← Back to Motta Hub

Privacy Policy

Last updated: September 14, 2026

1. Who We Are

Motta Hub ("the Platform") is an internal business operations platform operated by Motta Financial, LLC ("Motta Financial", "we", "us"). This Privacy Policy explains how we collect, use, store, share, and protect information processed by the Platform, including data obtained from integrated third-party services such as Zoom.

2. Scope

This policy applies to all users of the Platform, including Motta Financial employees and authorized collaborators, and to all personal data we receive from integrated services on behalf of those users. The Platform is intended for internal business use; it is not a consumer-facing product.

3. Information We Collect

We collect the following categories of information:

  • Account information. Name, work email address, and role of each authorized Motta Hub user, managed through Supabase Auth.
  • Zoom data. When you connect a Zoom account, we receive your Zoom user profile (name, email, account ID, time zone), your scheduled and past meeting metadata, your cloud recording metadata and download URLs, and your phone call history.
  • Zoom recording media. We download and retain our own copy of cloud recording media files (video and audio) for meetings recorded to your Zoom account, so that recordings remain available in the Platform independently of Zoom's own storage and retention. These files contain the full audio and video of the meeting, including anything said by other participants.
  • Zoom transcripts and summaries. We download and retain recording transcripts, store their text in our database so meetings are searchable, and retain AI-generated meeting summaries produced by Zoom.
  • Zoom webhook events. Real-time event payloads delivered by Zoom for events your authorized scopes subscribe to (for example meeting started, meeting ended, recording completed, app deauthorized).
  • OAuth tokens. Access tokens and refresh tokens issued by Zoom and other integrated services so the Platform can call those services on your behalf.
  • Operational data. Work items, debriefs, proposals, invoices, and other internal records you or your colleagues create inside the Platform.
  • Technical logs. Standard application logs (timestamps, IP addresses, request paths, error traces) used for debugging and security monitoring.

4. How We Use Information

We use the information described above to:

  • Display your meetings, recordings, and call history inside the Platform
  • Surface contextual information (for example linking a Zoom meeting to a client work item)
  • Refresh expired access tokens with Zoom and other providers
  • Verify the authenticity of incoming Zoom webhooks via HMAC-SHA256 signatures
  • Detect, investigate, and respond to security incidents
  • Comply with applicable legal obligations

We do not use Zoom data for advertising, do not sell Zoom data to any third party, and do not use Zoom data to train any machine learning model.

5. Where Data Is Stored

Motta Hub structured data, including Zoom metadata and transcript text, is stored in Supabase Postgres hosted in the United States. The database is encrypted at rest using AES-256 and is accessed only by the Motta Hub application running on Vercel. Row-level security policies isolate each team member's connection records and tokens.

Recording media and transcript files are stored in a private Vercel Blob store in the United States. These files are not publicly addressable: they carry no shareable URL and can only be retrieved through authenticated Platform endpoints, which serve them exclusively to signed-in Motta team members.

All network traffic between the user's browser, the Platform, Zoom, and Supabase uses HTTPS with TLS 1.2 or higher.

6. How We Share Information

We do not sell or rent personal information. We share data only with:

  • Service providers that host the Platform on our behalf (Vercel for compute and edge networking, Supabase for the database and authentication, Resend for transactional email, Vercel Blob for file storage). Each provider is contractually bound to handle data only on our instructions.
  • The integrated source service (for example Zoom) when we call its API on your behalf using your authorized credentials.
  • Legal and regulatory authorities when required by a valid legal request.

7. Data Retention

Detailed retention periods for each category of data are listed in our Data Retention Policy. In summary: Zoom OAuth tokens are retained until you disconnect or until Zoom revokes them, Zoom meeting and recording metadata is retained for as long as it is operationally useful or until you request deletion, and raw webhook event payloads are retained for 30 days for audit purposes and then automatically purged.

8. Your Rights and Choices

You may, at any time:

  • Disconnect Zoom from the Platform settings or from the Zoom App Marketplace. We will immediately stop calling Zoom on your behalf and stop accepting new webhook events from your account.
  • Request deletion of all your Zoom-derived data stored in the Platform by emailing the address in Section 11. We will honor deletion requests within 30 days.
  • Request a copy of the personal data we hold about you.
  • Correct inaccurate personal data through the Platform interface or by contacting us.

9. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

  • TLS 1.2+ for all data in transit
  • AES-256 encryption at rest for the Supabase Postgres database
  • Row-level security policies that restrict access to each team member's records
  • HMAC-SHA256 verification of all incoming Zoom webhook events with a 5-minute timestamp tolerance to prevent replay attacks
  • Secrets stored as environment variables scoped to the Production environment, never committed to source control
  • Principle-of-least-privilege access to production infrastructure

No method of transmission or storage is 100% secure. While we strive to protect personal information, we cannot guarantee absolute security.

10. Children's Privacy

The Platform is not directed to children under 16 and we do not knowingly collect personal information from children under 16.

11. Contact Us

For privacy-related questions, deletion requests, or to exercise any right described above, contact us at support@mottafinancial.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated through the Platform or via email.