Motionspace Privacy Policy

1. Introduction and Scope

This Policy explains how Ora Technologies Company, as the controller of the Personal Data of Motionspace users, collects, uses, discloses, retains, protects, and destroys your Personal Data, and the rights available to you in relation to that data.

This Policy applies to the Motionspace website and digital library, user accounts, favorites, delivery of protected prompts, daily quotas, contact forms, newsletter, Motionspace Assistant, Video Ads when enabled, subscriptions, and payments when enabled. We may provide an additional privacy notice for a specific service if it requires processing that differs materially from what is described here.

You may browse public previews without creating an account. However, we may process technical and security data necessary to deliver the page, protect the Platform, and prevent misuse. Browsing without an account does not mean that your use is completely anonymous.

When you use the Copy Prompt action in Motionspace, the Platform records the delivery event and its associated quota usage. We do not receive what you subsequently send to an external AI tool that you independently choose, or the output generated by that tool, unless you submit it to us yourself through one of our services.

2. Controller and Contact Details

• Controller: Ora Technologies Company.
• Legal form: A Single-Person Limited Liability Company registered in the Kingdom of Saudi Arabia.
• Unified Number: 7055008002.
• Registered address: Building 6655, Suwayd Bin Harithah Street, Hittin District, Secondary Number 3443, Riyadh 13516, Kingdom of Saudi Arabia.
• Email for privacy requests: info@motionspace.ai.

Ora Technologies Company is the controller of Motionspace customers' data unless a specific notice states that another entity acts as an independent controller for a particular processing activity.

3. Definitions

For the purposes of this Policy:

• “we,” “us,” “our,” or the “Controller” means Ora Technologies Company.
• “Motionspace” or the “Platform” means the service, website, and digital library operated by the Controller.
• “you” or the “Data Subject” means the person to whom the personal data relates.
• “Personal Data” means any data, regardless of its source or form, that may identify you directly or indirectly.
• “Sensitive Data” means data classified in this category under the Personal Data Protection Law, such as certain health, credit, or biometric data, or data concerning beliefs or origin.
• “Processing” means any operation performed on Personal Data, such as its collection, recording, organization, retention, use, analysis, disclosure, transfer, or destruction.
• “Processor” means a party that processes Personal Data on behalf of and in accordance with the instructions of the Controller.
• “Account” means the account registered in your name to access Motionspace features.
• “Motionspace Assistant” means the chat interface that answers questions about the product and library using a contracted AI provider.
• “Law” means the Personal Data Protection Law of the Kingdom of Saudi Arabia and its regulations, to the extent applicable.
• “Competent Authority” means the Saudi Data and Artificial Intelligence Authority (“SDAIA”) or any authority that succeeds it in exercising such jurisdiction.

4. Data We Process

We do not ask you to provide more Personal Data than is necessary for the specified purpose. The data varies depending on the features you use.

4.1 Account and Identity Data

When you create an Account or sign in, we may process:

• your name, email address, and profile image if provided by the sign-in provider;
• your email verification status, sign-in method, identity provider, and account identifier with that provider;
• your password as a one-way hash when you sign in by email; we do not retain your password as readable text;
• session tokens and their expiration dates, your Internet Protocol address, and browser or device data associated with the session;
• authentication identifiers or tokens returned by the sign-in provider, their scope, and their expiration dates, to the extent necessary to link the Account and operate sign-in;
• records of verification and password-recovery emails, including the recipient, subject, HTML message content, reply-to address, provider message identifier, and delivery status; the message content may include a signed link with a limited validity period; and
• the versions of the terms and policies you accepted, the time, context, and source of acceptance, and limited technical evidence such as browser language and user agent.

Your name, email address, and certain authentication data are required to create an Account. A profile image and sign-in with Google are optional. Motionspace does not currently require a mobile number to create an Account.

4.2 Subscription, Entitlement, and Usage Data

When you use your Account or protected materials, we may process:

• your plan, subscription status, entitlement period, and the date on which it expires, is suspended, or is canceled;
• the identifier of the prompt or material you requested, the delivery time, the Copy Prompt event, and your used and remaining daily quota; the usage record does not mean that we retain the text of the copied prompt within that record;
• idempotency keys and attempt status needed to prevent the same technical retry from being counted twice;
• items you save as favorites;
• entitlement records, specified usage actions such as copying, the outcome of certain authentication attempts, and rate-limiting data; and
• cancellation, refund, and payment-dispute records associated with the entitlement, where applicable.

The template-library journey delivers prompts through Copy Prompt. Separately, Video Ads, when enabled, allows eligible customers to generate, view and download their own customized videos. Video generation uses a monthly allowance distinct from daily prompt copies.

4.3 Payment and Billing Data

When paid purchasing is enabled, we may receive the following from the payment provider:

• the plan, amount, currency, and billing cycle;
• the provider's customer, contract, and transaction identifiers;
• the status of collection, renewal, failure, cancellation, refund, dispute, or payment reversal; and
• limited payment-method data, such as the card type or last four digits, only if the provider sends it and retaining it is necessary.

Raw card data, the full card number, and the security code do not enter Motionspace's infrastructure, and we do not retain them. The payment provider processes this information under its own terms and privacy policy. Paid purchasing is not currently enabled, so we do not process the payment data described above unless paid purchasing becomes available and you complete a purchase.

4.4 Technical and Security Data

When you visit the Platform or use its features, we may process:

• your Internet Protocol address, user agent, browser and device type, operating system, and language;
• requested pages or paths, request and response times, errors, and diagnostic events;
• referral or landing-page data and campaign parameters if a measurement tool to which you have consented is enabled;
• rate-limiting records, sign-in and verification attempts, and security events;
• the outcome of anti-bot checks and the technical data the check provider needs to verify that a request is made by a human;
• a pseudonymous visitor identifier technically derived from network address and browser data to protect the Assistant and apply usage limits without requiring an Account; and
• limited performance measurements, such as page-load time and visual stability, when a performance-measurement tool is enabled.

4.5 Contact and Support Messages

When you use the contact form or request support, we process your first name, last name, email address, message text, and any information you include in it, as well as the request status, the record of routing the message by email, and delivery status. The email record may retain the recipient, subject, HTML message content, reply-to address, and the provider's message identifier. Do not send passwords, card data, confidential client data, or Sensitive Data in your message.

4.6 Newsletter

If you choose to subscribe to the newsletter, we process your email address, signup source, a copy of the consent language, the time it was given, the time your email was confirmed, subscription, cancellation, or bounce status, and the reason for suppressing delivery where necessary. The email record may retain the recipient, subject, HTML message content, provider message identifier, and delivery status. Subscription requires separate confirmation by email, and we do not infer your consent to the newsletter from your acceptance of cookies or creation of an Account.

4.7 Motionspace Assistant

When you use the Assistant, we process:

• your messages, the resulting responses, the conversation identifier, language, and timing;
• your Account identifier if you are signed in, or a pseudonymous visitor identifier if you are not;
• rate-limiting data and records necessary for security and preventing misuse; and
• product or public-catalog information retrieved by the Assistant to formulate its response.

The messages required to generate a response are sent to the AI provider. The integration is configured to request that the provider not store the response where the provider offers this setting, although the provider may retain certain data for technical or security purposes under its terms. The Motionspace system assigns the conversation an expiration date 90 days after its most recent update for continuity, support, safety, and misuse-prevention purposes, unless it must be extended because of a dispute or legal obligation. Assigning an expiration date does not mean that the record is automatically and actually deleted when that date is reached; the record may remain until the destruction process is carried out.

Do not send secrets, passwords, card data, Sensitive Data, or client information you are not authorized to share through the Assistant. The Assistant's responses may be inaccurate. Do not use your conversation to make a consequential legal, financial, or professional decision without appropriate human review.

4.8 Cookies and Local Storage

The Platform may use cookies, local storage, or session storage to:

• provide secure authentication and sessions and protect your Account;
• retain your language selection for up to one year;
• retain your cookie preferences and the date on which they were updated;
• retain a local copy of your Assistant conversation for continuity of the interface; the interface treats it as expired one hour after the most recent local save, but the data may remain in browser storage until the browser deletes it, the Platform replaces it, or you clear it;
• retain idempotency keys for actions in progress and the interface state you requested; and
• run Google Analytics 4 or optional marketing analytics after you consent, and run limited performance measurement or diagnostic logs based on legitimate interests where applicable.

The Cookie Policy at /cookies-policy explains the categories, tools, and choices in greater detail.

4.9 Video Ads

When Video Ads is enabled and you choose to use it, we process your uploaded product image, optional AI-generated presenter image, the words and product details you provide, and your selected language, duration and format. We also process the prepared ad instructions, generated images and video, job status, monthly allowance, generation costs and technical records needed to deliver the result and resolve failures.

We send the relevant images and words to OpenAI to prepare and check the ad, and to BytePlus ModelArk to prepare images and generate video. These providers may process and retain inputs or outputs under the account settings, contracts and technical or security requirements that apply to the enabled service. We do not promise that provider-held copies are deleted immediately when you delete a video from Motionspace.

Customer uploads and completed videos are stored privately and made available through your authenticated account and limited-validity access links. Product and presenter uploads are used for the ad you request and are not automatically published to the public example library. This version accepts AI-generated presenter images only; photos of real people are not supported.

5. How We Obtain Data

We obtain data in the following ways:

• Directly from you: when you create or update an Account, subscribe, contact us, choose the newsletter, or use the Motionspace Assistant.
• Automatically through your use: from network requests, sessions, cookies, local storage, security records, quotas, and diagnostics.
• From other parties: such as Google if you choose federated sign-in, the payment provider when purchasing is enabled, the email provider in connection with delivery, bounces, or complaints, the anti-bot provider, and enabled hosting and analytics providers.

If we obtain your data from another source and the required information has not already been made available to you, we will provide you with the required information about the source, categories, and purposes within the period prescribed by law, unless a prescribed exception applies.

6. Purposes and Lawful Bases for Processing

We determine the lawful basis for each purpose individually. We do not treat acceptance of the Terms of Use as general consent to all processing activities.

When we rely on legitimate interests, we verify that the purpose is lawful and specific, that the processing is expected, reasonable, and limited, that it does not include Sensitive Data, and that our interests do not override your rights and interests.

Where consent is the lawful basis, we request it clearly and separately for each purpose that requires it, retain evidence of it, and allow you to withdraw it easily. Withdrawal does not affect the lawfulness of processing carried out before withdrawal or processing based on another lawful basis.

7. Automated Processing and Artificial Intelligence

Motionspace uses automated rules for authentication, entitlement verification, application of quotas, rate limiting, and detection of certain patterns of misuse. When purchasing becomes available, the Platform will process verified payment events through the payment-provider integration. Depending on Account or subscription status, these rules may grant or deny access or temporarily suspend a feature.

We do not currently use your data to make a decision based solely on automated processing that produces legal effects or similarly significant effects concerning you. If you believe an automated rule was incorrectly applied to your Account, contact us to request a review.

The Motionspace Assistant generates automated answers to provide product and library guidance. It is not authorized to change your subscription, execute a payment, or make a legal or credit decision concerning you.

8. Parties to Whom We May Disclose Data

Depending on the feature used, we may disclose the minimum data necessary to the following categories of recipients:

• Hosting and operation of the website and interfaces: to deliver pages, requests, and operational logs;
• Databases and backups: to retain Accounts, entitlements, quotas, favorites, messages, and records;
• Storage, media delivery, and content-delivery networks: to provide public or protected previews and resources;
• Authentication: to process sign-in by email or with Google when you choose it;
• Email: to send verification, recovery, service, and newsletter messages and receive delivery status;
• Anti-bot, security, monitoring, and performance measurement: to protect forms and Accounts and diagnose faults;
• Artificial intelligence: to process Motionspace Assistant messages and produce responses, and to prepare and check customer images, words and generated Video Ads when that service is enabled;
• Optional analytics: to measure use after you consent and the tool is enabled;
• Payment and billing: to process subscriptions, payments, refunds, and disputes when purchasing is enabled;
• Advisers, auditors, and insurers: to the extent professionally necessary and subject to confidentiality obligations;
• Government or judicial authorities: where disclosure is required by law or necessary to protect a legitimate right; and
• Legal successors: in connection with a merger, acquisition, restructuring, or transfer of the business, with continued protection of the data and notice to you when required.

Depending on the enabled feature, the Platform may rely on services that include Vercel, Neon, Cloudflare, Resend, OpenAI, BytePlus ModelArk for Video Ads when enabled, Google, AWS for backups, and Mux for video delivery when enabled. Some may act as Processors for us, while others may provide an independent service that you choose, such as sign-in with Google.

This Policy does not cover external websites or tools that you choose to visit after using the Copy Prompt action. Those parties are governed by their own privacy policies.

9. Transfer and Processing of Data Outside the Kingdom

Some Processors may host data or allow authorized personnel to access it from outside the Kingdom of Saudi Arabia. Any cross-border transfer or disclosure is subject to applicable legal requirements, including specifying the purpose, lawful basis, categories, and recipients; minimizing the data to what is necessary; verifying the level of protection; applying appropriate safeguards, such as standard contractual clauses or any other mechanism permitted by law; and conducting a transfer risk assessment where required.

The countries and processing locations vary by provider and enabled feature. If appropriate safeguards can no longer be maintained, or a risk assessment indicates an unacceptably high level of risk, we will stop the transfer or change the processing method as required by law.

10. Retention and Destruction

We retain data for the period necessary for the purpose for which it was collected, taking into account legal requirements and the need to resolve a dispute, maintain accounting records, prevent fraud, or establish, exercise, or defend a legal claim. Once the need ends, the data is subject to destruction or anonymization under the mechanisms we apply.

When billing becomes available, an Account-deletion request begins by canceling any active billing contract through the supported process. Deletion of operational Account data is not completed until the payment provider confirms that no active or pending contract remains. Completing deletion may require operational follow-up after the provider's confirmation is received.

Deleting your Account alone does not constitute a request to destroy all Personal Data. A destruction request also does not cover data that must be retained by law, including certain financial or security records and data temporarily present in the backup cycle.

Deleting your Account does not automatically delete an independent newsletter record, a contact message, email-delivery records, payment and audit events, or backups that are not directly linked to the Account for deletion purposes. You may identify these categories in your privacy request, and you may unsubscribe from the newsletter using the designated unsubscribe link. We process each category according to its lawful basis, retention period, and applicable legal exceptions.

11. Data Protection

The current technical architecture includes certain programmed controls, including, as applicable:

• hashing passwords and not retaining them as readable text;
• HttpOnly session cookies with a SameSite=Lax policy and restrictions on sign-in origins;
• rate limits and a limited log of authentication actions and their outcomes, using a hashed value instead of the raw network address in that log;
• function-specific permissions and service keys; and
• private storage for protected materials and links with limited validity periods.

No method of storage or transmission can guarantee absolute security. You must protect your sign-in details, not share them, and notify us immediately if you suspect unauthorized use of your Account.

12. Data Subject Rights

Under the Law and to the extent applicable, you have the following rights:

• Right to be informed: to know the lawful basis, purpose, categories, collection and Processing methods, and retention practices;
• Right of access: to access your Personal Data held by us;
• Right to obtain a copy: to request a clear, readable copy in a commonly used electronic format;
• Right to correction, completion, and updating: to request the correction of inaccurate, incomplete, or outdated data;
• Right to request destruction: where the legally prescribed conditions are met, subject to mandatory retention exceptions;
• Right to withdraw consent: where consent is the lawful basis, without affecting prior lawful Processing or Processing based on another lawful basis;
• Right to complain and claim compensation: to submit a complaint to the Competent Authority and to claim compensation for harm before the competent court in accordance with legally prescribed procedures; and
• Request restriction of disputed Processing: in cases specified by the regulations, such as the period necessary to verify the accuracy of disputed data.

To exercise a right, send your request to info@motionspace.ai from the email address associated with your Account, if possible, and identify the right and data concerned. Do not send a password or card data. We may request the reasonable minimum information necessary to verify your identity or authority before fulfilling the request.

We process your request without delay and within no more than 30 days of receiving it. This period may be extended by no more than an additional 30 days if fulfillment requires unexpected or unusual additional effort, or if you submit multiple requests, provided that we inform you in advance of the extension and the reasons for it. Exercising rights is generally free of charge. A request that is unjustifiably repetitive or requires unusual effort may be refused in cases permitted by the regulations, and we will inform you of the refusal and its reasons.

13. Marketing, Analytics, and Cookies

We do not send the newsletter or marketing offers unless you provide separate consent and confirm your email address. You may unsubscribe free of charge through the signed link in each message or by submitting a request to the privacy email address, and we will stop marketing messages without undue delay.

We may continue to send necessary service messages, such as email verification, Account recovery, security alerts, subscription or payment status, and necessary policy updates, because these are not marketing messages.

Google Analytics 4 and any analytics or marketing measurement classified as optional remain disabled until you select the analytics or marketing category in the cookie-preferences panel. Consent to analytics does not constitute a newsletter subscription, and subscribing to the newsletter does not constitute acceptance of optional cookies.

The “marketing” preference is not currently used to activate an active marketing tracker; it only retains your selection. If we add a new marketing purpose that requires consent, we will provide an appropriate notice and request new consent specific to that purpose.

We may use limited performance measurements or diagnostic logs necessary to improve service reliability based on legitimate interests, following data minimization and the balancing of interests. This measurement is separate from Google Analytics 4 and optional analytics or marketing measurement, none of which operates unless you consent.

You can accept, reject, or change optional categories through Cookie Preferences in the website footer. Withdrawal applies prospectively. Deleting necessary browser storage may sign you out or reset your preferences.

14. Data of Persons Who Lack Full Legal Capacity

The service is intended for persons who have the legal capacity required to enter into a contract. The current registration process does not request a date of birth or conduct technical age verification. If a guardian or legal representative believes that we are processing the data of a person who lacks legal capacity, they may contact us at info@motionspace.ai so that we can verify the matter, take appropriate action, and facilitate the exercise of that person's rights under the Law.

We do not request Sensitive Data about minors or provide a paid-subscription process designed for them.

15. Personal Data Breaches

If a Personal Data breach occurs that may harm the data or the Data Subject or conflict with the Data Subject's rights or interests, we will notify the Competent Authority within no more than 72 hours of becoming aware of it, in accordance with the conditions and information required by law.

The Data Subject must be notified without undue delay where the breach may cause harm to their data or conflict with their rights or interests. The notice will use clear language and include a description of the breach, potential risks, measures taken, a means of contact, and appropriate recommendations. This does not mean that every technical event or unsuccessful attempt constitutes a reportable breach.

16. Policy Updates, Governing Law, and Complaints

We may update this Policy when the service, Processors, or laws change, and we will state the last-updated date above. If a change is material, we will provide appropriate notice where required by law. If an update introduces a new purpose that requires consent, we will request separate consent before beginning that Processing; continued browsing is not a substitute for such consent.

This Policy is governed by and construed in accordance with the laws of the Kingdom of Saudi Arabia. Translations into other languages may be made available for convenience. If there is a conflict, the Arabic text prevails unless the law requires otherwise.

If you have a privacy-related question, complaint, or objection, you may first contact us at info@motionspace.ai with a description of the matter and the necessary Account details. This internal process is not a condition that prevents you from submitting a complaint to the Saudi Data and Artificial Intelligence Authority (“SDAIA”) or bringing a matter before any competent authority or court. The regulations allow a complaint to be submitted to the Competent Authority within no more than 90 days after the incident occurred or you became aware of it; the Authority may accept a late complaint if it finds factual reasons that prevented submission within that period.

17. Legal References

• Personal Data Protection Law
• Implementing Regulations of the Personal Data Protection Law
• Regulation on Personal Data Transfer Outside the Kingdom
• Guideline for Preparing and Developing a Privacy Policy

Video credit and payment records

We process your credit purchases, monthly add-on settings, payment references, confirmed payment status, credit reservations, delivery charges, returns and expiry records to provide video services and resolve payment issues. Card details go directly to Moyasar; Motionspace stores provider references and encrypted recurring-payment tokens rather than card numbers. These billing records remain separate from website-plan entitlements. Necessary financial and audit records are retained under the retention rules above.