Motion and the GDPR: AI training, data location and DPA

Trains on your data, with no documented way to stop it.

Yes: the Privacy Policy lists training machine learning algorithms as a use of collected information, and the Master Subscription Agreement allows anonymised service data for ML training. The security page's no-training promise does not override this.

Vendor's wording: “Training and developing machine learning algorithms, and identification of industry trends and developments, and anonymous benchmarking;”

Source: usemotion.com2. How we use your informationChecked on 20 October 2026

United States: customer data is stored on Google Cloud Platform in the Central-1 region, in Iowa.

Vendor's wording: “Data is stored in Google’s Central-1 region, based in Iowa.”

Source: usemotion.comSecurity page > Data hostingChecked on 19 October 2026

No EU hosting.

No. The security page says data is not stored in the EU and it is not possible to request EU-only storage.

Vendor's wording: “Data is not stored in the European Union, and at this time unfortunately it is not possible to request your data to only be stored in the European Union.”

Source: usemotion.comSecurity page > Data hostingChecked on 19 October 2026

Published.

Yes: public list at https://www.usemotion.com/legal/subprocessors (last updated April 29, 2025), 22 entries, all in the United States. Only OpenAI is named as an AI provider; Google Cloud Platform is listed as compute.

Vendor's wording: “Motion may engage third-party service providers to assist in providing our Services”

Source: usemotion.comMotion Subprocessors tableChecked on 20 October 2026

Not listed.

No listing found for search term 'NexusBird'

Source: dataprivacyframework.govSearch 'NexusBird' returned 'Query returned no results'Checked on 19 October 2026

Personal information is kept for the life of the account and up to one year after deletion unless earlier deletion is requested, then deleted or de-identified from active systems and backups. LLM inputs and outputs are held briefly for debugging.

Vendor's wording: “We retain personal information for the duration of your account and for up to one year after an account is deleted, unless you request earlier deletion.”

Source: usemotion.comPrivacy Policy > Data RetentionChecked on 19 October 2026

1 named: SOC 2 Type II (audited by Prescient Assurance).

Vendor's wording: “NexusBird, Inc (dba Motion) successfully completed the AICPA Service Organization Control (SOC) 2 Type II audit.”

Source: usemotion.comSecurity page > SOC 2Checked on 19 October 2026