Data Processing Agreement

Effective Date: September 22, 2026 Version: 1.3

This Data Processing Agreement (“DPA”) is between the organization that holds a Motif account (“Organization”) and Motif Bio, Inc., a Delaware corporation (“Motif”). Every Motif account is an organization. This DPA applies from the moment that organization is created, and it is incorporated into the Terms of Service. A countersigned copy of this same text is available on request at hello@motif.bio.

If this DPA conflicts with the Terms on a question of personal data, this DPA controls. The Standard Contractual Clauses and the UK Addendum control where they apply.

1. Roles

The Organization is the controller, and Motif is the processor, for personal data Motif processes to provide the Service on the Organization’s instructions.

Motif is an independent controller for processing it decides for itself: securing the Service, detecting fraud and abuse, keeping records Motif must keep to meet a legal obligation, and training Motif’s own models while model training is enabled. On a self-serve plan, training is on until the account turns it off. On Enterprise, training is off unless a written addendum sets the organization flag. Privacy Policy Section 3.7 describes that setting. Those activities are not processing under the Organization’s instructions.

2. Instructions

Motif processes personal data only on the Organization’s documented instructions, including for transfers, unless the law Motif is subject to requires otherwise. The Terms, this DPA, and the Organization’s use of the Service are those instructions. Motif will tell the Organization if an instruction appears to violate applicable data protection law, unless the law forbids that notice.

3. Confidentiality

Motif limits access to personal data to people who need it to perform the Service, and binds them to confidentiality.

4. Security

Motif applies the technical and organizational measures in the Security Whitepaper. Annex II states where those measures sit. Motif does not copy them into this DPA.

5. Subprocessors

The Organization gives Motif general written authorization to use the subprocessors in Annex III. Motif imposes data protection obligations on each subprocessor that are no less protective than this DPA, and Motif remains liable for a subprocessor’s performance of those obligations.

Motif gives at least 30 days’ notice before adding a subprocessor that processes personal data, by updating the Trust Center. Subscribe at hello@motif.bio. The Organization may object on reasonable data-protection grounds before the notice period ends. If the parties cannot resolve the objection, the Organization may stop using the affected part of the Service.

6. Assistance

Motif assists the Organization, taking into account the nature of the processing, with requests to access, correct, delete, export, or object to processing of personal data, and with security, breach notification, and impact assessments Motif is in a position to support.

Motif notifies the Organization without undue delay after becoming aware of a personal-data breach affecting the Organization’s personal data, and provides the information the Organization reasonably needs to meet its own notification duties.

7. Deletion and return

When the organization is deactivated or deleted, Motif deletes or returns personal data as Privacy Policy Section 5 describes, which is the behavior of the account-deletion path:

• The user account, credentials, connected Google sign-in, sessions, profile, preferences, organization membership, and that user’s session replay recordings are deleted.
• Conversation rows, message text, pipeline-run rows, upload rows, and the stored files stay. The account id on those rows is replaced with a system identifier. Message text is not rewritten. The account id is removed from contributing-user lists on entities. Knowledge-graph rows stay in the organization on the same basis.
• Billing rows stay on the organization and are removed if that organization is deleted. Stripe keeps payment and invoice records under Stripe’s own retention.

Motif does not promise erasure of message text, pipeline runs, uploads, or library files on account deletion. It does replace the account id on those rows with a system identifier.

8. Audits

Motif makes available the information reasonably needed to show compliance with this DPA. Until a SOC 2 Type II report exists, that information is the Security Whitepaper and answers to a written security questionnaire. This DPA does not promise on-site audits.

9. International transfers

Motif stores the Service in the United States. The AI pipeline runs on a Netcup server in the European Union. OpenRouter may route a request to a model host outside the United States and the EU.

For a transfer of personal data from the EEA, Switzerland, or the United Kingdom to Motif in the United States, the parties incorporate the European Commission’s Standard Contractual Clauses of 4 June 2021:

• Module Two (controller to processor), where the Organization is the controller and Motif is the processor.
• Module Three (processor to processor), where Motif is a processor and the next recipient is a subprocessor.

For those clauses: Clause 7 (docking) is not used. Clause 9, Option 2 (general written authorization) applies, with the notice period in Section 5. Clause 11 (redress) is not used. Clause 17 is the law of Ireland. Clause 18 is the courts of Ireland. Annex I of the clauses is Annex I of this DPA. Annex II of the clauses is Annex II of this DPA. The competent supervisory authority is the Irish Data Protection Commission, unless the Organization is established in a different EEA state, in which case it is that state’s authority.

For United Kingdom transfers, the UK Addendum to those clauses (the International Data Transfer Addendum issued by the Information Commissioner) applies. For Swiss transfers, the clauses apply with Switzerland treated as an EU member state for that purpose, and references to the GDPR read as references to the Swiss Federal Act on Data Protection.

10. United States service-provider terms

Where the California Consumer Privacy Act or a similar US state law applies, Motif is a service provider or processor. Motif does not sell or share personal information. Motif does not retain, use, or disclose it except to provide the Service, as this DPA allows, or as the law permits a service provider. Motif does not combine it with personal information received from another customer, except as needed to provide the Service and to secure it. These terms do not make Google Analytics or Meta a service provider. Those products are described in the Privacy Policy and are not subprocessors under Annex III.

11. Customer Data

“Customer Data” means the Organization’s personal data and the other content the Organization submits to the Service, including uploads, queries, extraction outputs, and workspace-graph material tied to the Organization. Confidentiality of Customer Data that is not personal data is also covered by Terms Section 17. A protein sequence or structure with no identifier is still Customer Data.

12. Artificial intelligence

OpenRouter’s data processing agreement deletes API payloads after the response unless prompt logging is turned on. Routing limited to providers marked no-retention and no-training applies when zero-data-retention routing is on. OpenRouter does not guarantee that those providers comply with that mark.

Motif’s inference, including figure and table image extraction, turns that routing on and refuses providers that collect inputs for training. OpenRouter does not guarantee that a provider marked no-training refrains from training.

Motif’s own training follows Privacy Policy Section 3.7. Subprocessors are not instructed to train their foundation models on Customer Data.

The Service is for research. The Organization will not submit patient data or data for clinical or patient-care decisions. Motif is the provider of the Motif AI system. The Organization is the deployer when it uses Motif under its authority. Model hosts are providers of the underlying models. Visible and machine-readable marking of AI output is part of the Service. This DPA does not restate the export formats.

13. Duration

This DPA lasts while the organization is active, and afterwards for the retention in Annex I and Section 7.

Annex I. Processing

Annex II. Security

The measures are the Security Whitepaper. Incident notification is Section 6 of this DPA.

Annex III. Subprocessors

Model hosts engaged by OpenRouter are further subprocessors. The current route is available on request at hello@motif.bio. Google Analytics and Meta are not on this list.