Privacy Policy
This Privacy Policy explains how OnMotion ("the Service", "we", "us", "our"), a product operated by T.M.E The Marketing Experts Ltd ("TME"), registered in Cyprus (reg. no. HE 457797), registered office at 15 Kallipoleos, Amaral 30, 4th Floor, Office 402, 1055 Nicosia, Cyprus, collects, uses, shares and protects personal data. It applies to our website, our customer dashboard, and the WhatsApp AI assistant we provide to real-estate agencies and developers.
OnMotion provides an AI assistant that replies to prospective buyers and renters on WhatsApp on behalf of a real-estate agency or developer ("the Agency"), answers their questions, and helps book property viewings, syncing to the Agency's dashboard and calendar. Communication via WhatsApp Business Cloud API is central to how the Service works.
1. Who is responsible for your data (controller vs. processor)
Our role depends on whose data it is:
- People who message an Agency ("Leads"/end-users): the Agency is the data controller and decides why the data is used; OnMotion acts as a processor handling the data on the Agency's instructions. If you contacted an Agency and want to exercise your rights, you may contact that Agency or contact us and we will route your request.
- Agency owners, agents and staff who use our dashboard ("Account Users"): TME is the controller for that account and login data.
Meta Platforms (which operates the WhatsApp Business Cloud API) acts as a processor for the messages it carries on our behalf.
2. What data we collect
From Leads (people messaging an Agency on WhatsApp)
- Your WhatsApp phone number and WhatsApp profile name;
- The content of your messages - text, voice notes (which we transcribe to text) and images you send;
- Property preferences you share - for example budget, areas, property type, number of bedrooms, and whether you want to buy or rent;
- Viewing appointments you request or confirm;
- Conversation history and technical metadata such as message timestamps.
From Account Users (Agency staff)
- Name, business email, phone number and role;
- Login credentials and two-factor authentication data;
- Settings and content you enter (agency profile, listings, templates, notes).
From visitors to our website (onmotion.ai)
- If you ask for a demo: your name, phone number and email address, and if you give them, your agency name and anything you write in the "Anything we should know?" box, plus the page you sent the request from. The form saves your details step by step: what you have entered so far is sent to us each time you press Continue, starting with the first step, so we can reach you even if you do not finish the form;
- If you try the demo chat: its answers are prepared examples that run in your browser. A message you type or a voice note you record there is not sent to us or to any AI provider. The page asks for your microphone only when you press the microphone button, and a recording stays in the page only so you can play it back. A message you type is copied into the demo form's "Anything we should know?" box (if that box is still empty), and reaches us only if you send the form;
- To stop abuse of the demo form, a scrambled key made from your network address (not the address itself), with counts of your requests. These keys are replaced as new requests arrive.
- Like any website, our hosting providers keep standard request logs, which include your network address and browser type, for a limited period.
3. Why we use it and our legal basis (GDPR)
| Purpose | Legal basis |
|---|---|
| Reply to Leads, answer questions, qualify interest and book viewings | The Agency's legitimate interest in responding to inquiries, and taking steps at the Lead's request; consent obtained through WhatsApp opt-in where required |
| Provide the dashboard, CRM and calendar to the Agency | Performance of our contract with the Agency |
| Send reminders and follow-up messages | Legitimate interest / consent, with an opt-out (reply STOP) always available |
| Answer demo requests from our website | Steps you ask us to take before any contract, and our legitimate interest in preventing abuse |
| Billing, security, fraud prevention and keeping records | Legitimate interest and legal obligation |
| Maintaining and improving the Service | Legitimate interest - we do not use tenant conversation data to train AI models |
4. Who we share data with (our sub-processors)
We use a small number of trusted providers to run the Service. Each is bound by a data-processing agreement and may only use the data to provide their service to us:
| Provider | What it does | Location |
|---|---|---|
| Meta Platforms | WhatsApp Business Cloud API - carries the messages | EU / global |
| Supabase | Database, authentication and file storage | EU (Frankfurt, Germany) |
| Netlify | Hosting for the dashboard and website, and receiving WhatsApp messages from Meta | Global CDN |
| Railway | Hosting for the server that runs the assistant | EU |
| Anthropic | The AI models that write the assistant's replies, summarise conversations, score leads, translate, and power the staff co-pilot | United States |
| OpenAI | Turns voice notes into text, and powers AI helpers in the dashboard (summaries, search, translation, scoring setup and imports) | United States |
| MailerSend | Transactional email (sign-in codes, invitations, alerts), including whether an email was opened | EU / United States |
| Bright Data | Fetches public web pages when an Agency imports listings from a web address | Global |
Our public website serves its fonts from its own address, so opening a page does not connect your browser to Google or to any other font service.
Our AI providers handle data under their business terms, which do not allow them to use it to train their models.
We do not sell your personal data, and we do not share it with third parties for their own advertising.
5. International transfers
Our primary storage is in the EU. Some of our service providers process data outside the EEA, including our AI providers in the United States. Where personal data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses and equivalent safeguards in our agreements with those providers.
6. How long we keep it
Meta deletes message content from the WhatsApp Cloud API infrastructure within 30 days of processing. In our own systems, we keep Lead and conversation data for as long as the Agency's account is active and needs it for its business, and then delete or anonymise it. Account User data is kept for the life of the account and a reasonable period afterwards for legal and accounting purposes. Demo requests from our website are kept for as long as we need them to follow up with you and for any business relationship that follows. You can ask for earlier deletion - see below.
7. Your rights
Subject to the roles described in Section 1, you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. Leads can opt out of messaging at any time by replying STOP.
To exercise any right, or to request deletion, see our Data Deletion page or email info@onmotion.ai. We respond within 30 days. You also have the right to lodge a complaint with the Cyprus supervisory authority, the Office of the Commissioner for Personal Data Protection (or your local authority in the EEA).
8. How we protect your data
- Data is stored in the EU and encrypted in transit (WhatsApp uses the Signal end-to-end encryption protocol; our systems use TLS);
- Each Agency's data is isolated from every other Agency's (tenant isolation / row-level security);
- Access is restricted, logged in an audit trail, and protected by two-factor authentication for staff;
- We do not train AI models on tenant data.
9. Cookies, local storage and email
The dashboard uses only essential cookies: to keep you signed in securely, to remember that you passed two-factor authentication where it is on, and to carry you through sign-in, invitation and password-reset steps. Our public website sets no cookies and runs no analytics. It saves your light or dark theme choice, your language choice, and how many times you restarted the demo, in your browser's own storage, which stays on your device.
Emails we send, such as sign-in codes, invitations and alerts, contain a small invisible image that tells us whether the email was opened. Links in our emails are not rewritten or tracked.
10. Children
The Service is intended for businesses and is not directed to children. We do not knowingly collect data from anyone under 18.
11. Changes to this policy
We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, take reasonable steps to notify affected Agencies.
12. Contact us
T.M.E The Marketing Experts Ltd - OnMotion
15 Kallipoleos, Amaral 30, 4th Floor, Office 402, 1055 Nicosia, Cyprus
Privacy requests and general enquiries: info@onmotion.ai