1. Purpose
This policy describes how long Motta Hub ("the Platform"), operated by Motta Financial, LLC, retains personal and business data, with particular attention to data obtained from integrated services such as Zoom. It is intended to satisfy the data-handling and deletion requirements of those services' marketplace policies and applicable privacy law.
2. Retention Periods at a Glance
| Data category | Retention | Trigger to delete |
|---|---|---|
| Zoom OAuth access & refresh tokens | Until disconnection | User disconnect or app_deauthorized event |
| Zoom user profile cache | Until disconnection | Disconnection or deletion request |
| Zoom meeting metadata | Operational lifetime | Deletion request, or when no longer needed |
| Zoom recording metadata | Operational lifetime | Deletion request, or when no longer needed |
| Zoom recording media (video and audio) | Operational lifetime | Deletion request, or when no longer needed |
| Zoom transcripts (file and text) | Operational lifetime | Deletion request, or when no longer needed |
| Zoom phone call history | Operational lifetime | Deletion request, or when no longer needed |
| Zoom webhook event payloads (raw) | 30 days | Automatic daily purge |
| Application logs | 30 days (Vercel default) | Automatic rotation |
| Internal Hub records (work items, debriefs, etc.) | As long as the team member account is active | Account deletion or explicit request |
3. Zoom Data — Detailed
3.1 OAuth Tokens
Access tokens and refresh tokens are stored in the zoom_connectionstable in our Supabase Postgres database. Tokens are retained for as long as the connection is active. When a user disconnects (from within the Platform or from the Zoom App Marketplace), or when Zoom delivers an app_deauthorized event for that user, the corresponding connection row is set to is_active = false and the token columns are cleared within minutes. The row itself is retained without tokens for auditability and is fully deleted on explicit request.
3.2 Meeting and Recording Metadata
We store meeting metadata (meeting ID, topic, host, start time, duration, join URL) and recording metadata (recording ID, host, start time, file types, download URL, transcript URL) in dedicated tables.
We also download and retain our own copy of the recording media (video and audio) and transcripts. Media and transcript files are held in a private Vercel Blob store in the United States; transcript text is additionally stored in the database so meetings are searchable. Because the Platform holds its own copy, a recording remains available here after it is deleted from Zoom, and is no longer governed by Zoom's retention settings.
Recordings, transcripts, and metadata are retained for as long as they are operationally useful to the team (for example to link a past meeting to a client work item) and are deleted on explicit user request or when the user's account is removed from the Platform.
3.3 Webhook Event Payloads
Every webhook delivered by Zoom is recorded in the zoom_webhook_events table along with the signed headers, raw body, signature verification result, and any error. These records are used for debugging and audit. A daily scheduled job purges rows older than 30 days.
3.4 Deauthorization Handling
Motta Hub implements the Zoom App Marketplace app_deauthorized event. When Zoom notifies us that a user has uninstalled or revoked the app, we immediately mark the connection inactive, clear the stored tokens, and stop calling the Zoom API on that user's behalf. No further Zoom data is collected for that user until they reauthorize.
4. Deletion Requests
Users may request deletion of personal data by emailing the address in Section 7. Each request is acknowledged within 5 business days and completed within 30 days. Deletion is performed as follows:
- Tokens. Immediately cleared from the
zoom_connectionsrow. - Zoom-derived metadata. Rows in
zoom_meetings,zoom_recordings, andzoom_phone_callsthat are linked to the user are deleted. - Webhook history. Webhook events tied to the user's Zoom account are deleted ahead of the normal 30-day purge.
- Backups. Supabase's point-in-time backups roll off automatically; we do not restore from backup to recover deleted data.
5. Legal Holds
In rare cases we may retain data beyond the periods stated above when required by law, regulation, or a valid legal process (for example litigation hold, subpoena, or regulatory inquiry). In such cases we will retain only the minimum data necessary and for only the period necessary.
6. Changes to This Policy
We may update this Data Retention Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated through the Platform or via email. See also our Privacy Policy and Terms of Service.
7. Contact
Send retention or deletion questions to support@mottafinancial.com.