Frequently Asked Questions
Common questions about accounts, security, privacy, payments and MotiveOne operations.
Can I create staff accounts?
Yes. Production owners and managers can create role-based staff logins. Only an owner can create another manager. Owner and manager accounts require authenticator-based MFA.
Does MotiveOne store card numbers or CVV?
It is not designed to. Card payments use tokenized processor methods when live payment processing is configured. Full card numbers, magnetic-stripe data, PIN data and card verification codes must never be stored in MotiveOne.
Is MotiveOne PCI certified?
No PCI certification claim is made. The architecture is designed to reduce PCI scope through tokenized processors, but each merchant must complete the PCI validation applicable to its payment environment.
Does MotiveOne sell personal information?
No. MotiveOne does not currently sell personal information for money or use CRM customer records for cross-context behavioural advertising.
Where is data processed?
MotiveOne uses a dedicated Supabase production project currently hosted in AWS US East (Ohio), together with Vercel and optional providers depending on enabled modules. See the Subprocessors page for current processing and transfer information.
Can customers request deletion or a copy of their data?
Yes. Applicable rights include access, correction, deletion and portability. Requests can be sent through the Data Rights page. For CRM records, the business that collected the data is often the controller and may be the fastest point of contact.
Does MotiveOne support Canadian privacy requirements?
The platform is being operated against a PIPEDA/Québec privacy-management baseline: accountability, safeguards, retention limits, access/correction handling, incident records and privacy-impact-assessment processes. Formal legal applicability depends on the business, province and data flow.
What about GDPR?
MotiveOne includes privacy-by-design, access control, security, retention and data-rights controls that support GDPR obligations. Before regulated EEA/UK customer data is onboarded, controller/processor terms, transfer mechanisms, subprocessor terms and any required DPIA or representative determination must be completed.
What about U.S. state privacy laws?
MotiveOne provides a common rights workflow supporting access, correction, deletion, portability and applicable opt-out rights. Whether a particular state law applies depends on the business, state, thresholds and processing activities.
How is marketing consent handled?
Customer records include SMS and email consent status. Businesses must configure campaigns to respect consent and opt-outs. Different countries and states can impose different consent, identification and unsubscribe requirements.
Does the public website use advertising cookies?
Not currently. If non-essential analytics or advertising technologies are added, MotiveOne will update the Cookie Policy and implement consent controls where required.
What security testing runs before deployment?
Production builds run TypeScript checks, automated tests and a high-severity production dependency audit. Independent penetration testing and formal certification are separate controls and are not claimed unless completed.
What are the current plans?
MotiveOne CRM is C$39.99/month for up to five staff users. MotiveOne Pro is C$69.99/month/location with unlimited staff and advanced features. The branded app add-on is C$59.99/month plus a C$200 one-time setup/publishing fee.
Home · FAQ · Privacy · Security