Privacy Policy

This policy covers Motilo, Auckland, New Zealand ("we", "us"). Contact for anything about privacy: [email protected], or message us on Bluesky (@motilo.app).

We are the "controller" of your account, billing and usage data. If you upload content or scripts for work that contain any personal data (such as a presenter's name), you are responsible for that content as the controller, and we process it only on your instructions to create your videos.

Your account

• Your email address, to sign you in (we email you a sign-in link) and to send messages about your exports. If you sign in with Google, we also receive your name and profile picture link from Google.
• The welcome form you fill in once: first name (required); last name, whether you use Motilo personally or for work, your organisation, what you plan to make and how you heard about us (optional). We use it to address you and to understand who uses Motilo. You can change it any time on your account page.
• The country you signed up from, worked out once from your IP address by our network provider (Cloudflare). We store only the country, not the IP address.

What you create

• Uploaded images (infographics, slides, screenshots) are sent to our AI provider to read the content, then discarded. We never save them to disk, to our database or to logs.
• The text read from an image is kept for 7 days under a fingerprint of the image (not the image itself), so uploading the same image again is instant and free.
• Projects: the content and settings of each video (text, template, colours, fonts, format), so you can edit and export it again.
• Your logo and background photo, if you upload them, to place on your videos.
• Exported videos (MP4 files), for you to download.
• For explainer videos (invited accounts only): the document or script you provide is sent to our AI provider to draft a storyboard and is not stored; we keep the storyboard you edit and the generated voice audio.

Payments

Lemon Squeezy or Stripe processes your payment and, where needed, your billing address and VAT/GST number. We receive and keep a record of each top-up (amounts, tax, currency, country where the provider gives it, status and the provider's reference) and every change to your balance. We never see or store your card number. Where Lemon Squeezy acts as merchant of record, it is an independent controller for the data it needs to complete the sale, calculate tax and prevent fraud, under its own privacy policy (lemonsqueezy.com/privacy).

Support requests

When you contact us, we keep what you write, your email address (and name, if you give it), the topic, and the video it's about if you write from one. We also keep our replies and short internal notes our team writes about your request. If you answer one of our emails by email, we may add your reply to the conversation so nothing gets lost.

Security and abuse prevention

• While you are signed in, your session record holds your IP address and browser type, so we can spot unusual sign-ins.
• To stop abuse of free features, we count uploads per visitor and per scrambled (hashed) IP address. These counters are deleted after about a day.
• A bot check (Cloudflare Turnstile) runs when you sign in or upload. Cloudflare looks at technical signals from your browser to tell people from bots.
• For each AI request we record who made it, when, what kind it was, whether it worked and what it cost us (never the content), to control costs and prevent abuse.

Visitors without an account

When you upload without signing in, we create a temporary anonymous account (a session cookie, no email or name) so your projects are yours. If you sign in later, they move to your account. If you don't come back within 7 days, the temporary account and its projects are deleted.

• To provide the service you asked for (contract): your account, reading your uploads, projects, exports, payments, the emails about them, and answering your questions.
• Our legitimate interests: keeping Motilo secure, preventing abuse and fraud, understanding who uses Motilo from the optional welcome form answers, and improving the product. We weigh these against your rights and keep the data to a minimum.
• Legal obligations: keeping payment and tax records.

We don't send marketing emails and we make no automated decisions about you with legal or similarly significant effects.

We use Anthropic's Claude through its commercial API to read uploaded images and to draft explainer storyboards. Anthropic processes this content on our behalf, under its commercial terms and data processing addendum, and does not use it to train its models. Anthropic may keep API requests for up to 30 days solely for safety and abuse monitoring, after which they are automatically deleted.

Explainer voices are made with Microsoft Azure Speech using real-time synthesis: Microsoft doesn't store or log the text or the audio.

We share personal data only with providers that help us run Motilo, under contracts that limit what they can do with it. We never sell your data.

We may also share data when the law requires it, to protect our rights or users' safety, or with a buyer if Motilo is ever sold (who would then be bound by this policy).

Some providers above process data outside your country, including in the United States. Where data leaves the EU, UK or New Zealand, we rely on safeguards the law recognises, such as the European Commission's standard contractual clauses or a provider's certification under the EU–US Data Privacy Framework (and its UK extension). The safeguard each provider uses is listed in section 5. New Zealand itself is recognised by the European Commission as giving adequate protection.

When you delete a project, it and its exports are removed straight away. When you close your account, we delete your account data, projects, logo, background photo, videos and support conversations; we keep only the payment and balance records the law requires, and AI usage records without your email address.

We use only cookies that are strictly necessary to run Motilo, so we don't ask for cookie consent. We use no analytics, advertising or third-party tracking cookies, and we don't use browser storage to track you across sites.

Connections to Motilo are encrypted (HTTPS). Download links are given only to the video's owner and expire after 5 minutes. Only a small number of our staff can see account and payment details, and only to run the service and support you. No system is perfectly secure, but if a breach affects your data, we will tell you and the authorities as the law requires.

Wherever you live, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it (you can also edit your details on your account page);
• delete it (you can delete projects yourself; email us to close your account);
• send it to you in a format you can take elsewhere;
• stop or limit using it, or object to uses based on our legitimate interests.

Write to us through the contact page (topic "My account or data") or email [email protected] from the address on your account. We reply within one month and don't charge for this.

If you're not happy with our answer, you can complain to your local data protection authority (such as the Office of the Privacy Commissioner in New Zealand, the Information Commissioner's Office in the UK, your national authority in the EU, or the UAE Data Office).

Motilo is not meant for children under 16. We don't knowingly collect their data; if you think a child has given us personal data, email us and we will delete it.

When we change this policy, we update the date at the top. If a change is important, such as a new kind of data or a new provider, we tell you by email or on the site before it takes effect.