Privacy Policy
1. Controller
The controller for data processing on this website and within the Motorica software is Kerim Yagmurcu, Loreleiweg 11, 23560 Lübeck, Germany. E-mail: datenschutz@motorica.io.
2. General information
Protecting your personal data is important to us. We treat personal data confidentially and in accordance with statutory data protection rules, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Personal data means any information relating to an identified or identifiable natural person.
3. Hosting and server log files
Our website and the Motorica platform are operated through checkdomain.de on servers in Germany. When you visit the website, the server automatically records information in server log files:
- IP address
- date and time of the request
- browser type and browser version
- operating system
- referrer URL
- pages accessed
- host name of the accessing computer
Processing is carried out to ensure secure and trouble-free operation of the website. The legal basis is Article 6 (1) (f) GDPR. Server log files are deleted automatically after no later than 30 days unless statutory retention duties apply.
4. SSL/TLS encryption
This website and the Motorica platform use SSL/TLS encryption for security reasons. You can recognize an encrypted connection by the "https://" prefix in your browser address bar.
5. Contact
If you contact us by e-mail or contact form, we process the data you provide, such as name, e-mail address, telephone number if provided and the content of your message. Processing is carried out solely to handle your request. The legal bases are Article 6 (1) (b) and Article 6 (1) (f) GDPR. Requests are deleted after no later than 24 months unless statutory retention duties apply.
6. Registration and customer account
Using Motorica requires a customer account. In particular, first and last name, company name, address, telephone number, e-mail address, username, encrypted password, language settings usage data, the version and hash of the contractual documents applicable when the contract was concluded, and the timestamp, IP address and user agent used as evidence of the contract may be processed. Processing serves pre-contractual measures and contract performance. The legal basis is Article 6 (1) (b) GDPR.
7. Use of the Motorica platform
When using Motorica, customers may store and process personal data of their own customers, suppliers and employees within the platform. This includes customer data, supplier data, employee data, invoice data, quote data, documents, payment information and communication data. Motorica processes this data exclusively on behalf of the respective customer. The customer remains the controller within the meaning of Article 4 No. 7 GDPR. Motorica acts as a processor pursuant to Article 28 GDPR. The authorised company administrator must accept the currently published data processing agreement in the customer account before personal data of third parties is processed within the platform.
8. Document upload and receipt capture
Users can upload documents and receipts, including invoices, receipts, till receipts, contracts, official letters and other documents. Processing is carried out solely to provide the requested functions within the platform. For optical character recognition (OCR), documents are processed on servers operated by us; documents are not transmitted to external OCR cloud services. The legal basis is Article 6 (1) (b) GDPR.
9. AI-supported document analysis (MIRA)
Motorica provides MIRA, an AI-supported assistant for analysing and processing documents. Uploaded documents may be automatically evaluated to extract invoice data, classify documents, summarize content, structure recognized information and provide information in the user's language. Processing is based solely on the documents provided by the user. MIRA analyses are processed on servers operated by us within our own infrastructure, without external third-party cloud AI services. The analysis serves only to provide the contractually agreed services. The legal basis is Article 6 (1) (b) GDPR.
11. Sending e-mails
We use the checkdomain.de e-mail service (SMTP) to deliver system e-mails, invoices, notifications and other messages. Name, e-mail address, message content and technical delivery information may be processed. The legal basis is Article 6 (1) (b) GDPR.
12. Payment processing (GoCardless)
We use GoCardless for payments during registration and subscription administration, such as direct debits. In particular, name and address, e-mail address, bank account and mandate details, payment status and transaction references may be processed. GoCardless may act as a processor. The legal basis is Article 6 (1) (b) GDPR. Further information is available in the GoCardless privacy policy.
13. Bank reconciliation (BANKSapi)
We use BANKSapi for optional bank reconciliation. Accounts are connected through a secure PSD2 frontend on behalf of Motorica. Account transactions and booking descriptions, balances and account references, payment references and transaction identifiers, and technical connection and session data may be processed. Processing reconciles incoming payments with outstanding invoices within Motorica. The legal basis is Article 6 (1) (b) GDPR. BANKSapi acts as the technical service provider for account connections. Further information is available in the BANKSapi privacy policy.
14. Use of Google Analytics
This website uses the web analytics service Google Analytics. Google Analytics uses cookies and similar technologies that enable an analysis of website use. Information generated by these technologies may be transmitted to and processed on Google servers. We use Google Analytics to analyse website use, improve our offer and optimize usability. IP anonymisation is activated, so the IP address of users within the European Union is shortened before transmission. The legal basis is Article 6 (1) (a) GDPR, consent via the cookie banner. The recipient is Google Ireland Limited. The storage period depends on the retention periods configured in Google Analytics.
15. Metricool
This website uses Metricool to measure website visits for social media reporting. After consent to statistics cookies, a script from tracker.metricool.com is loaded. URL, referrer, timestamp, technical browser/device data and approximate location (via IP) may be transmitted to Metricool Media SL (Spain, EU). According to the provider, no first-party cookies are set. Legal basis: Article 6 (1) (a) GDPR. More: https://metricool.com/privacy-policy/
16. Use of Microsoft Clarity
This website may use Microsoft Clarity if a project ID is configured and you allow statistics cookies in the cookie banner. Clarity may capture session recordings, heatmaps and usage statistics. Data may be transmitted to and processed by Microsoft. The legal basis is Article 6 (1) (a) GDPR (consent via the cookie banner). Recipients are Microsoft Ireland Operations Limited and/or Microsoft Corporation.
17. Use of Google Fonts
This website uses Google Fonts. Where possible, fonts are provided locally from our web server. If fonts are loaded directly from Google servers, a connection to Google servers is established when the website is accessed. In particular, the IP address and technical browser information may be transmitted. The legal basis is Article 6 (1) (f) GDPR, our legitimate interest in a uniform presentation of the website.
18. Applications
If applications are sent to us, we process the data contained in them solely to conduct the application procedure. After the procedure is completed, application documents are deleted after no later than six months unless a legal duty or consent permits longer storage. The legal basis is Article 6 (1) (b) GDPR.
19. Privacy information for the Android app
The Motorica app serves as mobile access to the Motorica platform. Depending on use, account data, device information, app version, language settings, usage data and error or diagnostic data may be processed.
20. Camera access
The app may access the camera to capture documents, invoices or receipts. Camera access takes place only after explicit approval by the user. The images are used solely for the functions requested by the user.
21. Access to files and storage
The app may access files when users want to upload documents or images. Access takes place only after approval by the user.
22. Firebase Cloud Messaging (push notifications)
The Motorica app uses Firebase Cloud Messaging (FCM) to send push notifications. In particular, device tokens, app instance IDs, device information and delivery information may be processed. Push notifications may inform users about new documents, completed document analyses, messages, system notifications and status changes. Push notifications can be disabled at any time in the device settings. The legal basis is Article 6 (1) (b) GDPR and Article 6 (1) (a) GDPR. The recipient is Google Firebase.
23. Google Play Store
When downloading the app via the Google Play Store, Google's privacy terms also apply. Further information is available in Google's Privacy Policy.
24. Storage duration
We store personal data only for as long as necessary for the respective purposes or as required by statutory retention duties. In particular, contact requests may be stored for up to 24 months, contract data for the duration of the contractual relationship, invoice data for 10 years, tax-relevant documents for 10 years and server logs for up to 30 days.
25. Access
You have the right of access to the personal data processed by us pursuant to Article 15 GDPR.
26. Rectification
You have the right to rectification of inaccurate data pursuant to Article 16 GDPR.
27. Erasure
You have the right to erasure of your personal data pursuant to Article 17 GDPR.
28. Restriction of processing
You have the right to restriction of processing pursuant to Article 18 GDPR.
29. Data portability
You have the right to data portability pursuant to Article 20 GDPR.
30. Objection
You have the right to object to the processing of your data pursuant to Article 21 GDPR.
31. Withdrawal of consent
Consent given may be withdrawn at any time with effect for the future pursuant to Article 7 (3) GDPR.
32. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Independent Centre for Data Protection Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.
33. Data location and transfers to third countries
Motorica generally processes core customer, company and document data in German or its own infrastructure. MIRA and OCR are operated in-house. Specialised providers may be involved in individual technical services such as payment processing, e-mail delivery, bank connections, app distribution or web analytics.
Customer, company and document data of the Motorica platform, as well as MIRA and OCR processing, are generally handled on infrastructure operated by us in Germany.
For individual technical functions, specialised providers may also process data outside the EU, particularly web analytics (Google Analytics, Metricool, Microsoft Clarity), push notifications (Firebase), app distribution (Google Play), payment processing (GoCardless) and bank connections (BANKSapi). The respective sections of this policy explain these processing activities in detail.
34. Service providers (overview)
In operating our services, we use in particular:
- Hosting of the website and Motorica platform: checkdomain.de, Germany
- E-mail delivery: checkdomain.de (SMTP)
- Payment processing: GoCardless
- Bank reconciliation and account connections: BANKSapi
- MIRA / OCR: servers operated by us, without external cloud services
- Web analytics: Google Analytics, Metricool, Microsoft Clarity (only with consent)
- Monitoring and backups: operated on our own infrastructure without an external monitoring or backup provider.
Push notifications (Firebase), web analytics (Google Analytics, Metricool, Microsoft Clarity) and fonts (Google Fonts) are described in their respective sections.
35. Data security
We use technical and organisational measures to protect personal data against loss, manipulation, unauthorized access or unauthorized disclosure. These include SSL/TLS encryption, access restrictions, role and permission concepts, regular security updates and backups. Backups and technical monitoring use our own infrastructure without an external provider.
Automated daily backups of the production database, uploads and files on separate infrastructure operated by us. Backups are encrypted, access is restricted, and they are deleted on a rolling 30-day basis. Documented recovery tests are carried out at least quarterly. Technical monitoring supports secure operation.
36. Changes to this Privacy Policy
We reserve the right to adapt this Privacy Policy to changed legal requirements or technical changes to our services. Status: 16 October 2026.
Session replay on the website and in the back office
On the website, we record the appearance of visited pages, navigation, mouse movements and scrolling only after you separately consent to session replay. Statistics consent alone does not enable replay. We use recordings to identify usability problems and improve the service.
In the signed-in back office, we may associate the same interactions with a user account to investigate errors and improve usability. Inputs are masked; visible back-office text and images, iframes, videos, canvas elements and marked sensitive areas are not recorded.
Recordings remain on our own infrastructure. Only authorized platform administrators may access them, and each access is logged. We delete recordings within seven days. You may withdraw website consent at any time in cookie settings for the future. For access, deletion or an objection concerning back-office processing, contact datenschutz@motorica.io.