Privacy Policy

Effective Date: October 9, 2026 Version: 2.5

1. Introduction

Motif (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our biomedical research platform (“Service”).

This Privacy Policy describes our data practices. Our legal bases for processing your personal data are set out in Section 3.6.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly:

• Account Information: Email address, name, honorific, contributor role, organization affiliation
• Research Data: Search queries, uploaded documents, annotations, notes, votes, Structured Corrections (field-level changes you save on an extracted finding, including the rationale)
• Payment Information: Full card numbers are entered via Stripe. Motif retains only card brand, last four digits, and expiry for the billing page, plus billing and tax records required for accounting
• Communications: Support requests, feedback, and correspondence, including Slack if you use community or personal support channels

2.2 Information Collected Automatically

We automatically collect certain information:

• Usage Data: Features used, search patterns, session duration, subscription and metering events
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP addresses, access times, pages viewed
• IP address: Used for abuse prevention, rate limiting, and login anomaly checks (device and IP patterns). Motif does not resolve IP addresses to city or country for security decisions
• Cookies: Session tokens, preferences, and—when you opt in—analytics and marketing tags on Motif chat (see Section 8)
• Session replay (only with session-replay consent): A reconstruction of your interaction with the Motif chat and dashboard product UI (DOM structure, clicks, scrolls, and navigation). Password, MFA, payment, and similar secret fields are masked. Replay data is stored in Motif-controlled Cloudflare R2 storage and PostgreSQL metadata, and is viewable only by Motif administrators for support and product debugging. It is not a camera or screen video of you.

2.3 Information from Third Parties

We may receive information from:

• OAuth Providers: Google account information when you sign in
• Payment Processors: Transaction confirmations from Stripe
• Analytics Services: Aggregated usage statistics

2.4 Special Categories of Data

Our Service is a research tool. We do not intentionally collect data concerning your personal health. Search queries about biomedical topics are processed to deliver research results and are not used to infer your personal health status.

The Service may not be used to upload or process Protected Health Information or other individually identifiable health information. This is a contractual prohibition under Section 7.3 of the Terms of Service, not a recommendation: Motif is not a HIPAA business associate, does not sign Business Associate Agreements, and its safeguards are not designed or assessed for this category of data. Do not upload documents containing your own or any other individual’s personal health data unless it has been de-identified in accordance with 45 C.F.R. § 164.514.

3. How We Use Your Information

3.1 Service Delivery

We use your information to:

• Provide and maintain the Service
• Process your research queries and requests
• Manage your account and subscriptions
• Provide customer support

3.2 Service Improvement

We use data to:

• Improve AI models and search algorithms
• Develop new features and functionality
• Analyze usage patterns and optimize performance
• Conduct research and analytics
• Debug product issues and support requests using session replay when you have consented to session replay (see Sections 2.2 and 8)

We may aggregate or de-identify personal data so that it no longer identifies you, and use that information for the purposes described in this Policy. We will maintain de-identified information in its de-identified form and will not attempt to re-identify it, except as required by law or to verify that de-identification remains effective.

3.3 Communication

We may contact you to:

• Send service-related notifications
• Provide updates about your account
• Share important security alerts
• Send marketing communications (with consent)

3.4 Safety and Abuse Prevention

When you set a profile or organization name, Motif may send that name to OpenAI’s moderation API and reject it if the result is in an abuse category (hate, harassment, or sexual content). A rejected name is not saved. Research queries are not sent to OpenAI for this check. If the moderation service is unavailable, the name is accepted. OpenAI states that inputs to the moderation endpoint are not used to train its models.

Separately, we process account, device, usage, billing, and metering data to prevent, detect, and investigate fraud, subscription and billing abuse, attempts to reset or evade included usage limits (including by creating extra Motif user accounts), security incidents, and violations of our Terms of Service. Included usage and overage are metered per organization against that organization’s subscription and budget. Belonging to more than one organization under a single Motif user account is normal and permitted. We do not currently operate an automated cross-account payment-method matching system; Motif may still investigate suspected multi-login abuse using records it already holds (for example billing history, support correspondence, and security logs) and may take action under the Terms.

3.5 Legal Compliance

We process data to:

• Comply with legal obligations
• Respond to lawful requests
• Protect our rights and property
• Investigate and resolve disputes or security issues
• Enforce our Terms of Service and other applicable agreements

3.6 Legal Basis for Processing (EEA Users)

Under GDPR, we process your data on the following bases:

• Contractual necessity (Article 6(1)(b)): Service delivery, account management, subscription processing
• Legitimate interest (Article 6(1)(f)): Service improvement, security, analytics, safety and abuse prevention including fraud and billing-abuse detection (see Section 3.4), AI model training (see Section 3.7)
• Consent (Article 6(1)(a)): Marketing communications; optional cookies by purpose (analytics, marketing tags, and session replay) as described in Section 8
• Legal obligation (Article 6(1)(c)): Tax records, regulatory compliance

3.7 AI Model Training

We may use your research sessions (the prompts Motif sends to a language model on your behalf and the responses it receives, including the text of the documents those prompts carry) and the Workspace Graph (the entities, associations, evidence links, and reports Motif produces for your organization in the Service) to train and improve our own AI models. We rely on legitimate interest (Article 6(1)(f)) for this processing, having weighed our interest in improving extraction quality against your privacy rights. Research sessions and graph data belong to scientific work rather than to personal life, and the data of any user who has objected are excluded from the eligible corpus at the point of use, so an objection also covers sessions and graph data already recorded.

The setting is enabled by default on self-serve plans and each user can disable it at any time in dashboard settings, which is how the right to object under Article 21 GDPR is exercised. Disabling it excludes your past and future research sessions and Workspace Graph data from every training run started from that point; it cannot remove data from models already trained. On Enterprise, that use is off unless a written addendum sets it for the organization. Members see the setting and cannot change it in the dashboard. The model training setting does not limit Motif’s use of Motif Graph Content under the Terms of Service Section 4.1, or of Curation Data under Section 4.4.

Files you upload are not read out of storage for training; their text is processed only as part of the research sessions you run. See How Motif uses your data to improve our AI models.

4. Data Sharing and Disclosure

4.1 Service Providers

We share data with trusted third parties who support our business operations. The current list of subprocessors, and of parties that are not subprocessors (Google sign-in, reCAPTCHA, Google Analytics, Meta), is published in the Trust Center. Material changes are reflected there; you may also request the current list, including AI model providers in scope, at hello@motif.bio.

Session replay is processed on Motif infrastructure (Neon metadata and Cloudflare R2 event chunks). It is not sent to Google Analytics or Meta. Cookie purposes are in Section 8.

AI Processing Disclosure: Your search queries and selected documents are processed through OpenRouter, which routes requests to third-party large language model providers, to provide AI-powered summaries, entity extraction, relationship identification, and cross-referencing. Inference, including figure and table image extraction, uses OpenRouter zero-data-retention routing and refuses providers that collect inputs for training. OpenRouter deletes API payloads after the response unless prompt logging is enabled, and it does not guarantee that a provider marked no-training refrains from training. Because routing is dynamic, this processing may occur outside the United States and EU. A current list of AI sub-processors is available in the Trust Center and upon request at hello@motif.bio.

4.2 Your Knowledge Graph

Members of your organization can see the Workspace Graph in the Service. You can remove the link between your identity and entries you created at any time using Anonymize My Contributions in dashboard settings. That replaces your account id with an anonymous system identifier on conversations, graph rows, pipeline runs, and uploads, removes it from contributing-user lists, and leaves the scientific data and files in place.

Motif may include Motif Graph Content (entities, associations, evidence links, and scores extracted from public literature) in Motif products and Motif Dataset, without identifying your organization, as described in Terms of Service Section 4.1. Motif Dataset does not include unpublished documents or your search queries. Curation Data enters Motif Dataset only under Terms of Service Section 4.4, without identifying your organization or you.

4.3 Organization and Business Account Administrators

If you join an organization on Motif, we may disclose account-related information such as your email address, account status, role, and usage summary to that organization’s administrators. A work email does not enroll you in an employer organization by itself; you join by invite or by creating the organization. Organization administrators may access and manage members’ use of the Service as permitted by the organization’s plan and the Terms of Service.

4.4 Legal Requirements

We may disclose information:

• To comply with legal process
• To respond to government requests
• To protect our rights or safety
• To prevent fraud, security incidents, or other unlawful activity
• To enforce our Terms of Service or other legal rights
• In connection with corporate transactions

4.5 With Your Consent

We may share information for other purposes with your explicit consent.

4.6 Controller and Processor Roles

Every account is an organization. For personal data Motif processes to provide the Service, the organization is the controller and Motif is the processor under the Data Processing Agreement.

Motif is an independent controller for securing the Service, detecting fraud and abuse, keeping records a legal obligation requires, and training Motif’s own models while that setting is on (Section 3.7). This Privacy Policy describes both roles. Where Motif is the processor, the Data Processing Agreement controls if it conflicts with this Policy.

5. Data Retention

5.1 What Happens When You Delete Your Account

Deleting your account removes your identity from the Service. It does not erase the scientific record your organization built, and it does not delete the documents in your library. Read this section before deleting, because the action takes effect immediately and cannot be reversed.

Deleted immediately when you confirm:

• Your user account, login credentials, and any connected Google sign-in
• Every active session, on every device
• Your profile, preferences, and organization membership
• Your session replay recordings and related metadata (R2 objects and database rows)

Kept, with your account id replaced by a system identifier: conversation rows, message text, pipeline-run rows, upload rows, and the files those rows point at. Message text is not rewritten. The user id on pipeline-run rows and the account id on upload rows become that system identifier. Entity and observation rows stay in the Workspace Graph on the same basis, and the account id is removed from each entity’s contributing-user list. Motif Graph Content extracted from public literature may remain in Motif products and Motif Dataset under Terms of Service Section 4.1.

Retained as a legal or security record: audit and security logs recording access to the Service. Billing rows stay on the organization and are removed if that organization is deleted. Stripe keeps payment and invoice records under Stripe’s retention.

If you want an unextracted document removed from object storage, remove it from your library before deleting your account. Extracted articles are archived rather than deleted when you remove them; their files stay in object storage (Section 5.3). There is no export window after account deletion: your access ends the moment the deletion completes, so export anything you want to keep beforehand.

Research sessions already included in a model training run cannot be withdrawn from models that have already been trained. See Section 3.7.

If you want your name removed from your contributions without losing access, use Anonymize My Contributions in dashboard settings instead. This is described in Section 4.2.

5.2 Retention After Subscription Cancellation

Cancelling a subscription is not the same as deleting your account. For 90 days after cancellation you retain read and export access to the data you paid to produce. Nothing is deleted when that window closes; your access to create new work ends, and your account and its data remain until you delete the account.

We may retain data longer where required by law.

5.3 Removing articles from your Article Library

Removing an article from the Article Library is not always deletion. What happens depends on whether extraction has completed for that article in your organization.

Not extracted. Motif permanently deletes the article from your library. The PDF and any supplementary files are removed from object storage if no other organization still has a live copy of the same article. This cannot be undone.

Extracted. Motif archives the article. The PDF and supplementary files stay in object storage. Associations stay in the Workspace Graph, so citations and provenance remain. You can restore the article from the Archive filter. There is no Article Library action that deletes an extracted article’s files from object storage.

Account deletion does not run this removal. Documents still in the library, including archived extracted articles, remain with your organization as described in Section 5.1. The upload row’s account id is replaced with a system identifier.

6. Your Privacy Rights

6.1 Access and Portability

You have the right to:

• Access your personal data
• Export your data in standard formats
• Receive a copy of your information

6.2 Correction and Deletion

You may:

• Update inaccurate information
• Request deletion of your personal data
• Withdraw consent for processing

Deletion covers the categories Section 5.1 lists as deleted. Message text, pipeline-run rows, upload rows, and the files they point at stay, with the account id replaced by a system identifier as Section 5.1 describes. Section 5.3 sets out what happens when you remove an article from the Article Library, which is not the same as account deletion.

Withdrawal of consent is as easy as giving it: manage cookie preferences via the consent panel, or turn off model training via your dashboard settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

6.3 Opt-Out Rights

You can opt out of:

• Marketing communications
• AI model training (via Help improve our AI models in dashboard settings; see Section 3.7)
• Non-essential cookies

6.4 GDPR Rights (EEA Users)

If you are in the European Economic Area:

• Right to erasure (“right to be forgotten”), exercised through account deletion in dashboard settings. Erasure applies to the categories Section 5.1 lists as deleted. Message text, pipeline-run rows, upload rows, and library files stay under a system identifier, as Section 5.1 describes
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right regarding automated decision-making: We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you (Article 22)
• Right to lodge a complaint with your local data protection authority

6.5 CCPA/CPRA Rights (California Residents)

California residents have the right to:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of personal information
• Access their personal information
• Equal service and price, regardless of privacy choices

Motif does not sell your personal information as defined under the CCPA/CPRA. Motif does not “share” personal information for cross-contextual behavioral advertising, and does not process personal information for “targeted advertising,” as those terms are defined under applicable US state privacy laws, except where you have affirmatively consented to marketing cookies described in Section 8. Our tiered subscription model reflects different feature sets, not compensation for personal data.

To exercise your CCPA rights, contact hello@motif.bio.

6.6 Response Timeline

We will respond to privacy requests within one month of receipt (GDPR) or 45 days (CCPA). If an extension is necessary, we will inform you within the initial period. We may request information to verify your identity before processing your request. Motif will not discriminate against you for exercising privacy rights available under applicable law.

If we deny your request, you may appeal by emailing hello@motif.bio with the subject line “Privacy Appeal,” a description of the request, and why you believe the denial was in error. We will review the appeal in good faith and respond within the timelines required by applicable law.

7. Data Security

7.1 Technical Measures

Technical measures are in the Security Whitepaper.

7.2 Organizational Measures

We maintain security through:

• Incident response procedures aligned with the Security Whitepaper
• Vendor security posture reviewed when onboarding or changing subprocessors
• Policy and Trust Center updates when controls or subprocessors change

7.3 Breach Notification

In case of a personal data breach:

• We will notify the competent supervisory authority within 72 hours where the breach is likely to result in a risk to your rights, in accordance with GDPR Article 33
• Where the breach is likely to result in a high risk to your rights, we will notify you without undue delay, in accordance with GDPR Article 34
• For California residents, we will provide notification as required by Cal. Civ. Code Section 1798.82
• We will document all breaches and our response measures

8. Cookies and Tracking

Motif chat and Motif dashboard share one cookie preference. Choosing Essential Only, Accept All, or Manage on either app applies to both.

8.1 Essential Cookies

Always active. Required for Service operation:

• Authentication cookies: Session management and login state (Duration: session)
• Security cookies: CSRF protection and security tokens (Duration: session)
• Consent preference: Shared parent-domain cookie motif-cookie-consent storing your Essential Only / Accept All / per-purpose choices (Duration: up to 1 year). A local mirror may also be kept in localStorage (motif_cookie_consent, motif_cookie_preferences) for migration and reliability
• Theme preference: Shared theme cookie used to keep light/dark mode consistent across Motif apps

8.2 Analytics Cookies (opt-in)

Enabled only after you consent to analytics (Accept All, Manage → Analytics, or the Analytics switch in dashboard Cookie Preferences). Applied on the Motif chat product surface:

• Google Analytics: Cookie names: _ga, _gid (Duration: up to 2 years; Provider: Google LLC, USA)

8.3 Marketing Cookies (opt-in)

Enabled only after you consent to marketing. Applied on the Motif chat product surface:

• Meta/Facebook Pixel: Advertising effectiveness measurement (Provider: Meta Platforms Inc., USA)

8.4 Session Replay (opt-in)

Enabled only after you consent to session replay. Applied on Motif chat and dashboard:

• Motif records a privacy-masked reconstruction of your product UI session (see Section 2.2). Stored in Motif-controlled Cloudflare R2 and Neon; retained up to 30 days; accessible only to Motif administrators; deleted on account erasure (see Section 5)

8.5 Managing Cookies

• Consent modal: Essential Only, Accept All, or Manage (per-purpose toggles for analytics, marketing, and session replay)
• Update preferences anytime via Cookie Preferences in dashboard settings; the same choices apply to chat and dashboard
• Non-essential tags and session replay do not start until you affirmatively opt in to that purpose
• The Service functions with Essential Only
• Withdrawing a purpose stops new processing for that purpose. Existing session replay objects may remain until the 30-day retention window ends or until account deletion / erasure removes them

Our marketing website (motif.bio) uses additional cookie categories including Yandex.Metrika, Google Tag Manager, and HubSpot, which are governed by the separate cookie consent banner presented on that site.

9. International Data Transfers

9.1 Data Location

Your data may be processed in:

• United States (stored data: database, object storage, cache, application hosting)
• European Union (AI pipeline compute on Netcup)
• Other jurisdictions where OpenRouter may route inference, subject to the transfer safeguards in Section 9.2

EU stored-data residency is not offered yet. See the Trust Center.

9.2 Transfer Safeguards

For international transfers, we use:

• Standard Contractual Clauses
• Data Processing Agreements
• Appropriate security measures

10. Children’s Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will post the updated policy on our website and update the “Effective Date” at the top. Continued use after the effective date constitutes acceptance of the updated policy.

12. Contact Us

Motif Bio, Inc., a Delaware corporation, is the processor for personal data it handles to provide the Service, and the controller for the purposes in Section 4.6. The organization is the controller for the service.

For privacy-related questions or requests:

13. Data Protection Officer

For GDPR-related matters, you may contact our Data Protection Officer at hello@motif.bio.