Privacy

What this covers

How MOTION handles personal information: your staff's, and your customers'. Your customers gave their details to you, not to us — we hold them on your behalf and act on your instructions.

What we hold

For your staff: name, email address, the workshop they belong to and what they are allowed to do. A password is never stored — only a value derived from it that cannot be turned back.

For your customers: whatever you enter. Typically a name, a telephone number, an email address, an address, and the vehicles and jobs attached to them.

We also keep a record of who did what inside MOTION — who raised a document, who voided one, who exported data — because a workshop's books have to be provable.

What we do not do

We do not sell personal information. We do not use it to train models. We do not use your customers' details to market anything to them, and we do not mix one workshop's data with another's — separation is enforced in the database itself, not by application code remembering to filter.

Where it lives

On the hosted service, on servers we operate. Where MOTION is installed on your own equipment, it lives on your equipment and we hold none of it except what you send us when you ask for support.

To decide: Name the hosting country and provider once staging is chosen. A council will ask, and “we will tell you later” loses tenders.

Who else sees it

Nobody, except the small number of suppliers we need to run the service — hosting, and file storage where you have configured it. They act on our instructions and may not use your data for anything else.

We will disclose information where the law genuinely requires it. If that happens and we are allowed to tell you, we will.

To decide: A named subprocessor list, with the hosting provider on it. Enterprise procurement asks for this by name.

How long it is kept

For as long as you are a customer, and for a period afterwards so that a workshop coming back does not find its history gone.

A workshop's books are usually kept far longer than a subscription — seven years is the working assumption for accounting records here. Deletion requests are honoured except where keeping something is a legal requirement, in which case we will say so.

To decide: Confirm the retention period with a council or an accountant before publishing a figure. Seven years is assumed, not verified.

Your rights, and your customers'

Ask us what we hold about you and we will tell you. Ask us to correct it and we will. Ask us to delete it and we will, within what the law allows.

Where the request is about one of your customers, it comes to you first — they are your customer and the data is yours to correct. MOTION gives you the tools to do it without us.

Security

Passwords, session tokens, invitation links and API keys are stored as values that cannot be reversed. Each workshop's data is separated inside the database by rules the database enforces. Access to what people can see is set by role, and removing contact details for staff who should not see them happens on the server, before the page is built, rather than by hiding them in the markup.

No system is beyond compromise. If one happens and it affects you, we will tell you promptly and plainly.

Reaching us about this

Use the support page. Say that it is a privacy question and it will be treated as one.