Motif

The Privacy Notice defines 'Customer Content' as data uploaded by or on behalf of Customers and states Motif processes it solely on behalf of the Customer, implying the Customer retains control. However, the supplied text does not contain an explicit ownership/IP grant clause (that would live in the Terms of Use or MSSA, which were not supplied), so ownership cannot be conclusively confirmed.

The product is AI-native and generates models, drawings, and geometry, but the supplied Privacy Notice does not address ownership of AI-generated output. Such terms would appear in the Terms of Use or AI Policy, neither of which was supplied, so this is a silence-based finding.

The Privacy Notice permits Motif to aggregate/de-identify data to 'improve and add features to the Services' and to 'develop new features,' but the supplied text does not clearly state whether Customer Content or prompts are used to train AI models. A dedicated 'AI Policy' is referenced on the legal page but its contents were not supplied, so any explicit no-training commitment cannot be confirmed. The sub-processor list shows prompts flow to Google Vertex, OpenAI, and Runway as model providers.

The Privacy Notice includes a 'Data Retention' section in its table of contents, but the supplied text was truncated before that section's substance was reached, so no retention period, deletion mechanism, or deletion SLA could be read. No security-related retention obligations (e.g., SOC 2 audit-log retention) appear in the accessible text. This silence is a risk signal.

Motif discloses sharing with service providers, third-party integrations, and advertising partners (Google, Bing, LinkedIn, Meta) for targeted advertising, and states it does not share information with third-party product/offer providers unless the user directs it. The 'Sharing Personal Data' section was truncated in the supplied text, limiting a full assessment, but the accessible material shows disclosed, purpose-linked sharing consistent with an SaaS model rather than undisclosed data selling.

The Privacy Notice references a 'Your Choices' section and separate California/Nevada rights sections, and discloses cookie/advertising practices, indicating some opt-out pathways exist. However, the substantive 'Your Choices' and rights sections were beyond the truncation point in the supplied text, so the specific opt-out mechanisms and their scope could not be read and confirmed.

The accessible Motif documents mention only that third-party payment processors are 'PCI-compliant'; they do not claim or evidence any Motif-held certification such as SOC 2, ISO 27001, ISO 27018, GDPR, or CCPA attestation. The Privacy Notice acknowledges California, Nevada, and European residents' rights but names no audit or certification. For an enterprise SaaS handling proprietary design data, the absence of any named vendor certification with evidence is a significant gap. (Note: the unrelated Cloudflare document's DPF/certification claims are NOT Motif's and were disregarded.)

The supplied Privacy Notice does not address model explainability, transparency, or enterprise auditing of AI behavior. Marketing copy suggests change-tracking and queryability, but that is not policy language. This topic is effectively silent in the accessible legal documents.

The Privacy Notice lists a 'Data Security and Protection' section in its table of contents, but the supplied text was truncated before that section could be read, so no specific controls (encryption, access controls, pen testing, incident response) or breach history could be confirmed. A Service Level Agreement and Support Terms are referenced on the legal page but were not supplied. No trust center or dedicated security page is referenced in the accessible text.

The Privacy Notice distinguishes Visitors, Customers, and Authorized Users and notes more limited data is processed about Visitors than Customers, but it does not describe differing data-handling protections between free and paid tiers. Any material delta would live in the MSSA/DPA, which were not supplied.

The Privacy Notice states data is disclosed to Motif employees, contractors, and agents authorized to process it to provide the Services and committed to confidentiality, implying staff may access data, but it does not explicitly describe human review of prompts or outputs. The enterprise sub-processor list shows a support/call-recording vendor (Grain) processing customer-provided audio/video content, indicating some human-adjacent processing exists.

The Privacy Notice states Motif will respond to regulatory bodies and valid court orders and process data to comply with legal obligations, which is standard. It notes that for Authorized Users, Motif acts as processor and will forward data-rights requests to the Customer. No litigation, government-request statistics, or transparency report is disclosed in the accessible text.

Motif collects significant PII: name, location, email, phone, business address, billing information, employer/occupation, login credentials, IP address, device identifiers, usage/analytics data, and approximate (city/state) location. It expressly states it does not require sensitive data (race, religion, sexual orientation, health, biometrics, etc.), which is a positive control, though Customer Content is open-ended and could contain such data uploaded by users. Disclosure of PII categories is reasonably clear.

The Motif Privacy Notice is dated 'Last Updated: October 7th, 2025' — well within 12 months of the analysis date — and the enterprise sub-processor list is dated 'April 2nd, 2026'. The product is emphatically AI-first, and the sub-processor list explicitly names AI model providers (Google Vertex, OpenAI, Runway), showing awareness of AI data flows. However, the supplied Privacy Notice text is truncated and does not itself substantively address AI model training or third-party model providers within the accessible portion, so full coverage of the shipped AI capabilities cannot be confirmed. Capped at YELLOW due to incomplete coverage evidence.

Three documents were supplied, but one (the Cloudflare Privacy Policy) is an unrelated third party's policy that appears to have been mis-scraped and is not a Motif governing document — it cannot be validly compared against Motif's terms. The Motif legal index page and the Motif Privacy Notice are consistent with each other, but the Notice was truncated and the substantive Terms/DPA/AI Policy were not supplied, so a full cross-document consistency check across Motif's own legal suite is not possible. No genuine contradiction between Motif documents was found in the accessible text.