Privacy Policy

Account & profile: name, email address, phone number, role, the company / store / region you are linked to, your profile photograph, and — where you give us one — your address and the approximate map coordinates we look up from it.

If you are a contractor: your business name, your business address and its coordinates, the trades you work in, how far you will travel, your VAT number if you have one, and the documents you upload to be verified (company registration, VAT certificate, public liability insurance, trade qualification or licence). We store those as files — we do not extract certificate numbers or expiry dates from them. When you accept our Service Level Agreement we record the name you type as your signature, the version you accepted, and the IP address the acceptance came from.

Identity and payment details (contractors setting up payouts): your South African identity or passport number and your bank account details are collected on that one screen and passed straight to our escrow provider. We do not store them. We keep only the reference our provider hands back, which is what pays you from then on.

Operational content: maintenance tickets, descriptions, quotes and amounts, completion certificates (COCs), photos and documents you upload, ratings, and audit-trail actions.

What you type when you log a job: where the form does not ask you how urgent the job is, the title and description you typed are sent to our AI operator Groq so that an urgency can be worked out from them. This happens as part of logging the job — it is not an optional extra you switch on. Section 3 explains what is done with the words and section 5 says where they go. Only the title and description are sent, so please keep other people's names and contact numbers out of them unless they are needed to get the problem fixed.

Messaging intake (optional): if you log a ticket via WhatsApp, the message text and any voice note you send, which are transcribed to create the ticket.

Messages and job activity: the messages and files you send in a job's chat thread or in a dispute thread. Where a contractor's technician shares their position while on their way to you, their live location, until the visit is done. Where you are shown a 6-digit code to read out to the contractor when they arrive, that code is held against the job until it is used or expires.

Technical: device push-notification tokens; cookies that keep you signed in and remember which store or region you are viewing; and technical log data. We record your IP addresswhen a contractor accepts our Service Level Agreement, and keep it as proof of who accepted it and when. IP addresses are also used transiently to limit abusive traffic, and the anti-bot check on our sign-in, sign-up and contractor-registration pages is run by Cloudflare, which sees your IP address when that check loads. We also record which jobs and messages you have opened and when, so that unread markers and audit trails work.

We process your information to operate the ticketing and quoting workflow, route notifications to the right people, produce dashboards and reports, and keep the Service secure. Our lawful bases are: the performance of our contract with you or your organisation; our legitimate interest in running and securing the Service and keeping accurate operational records; your consent where we ask for it and record it — the tick you give when you create an account; and compliance with legal obligations.

Using the WhatsApp intake is your choice: it exists alongside the web form and nothing requires you to use it. We treat sending us a WhatsApp message as your instruction to create a job from it, and we process that message to perform our contract with you rather than on the strength of a separate recorded consent.

The automatic urgency read described in section 3 runs every time a job is logged without an urgency being chosen, so it is not based on your consent — you are not asked to agree to it and you cannot decline it. We rely instead on performance of the contract and on our legitimate interest in getting a dangerous job in front of someone quickly. You may object to it on reasonable grounds, and ask for the result to be corrected, under section 8.

The Service computes health / SLA / priority scores automatically from ticket data to help prioritise work, and rank contractors by distance from the job.

Working out how urgent a job is. Where the form does not ask you to choose, an automated system reads the job's title and description and places the job in an internal urgency band, which is what sets its priority and its response-time targets. Two things do that reading: an AI language model operated by Groq (sections 4 and 5), and — when Groq is unavailable or its answer is unsure — a fixed list of word rules that runs on our own servers. It is given nothing but the title and description, and it produces nothing but that urgency band. It does not build a profile of you, score you as a person, or decide anything about you.

It is not the last word. An unsure reading is allowed to raise a job up the scale but never to move it down, and only a clearly confident reading may move a job down at all. An explicit danger word in what you typed — a gas smell, a spark, exposed wiring — locks the job at the highest band whatever the AI returns. There is no separate human review step before the job reaches contractors. You can see the urgency band on the job page; on a job you logged yourself you cannot change it in the app and nor can the contractor, so if you think it is wrong, ask us to correct it under section 8. On a job logged through a business, a manager can change it while the job is still open.

Some steps run on a clock, without a person. On a home owner's job paid through escrow: when the contractor submits completed work — and again at the final close-out step — you have 48 hours to act, and if you do nothing the job is signed off automatically and the money held in escrow is released to the contractor. We remind you before that happens. If you do not decide a variation order within 48 hours it is treated as declined, the contractor is paid the call-out fee stated in the quote you accepted, the balance is refunded to you and the job reopens. If a contractor reports they could not get access and then does not offer you a new time within 24 hours, the job is cancelled automatically and everything held in escrow is refunded to you. These steps only enforce deadlines set out in our Terms of Service. They build no profile of you and assess nothing about you as a person. Every other decision on a job — approving a quote, awarding it, deciding a variation, resolving a dispute — is made by a person. If one of these automatic steps has affected you, you may ask us to have it reviewed by a person under section 8.

Other people the job requires. On a business account: the managers at your organisation who handle the job, the contractors invited to quote on it, and the technician the awarded contractor sends. On a home owner's job you have no organisation — the people who see your job are the verified contractors we invite to quote and, once you award it, that contractor and the technician they send. Motiv's own platform administrators can also access job records, job chats and your contact details where support, safety, payment or a dispute requires it.

Our operators (processors), who process data on our behalf: Supabase(database, authentication, file storage), Vercel (hosting), Upstash(rate-limiting), Sentry (error monitoring), Resend (email), Groq (AI — it reads the urgency of a job from its title and description, as described in section 3; transcribes and interprets WhatsApp intake; reads quote documents a contractor uploads, including scans and photographs, to fill in the quote form; and writes the wording of the daily dashboard summary and of management reports from operational figures, together with the store and client names those reports name), Backblaze (off-site backup copies of uploaded files — photos, certificates of compliance, invoices and contractor documents), Meta / WhatsApp (messaging), Mapbox (address suggestions while you type, and the driving route when a contractor is on their way to you) and Cloudflare (the anti-bot check on our sign-in, sign-up and contractor-registration pages, where that check is switched on — it receives your IP address). We do not sell your personal information.

Payments on home owner jobs. Where a job is paid through escrow, TradeSafe— an independent South African escrow provider, not an operator acting on our behalf — receives from us the home owner's name, email address and phone number, the contractor's name, business name, email address and phone number, and the job reference, title, trade category and amount. The home owner then pays on TradeSafe's own hosted checkout page, so their card or bank details are given to TradeSafe and never reach Motiv. Separately, a contractor setting up payouts enters their identity or passport number, company registration number and bank account details into a form in Motiv; we pass those straight to TradeSafe in the same request and store none of them, keeping only the reference TradeSafe issues back. TradeSafe processes this information for its own purposes as a regulated escrow provider, under its own terms and its South African financial-services and FICA obligations.

Other recipients, who are not our operators. A few services receive information without acting for us:

• OpenStreetMap (Nominatim) — when an address is saved, our servers send the address text to OpenStreetMap's free lookup service to find its position on the map. The request comes from our servers, so your IP address is not sent.
• OpenStreetMap map images — while you watch a contractor on the live tracking screen, the map images are loaded by your own browser directly from OpenStreetMap, which therefore sees your IP address and the area being shown — the area around your home and the contractor.
• The push service your browser uses (Google, Mozilla or Apple) — it delivers our notifications to your device. The content is encrypted between us and your browser, so the push service can see that a message was sent but cannot read it.

Your address and contact details on a home owner's job: every verified contractor we invite to quote can see the job address, because they need it to price travel and access — including contractors who do not win the work. Your name and phone number are released only once you award the job: to the contractor who wins it, who also sees your email address, and to the technician they send to attend, so that they can reach you and get there. They receive the scheduled date and time with it.

Adding a visit to your own calendar: both you and the contractor can send an individual appointment to Google Calendar or Outlook from inside Motiv. That happens only when the button is pressed, one appointment at a time. It carries the suburb, the job reference, the job title and the name of the other party to the job — the contractor's business name on your copy, your name on the contractor's copy — but never the full street address and never a phone number. Once added, the entry lives in that calendar provider's account under their terms, not ours. Motiv does not connect to, read or write to your calendar automatically.

Some of our operators (e.g. Supabase, Vercel, Sentry, Groq) may store or process data on servers outside South Africa. Where that happens we rely on POPIA s.72, on the basis that the recipient is subject to laws or binding terms providing an adequate level of protection.

Concretely: application hosting, the database, authentication and file storage all sit within the European Union — today in Frankfurt, Germany (Vercel region fra1, with Supabase in the same region), chosen so the data stays in one jurisdiction and queries do not cross an ocean. Off-site backup copies of uploaded files are held by Backblaze, also within the European Union. We commit to the jurisdiction rather than to a particular city: a provider may move between data centres, and what protects you under POPIA s.72 is the legal regime the data sits in, not the street it is on. Error monitoring (Sentry), rate limiting (Upstash), email (Resend), address suggestions and driving directions (Mapbox), the address lookup and the map images on the live tracking screen (OpenStreetMap), the anti-bot check on our sign-in and sign-up pages (Cloudflare), the push service that delivers notifications to your device, and WhatsApp messaging (Meta) may process data outside South Africa under their own terms.

AI processing leaves the country. Groq is a United States provider, and we use it in four places. The urgency read: only the job title and description you typed are sent — not your name, not your phone number, not your photos, and not any other part of your account. The WhatsApp intake: the voice note itself — the recording, not a transcript — is sent to be transcribed, together with your message text; photos you attach are not sent to it. We do not keep the recording. Quote auto-fill: when a contractor uploads a quote document so the figures fill themselves in, the text of that document is sent, and where the quote is a scan or a photograph the image itself is sent — so whatever appears on that document goes with it. Management reports and morning summaries: the figures behind them are sent so the wording can be written, including store, branch and client names, the name of the person the report is for, health scores and Rand totals — but no email addresses, phone numbers or identity numbers. Whatever you put in a free-text box goes with it — which, for a maintenance job, often includes the address.

Encryption in transit (HTTPS/TLS); database Row-Level Security isolating each organisation’s data; role-based access controls; rate limiting; and error monitoring. Everything uploaded for a job — photographs, certificates of compliance, invoices, quotes, contractor documents and project files — is stored privately and served only through short-lived signed links that expire. Profile pictures are the one exception: they sit in a public location, so anyone holding the link can view the image without signing in, which is why deleting your account deletes the image file itself rather than only the link to it. No system is perfectly secure, but we take reasonable technical and organisational measures as required by POPIA.

If something goes wrong. If personal information in our care is accessed or acquired by someone who should not have it, we will notify the Information Regulator and the people affected — unless we cannot establish who they are, or a law-enforcement body or the Regulator tells us that notifying would impede an investigation. We will do so as soon as reasonably possible after discovering the compromise, allowing for the time needed to establish its scope and secure the system. We will tell you in writing, normally by email to the address on your account, what happened, what information was involved, and what you can do to protect yourself.

We keep operational records (tickets, quotes, completions, sign-offs and the audit trail) for as long as needed for business, warranty and legal purposes — a completed job is evidence of what was done, by whom, for how much.

What the system deletes automatically today, on a timer:

• Archived notifications — after 3 days.
• A technician's live location — 7 days after it was last recorded. That position exists only to show you a moving dot while someone is on their way to you, so it is not kept once the job is over.
• An unfinished WhatsApp ticket draft — after 7 days. A draft that never became a ticket is not a record of anything, so we do not keep the phone number and description attached to it. Photographs sent during that conversation are not removed by this timer: those image files stay in our file storage until you ask us to delete them under section 8.
• The working copy of a WhatsApp conversation that did become a ticket — stripped of your number and its text after 30 days. The ticket itself is the record and is retained.

When you delete your account from Settings we erase, from your user profile, your name, email address, phone number, home address and its saved location (including map coordinates), and your profile photograph. We delete the image file itself, not merely the link to it; if our file storage cannot be reached at that moment the rest of the erasure still completes and the failure raises an alert to us, and until the image is removed it may remain reachable at its existing web address — ask us under section 8 if you want confirmation that it is gone. We then replace your sign-in address so the account cannot be used again, ban it, sign you out of every device and remove your push-notification devices. We keep one reference number issued by our escrow provider, which is not readable personal information and exists only so a historical payment can be reconciled.

What that action does not reach. Some details sit outside your user profile and are not removed by it. If you are a registered contractor, your business record — contact name, email address, phone number, business address and its coordinates, VAT number, and the verification documents you uploaded — remains, so that completed jobs stay attributable. If you accepted our contractor agreement, the name you typed as your signature and the IP address recorded at that moment are kept as proof of it. If you are a field technician on a contractor's team, your name and phone number stay on that team's roster. Our audit trail records the email address an invitation was sent to. And any name typed into a job description, message, dispute or review stays inside that text. To have those removed as well, make a deletion request under section 8 and we will assess each against the records we are required to keep.

Deleting your account is irreversible and it does not hand you a copy of anything. If you want a record of your information, ask for it under section 8 before you delete the account — once the sign-in address is scrubbed we can no longer tie the remaining history back to you.

Backups, and why deletion is not instant everywhere. We keep off-site backup copies of uploaded files (photos, certificates, invoices, supplier documents) so that they survive a failure or an accidental deletion. Those copies are deliberately write-protected: once written they cannot be altered or removed until their retention period lapses, which is what makes them useful against ransomware and mistakes alike. The consequence is worth stating plainly — when a file is deleted in Motiv it stops being reachable through the app immediately, but a copy may remain in that protected backup until its retention period expires. Those copies are not used to serve the app, are not searchable, and are read only to restore data after a loss. A backup copy cannot be altered or removed by anyone, ourselves included, for the period set on that storage; after that it is removed only when we remove it, since backup copies are not deleted on a timer.

The database is backed up too. Separately from the file backups above, our database provider takes an automatic backup of the database every night and keeps those copies for seven days before they expire. Everything held in the database — your name, email address, phone number, home address and its coordinates, and messages sent in a job's chat — is in them. When you delete a record, or your account, it is erased from the live database immediately, but the pre-deletion values may still exist in a nightly database backup for up to seven days until that copy expires.

How long we keep operational records. Job records — tickets, quotes, variation orders, photographs, certificates and invoices — are retained for five (5) years after the job is completed or cancelled. Five years matches the period South African tax and company law expects records of a transaction to be produceable, and a maintenance job is exactly the kind of thing a later insurance claim or workmanship dispute turns on. These records are not deleted automatically on a timer: removal happens on request under section 8, or when the retention period is reviewed.

How long backups keep a copy. Backups of uploaded files are governed by the retention set on the protected storage described above, and database backups by the seven-day retention just described — neither by the five-year figure. Deletion from the live system is immediate; deletion from a write-protected backup is not, and cannot be, until that copy expires. We state this plainly rather than imply otherwise: it is the price of being able to recover from ransomware or an accidental deletion, and you are entitled to know it applies to a deletion request under section 8.

We do not send marketing. Email from Motiv is transactional only — account invites, password setup, and notifications about your own jobs. If that ever changes we will ask for your consent first, as POPIA s.69 requires, and every such message will let you opt out.

We use only two kinds of cookie: the session cookies that keep you signed in, and — if you manage more than one store or region — a cookie that remembers which one you are currently viewing, kept for one year. We do not use advertising or third-party tracking cookies, and we do not build advertising or behavioural profiles of individuals. We may measure aggregate page speed and page-view totals through our hosting operator: that measurement runs on our own domain, sets no cookies, reports totals rather than anything about you as a person, and is never shared with advertisers.

Separately, your browser keeps a few things on your own device that are never sent to us: your appearance preferences (light or dark theme, page width); which sections you last left expanded; an unfinished job draft, held only until you close that tab; and, if you tick “Remember me” when signing in, your email address so it can be filled in next time. You can remove all of these by clearing your browser's site data.

The Service is intended for adults. You must be 18 or older to open an account, whether it is provided to you by an organisation or you open it yourself as a home owner or a contractor. We do not knowingly collect personal information from children; if you believe a child has given us information, contact our Information Officer (section 13) and we will delete it from the live system, subject to the backup limits in section 7.

We may update this policy. The “last updated” date at the top of this page always shows the version in force, and is how you can tell whether anything has changed — please check it from time to time. Where an update materially affects how we use your personal information, we will also email the address on your account.

The Information Officer for MOTIV GROUP (PTY) LTD is Jacques Dippenaar.

Data requests under section 8, and any other privacy query: info@motivgroup.co.za. Physical address: Plot 25 Mountain Drive, Derdepoort Park, Gauteng, 0035.

Our Information Officer is registered with the Information Regulator, as POPIA requires.