as long as the update does not lower the overall level of protection. More detail is on our Security page.

Sub-processors

Authorisation

You give us general authorisation to engage Sub-processors. The categories we use are cloud hosting and infrastructure, payments, email delivery, analytics and error monitoring, customer support tools and, where your plan includes AI credits, AI providers. A current list of Sub-processors is available on request from [email protected].

We will put a written contract in place with each Sub-processor that gives Customer Personal Data at least the same protection as this DPA. We remain responsible to you for our Sub-processors’ performance.

Notice of changes and right to object

We will give you at least 30 days’ notice before a new Sub-processor starts processing Customer Personal Data, by email to the account owner or in the app. If you have reasonable data protection grounds to object, tell us within that period. We’ll work with you in good faith to find a solution. If we can’t, you may end the affected part of the Service and we’ll refund any prepaid fees for the unused period.

Services you choose

Some third parties process data because you chose to connect them, not because we engaged them. These are not our Sub-processors, and their own terms apply:

Messaging and social networks such as Meta, WhatsApp, Instagram, Telegram, TikTok, YouTube, LinkedIn, X, Threads and Bluesky, and the email or SMS providers you connect
AI providers you configure with your own key, such as OpenAI, Anthropic, Google Gemini, Mistral or Azure OpenAI. They act under your agreement with them
Integrations you enable, such as Shopify, WooCommerce, HubSpot, Google Sheets, Google Drive, Dropbox, Slack, Microsoft Teams, webhooks and custom MCP servers

When you connect one of these, you instruct us to send it the data your configuration requires.

No AI training

We do not use Customer Personal Data to train AI models, and we do not allow the AI providers we engage as Sub-processors to train on it.

Helping you meet your obligations

Data subject requests

The Service lets you respond to most requests yourself. You can find a contact and their conversations, correct their details, and export or erase everything about a single contact, with an audit trail. If we receive a request directly from one of your data subjects, we will pass it to you without undue delay and will not respond ourselves, except to tell the person to contact you, unless you ask us to. Where you can’t fulfil a request with the tools in the Service, we will give reasonable help.

Assessments and consultations

Taking into account the information available to us, we will give reasonable help with data protection impact assessments and prior consultations with supervisory authorities that relate to your use of the Service.

Security incidents

If we become aware of a Security Incident, we will notify you without undue delay. Our notice will describe, as far as we know at the time:

the nature of the incident, including the categories and approximate number of data subjects and records affected
the likely consequences
the measures we have taken or propose to take to deal with it and reduce its effects
a contact point for more information

Where we can’t provide everything at once, we’ll provide it in phases as we learn more. We’ll take reasonable steps to contain and investigate the incident and to stop it happening again. Notifying you is not an admission of fault.

Unless the law requires otherwise, you are responsible for notifying supervisory authorities and data subjects, and we’ll give you the information you reasonably need to do so.

Deletion and return

You can export your data at any time while your account is active, using the export tools in the Service and the API.

When the Agreement ends or a workspace is deleted, we will delete Customer Personal Data from our live systems within a reasonable period, unless the law requires us to keep it. Copies in backups will be deleted as the backups expire on their normal cycle, and we’ll keep them protected and won’t actively process them in the meantime. If you’d like us to confirm deletion in writing, email [email protected].

Audits and information

We will make available the information reasonably necessary to show that we comply with this DPA. This includes answers to reasonable security questionnaires and a description of our security measures.

If that information is not enough to show compliance, or a supervisory authority requires it, you may audit our compliance with this DPA, either yourself or through an independent auditor bound by confidentiality, on these terms:

you give us at least 30 days’ written notice
audits take place no more than once in any 12-month period, unless after a Security Incident or at a supervisory authority’s request
audits happen during normal business hours, avoid disrupting our operations, and do not give access to other customers’ data
you pay the costs of the audit, including our reasonable costs of supporting it

International transfers

We and our Sub-processors may process Customer Personal Data outside the UK, European Economic Area and Switzerland. Where we transfer it to a country that hasn’t received an adequacy decision, we will make sure it is protected by a valid transfer mechanism:

EU transfers: the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), Module 2 (controller to processor) where you are a controller and Module 3 (processor to processor) where you are a processor, which are incorporated into this DPA by reference
UK transfers: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement (IDTA), as appropriate
Swiss transfers: the Standard Contractual Clauses, with the changes the Swiss data protection authority requires

For the Standard Contractual Clauses, the details of the processing are those set out in this DPA, the security measures are those described above, and the governing law and courts are those of the EU member state or UK country chosen in the clauses. If a transfer mechanism is invalidated, we will work with you to put a suitable alternative in place.

We also flow equivalent protections down to our Sub-processors.

Liability and term

Each party’s liability under this DPA is subject to the limits in the Agreement, to the extent Data Protection Law allows. This DPA stays in force for as long as we process Customer Personal Data on your behalf.

Signed copies and questions

This DPA applies automatically when you accept the Terms, so you don’t need to sign anything for it to take effect. If you’d like a countersigned copy for your records, or have questions about how we process personal data, email [email protected]. For privacy requests and the current list of Sub-processors, email [email protected].