Privacy Policy

In short: Open Motives is a workspace businesses use to run their social media and customer conversations. For your account, billing and our website, we decide how your data is used and we are responsible for it. For the messages, contacts and posts that flow through your workspace, we process data only on your instructions, as your processor. We don’t sell personal data, we don’t use your content to train AI models, and we send content to an AI provider only when you use an AI feature, and only to the provider you chose. You can ask us to access, correct, export or delete your data at any time by writing to [email protected].

Who we are

Open Motives is operated by Open Motives, of the registered address available on request from [email protected] (“Open Motives”, “we”, “us”). This policy is effective from 28 October 2026.

It covers our website, the app at app.openmotives.com, the client portal, our API and MCP server, and the emails we send. It does not cover services run by our customers or by third parties.

Our two roles

We play two different roles under data protection law, depending on whose data it is and why we hold it.

We are the controller for personal data about our own customers and visitors: account details, billing information, product usage, support conversations and website analytics. This policy explains how we handle that data.
We are a processor (a “service provider” under Californian law) for personal data our customers put into, or receive through, their workspaces. That includes their end customers’ messages, contact details, comments and order details. Our customer, the business that owns the workspace, is the controller and decides how that data is used. Our Data Processing Addendum sets out the terms.

If you messaged a business that uses Open Motives (say you sent Kettle & Co. a WhatsApp about cardamom buns), that business is responsible for your data. Please contact them first. If you contact us, we will pass your request on.

The data we collect

Account and profile data

When you sign up or are invited to a workspace we collect your name, email address, password (stored as a one-way hash), organisation and workspace names, role, profile photo if you add one, language and time zone, and two-factor authentication settings.

Billing data

For paid plans we collect the billing contact, company name, billing address, tax or VAT number where relevant, plan and invoice history. Card payments are handled by our payment processor. We do not see or store full card numbers.

Usage and device data

When you use the app we record how it is used so we can run, secure and improve it: features used, actions taken, IP address, browser and device type, approximate location derived from IP, timestamps and error reports. This includes workspace activity logs, which you can view and export.

On our marketing site we use strictly necessary cookies and privacy-friendly analytics. Where the law requires consent, we ask before setting anything that isn’t essential. See our Cookie Policy for details.

Communications

If you contact support, sales or our privacy team, we keep that conversation and your contact details.

Connected-channel data we process for customers

When a customer connects a channel or app, we process the data needed to provide the features they switched on. Depending on the channel, this can include:

messages, attachments, voice notes and comments sent through WhatsApp, Instagram, Messenger, Telegram, the website chat widget, email and SMS
public profile details of people who message or comment, such as name, username, profile picture and phone number or email address
contact records, tags, notes, conversation history and custom fields the customer adds
posts, media, captions, schedules, approval history and analytics from connected social accounts
ad account, campaign and performance data from Meta
order details from connected stores such as Shopify or WooCommerce
access tokens and credentials for connected accounts, which are encrypted at rest

We handle this data as a processor, only on our customer’s instructions.

How and why we use data

For the data we control, we rely on the following purposes and legal bases under the GDPR and UK GDPR.

Purpose	Legal basis
Creating and running your account and workspaces, and providing the features you use	Performance of our contract with you
Billing, invoicing, tax and accounting	Contract, and our legal obligations
Keeping the service secure, preventing fraud, spam and abuse, and enforcing our terms	Our legitimate interest in a safe, reliable service
Customer support and service messages (such as security alerts, billing notices and connection problems)	Contract, and our legitimate interests
Understanding how the product is used and improving it, using aggregated or de-identified data where we can	Our legitimate interest in improving Open Motives
Product news and marketing emails	Consent where required, otherwise our legitimate interests. You can unsubscribe at any time
Non-essential cookies and analytics where consent is required	Consent
Complying with law and responding to lawful requests	Legal obligation

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time.

We use connected-channel data only to provide and secure the service for the workspace owner and to meet legal obligations, never for our own marketing.

AI features

Open Motives includes optional AI features, such as the AI Employee, Copilot, drafting help, summaries and sentiment detection. When you or a workflow uses one of these features, the content needed for that task (for example the conversation, the relevant knowledge base entries or a post draft) is sent to an AI provider.

You choose the provider. If you bring your own key, the content goes to the provider and account you configured (for example OpenAI, Anthropic, Google Gemini, Mistral or Azure OpenAI), under your agreement with them. Where a plan includes AI credits, we send it to a provider we have contracted with, as our sub-processor.
We do not use customer content to train AI models, and we do not allow the providers we contract with to train their models on it.
AI is off until you turn it on. Each AI Employee either sends replies automatically or drafts for approval, as you decide. Write actions on connected apps always wait for a teammate to approve them.
AI providers process content under their own terms and privacy commitments. If you use your own key, please check that provider’s data-use and retention settings.

We do not use AI to make decisions that have legal or similarly significant effects on you.

Platform data: Google, Meta and other networks

Open Motives connects to platform APIs, including Meta (Facebook, Instagram, Messenger and WhatsApp), Google (including YouTube, Google Sheets and Google Drive), TikTok, LinkedIn, X, Threads, Bluesky and Telegram. For data we receive from these platforms:

We access only the data needed for the features you switched on, and we ask only for the permissions those features require.
We use it only to provide and improve those user-facing features. We do not use it for advertising, we do not sell it, and we do not use it to build profiles for any other purpose.
We do not transfer it to others except as needed to provide the features, to comply with law, for security, or as part of a merger or acquisition with notice to you.
Our staff do not read it unless you ask us to (for example in a support case), it is needed to investigate security or abuse, or the law requires it.
When you disconnect an account, we stop collecting data from it and delete the stored access tokens. You can also ask us to delete the data we obtained from it, unless the law requires us to keep it.

Google. Open Motives’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised AI or machine-learning models. When you connect YouTube, you also agree to the YouTube Terms of Service, and Google’s Privacy Policy applies. You can revoke our access at any time from your Google Account security settings, as well as from Open Motives.

Meta. We follow the Meta Platform Terms and Developer Policies when handling data from Facebook, Instagram, Messenger and WhatsApp. You can remove Open Motives from your Facebook or Instagram business integrations settings, and you can ask us to delete Meta platform data by emailing [email protected] or using the data deletion option in the app.

We don’t sell personal data. We share it only in these situations.

Sub-processors and service providers

We use carefully chosen providers to run Open Motives. They may process personal data on our behalf, under contracts that limit their use of it. The categories are:

Cloud hosting and infrastructure: servers, databases, storage, backups and content delivery
Payments: our payment processor handles card payments, invoices and tax calculation
Email delivery: sending service, notification and digest emails
Analytics and error monitoring: privacy-friendly product and website analytics, and crash reporting
Customer support tools: help desk and support chat
AI providers: when a plan includes AI credits, the provider that supplies them. When you bring your own key, the provider works under your agreement, not ours

We keep a current list of sub-processors, available from [email protected], and we notify customers before adding new ones as set out in the DPA.

To deliver a message or publish a post, we have to send content to the network you chose, such as Meta, WhatsApp, Telegram, TikTok, YouTube, LinkedIn, X, Threads or Bluesky, or to an email or SMS provider. These networks handle that data under their own terms and privacy policies.

Apps you connect

If you connect an integration, such as Google Sheets, HubSpot, Slack, Microsoft Teams, Shopify, a webhook or a custom MCP server, we send it the data your settings tell us to send.

Within your workspace

Teammates, portal clients and people with review links see the data you give them access to.

Legal and business reasons

We may disclose data if the law requires it, to respond to valid legal requests, to protect the rights and safety of our users, the public or Open Motives, or as part of a merger, acquisition or sale of assets. In a business transfer we would tell you about any change to how your data is handled.

International transfers

Our team and providers may be outside your country, including outside the UK and European Economic Area. When we transfer personal data out of the UK or EEA, we rely on an adequacy decision or an approved safeguard, usually the European Commission’s Standard Contractual Clauses with the UK International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards at [email protected].

How long we keep data

We keep personal data only as long as we need it.

Account data is kept while your account is active. After you close your account we delete or anonymise it within a reasonable period, unless we need to keep some of it for the reasons below.
Workspace content (connected-channel data) is kept according to the workspace owner’s settings and instructions. When a workspace is deleted, we delete its content from live systems, and it then expires from our backups on their normal cycle.
Billing records are kept for as long as tax and accounting laws require.
Security and activity logs are kept for a limited period to protect the service and investigate incidents.
Unsubscribe records are kept so we can respect your choice.

How we protect data

Our measures include two-factor authentication (which organisations can require for everyone), encryption of credentials at rest with AES-256-GCM, hashed API keys, tenant isolation at the database layer, an activity log, and blocking outbound calls to private networks. Read more on our Security page.

No system is perfectly secure. If a personal data breach affects you, we will tell you and the relevant authorities as the law requires.

Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you and get a copy
correct data that is inaccurate or incomplete
delete your data
restrict or object to our use of it, including for direct marketing
port your data to another service in a common, machine-readable format
withdraw consent at any time, where we rely on consent
complain to a data protection authority, such as the UK Information Commissioner’s Office or the supervisory authority where you live or work

California residents

Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect, use and disclose, and to delete or correct it. In the past 12 months we have collected identifiers, commercial information (billing and plan), internet activity, approximate geolocation and professional information, for the purposes described in this policy.

We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights, and you may use an authorised agent to make a request.

How to exercise your rights

Email [email protected]. Many requests can also be handled directly in the app: you can update your profile, export data and close your account in your settings.

We may need to verify your identity before acting on a request. We will reply within one month (45 days for California requests), and let you know if we need more time.

If your data was processed by one of our customers, for example as a contact in their inbox, please contact that business. Workspace owners can export or erase everything about a single contact, with an audit trail, so they can respond to you quickly.

Children

Open Motives is a business service for people aged 18 and over. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact [email protected] and we will delete it. Our customers are responsible for data about children who contact them through their channels.

Changes to this policy

We may update this policy as our product or the law changes. We will change the “last updated” date at the top of the page, and if the changes are significant we will tell account owners by email or in the app before they take effect.

Contact us

For any question about this policy or your personal data, contact us at:

Email: [email protected]
Post: Open Motives, the registered address available on request from [email protected]