Introduction

MotionValidator is operated by Citational Limited, a UK limited company. We built MotionValidator for US attorneys who handle privileged legal documents. This Privacy Policy explains what information we collect, how we use it, and how we protect it.

If you have questions about this policy, email us at support@motionvalidator.com.

Company Information

Legal Entity: Citational Limited
Company Number: 17006536
Registered Address: 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE
Jurisdiction: United Kingdom (England and Wales).

MotionValidator's services are designed exclusively for attorneys practicing in the United States. All user data is stored on servers located in the United States (California and Virginia) and never leaves US jurisdiction.

Information We Collect

Information You Provide Directly

• Account Information: Email address, name, and password when you create an account.
• Legal Documents: Motions, briefs, and other documents you upload for verification.
• Payment Information: See "Payment Processing" section below.

Information Collected Automatically

• Usage Data: Pages accessed, features used, time spent on platform.
• Technical Data: IP address, browser type, device information, operating system.
• Log Data: Access times, error logs, system events.

Information We Do Not Collect

We do not collect information about your clients, opposing parties, or case details beyond what appears in documents you voluntarily upload.

How We Use Your Information

We use collected information solely to:

• Provide citation verification and document analysis services.
• Process your payments through our payment processor.
• Communicate with you about your account and our services.
• Improve platform functionality and user experience.
• Comply with legal obligations.
• Prevent fraud and maintain security.

We never use your documents to train our AI models. Not anonymized. Not aggregated. Not ever.

Data Processing and Storage

Document Processing

When you upload a document:

1. It is encrypted in transit (TLS 1.3) and at rest (AES-256).
2. Personally identifiable information is automatically stripped before AI processing.
3. The document is analyzed within our secured infrastructure.
4. AI inference uses SOC 2, ISO 27001, HIPAA, and PCI DSS certified providers.
5. Before any external AI processing, all PII is stripped and sensitive content is replaced with anonymized placeholders.
6. Citation verification occurs against our internal case law database with no external API calls.

Storage Location

All user data, including documents and verification reports, is stored exclusively on servers located in the United States (California and Virginia). Your data never leaves US jurisdiction.

Data Retention and Deletion

Automatic Deletion: All uploaded documents and associated verification reports are automatically and permanently deleted after 7 days.

Manual Deletion: You may delete any document manually at any time before the 7-day period. Deletion is immediate and irreversible.

Exceptions: You may opt to preserve specific validations beyond the 7-day auto-delete period. Only validations you explicitly choose to preserve will be retained.

Permanence: When we say "deleted," we mean permanently deleted from all systems, including backups. Once deleted, documents cannot be recovered, even by court order.

Payment Processing

Paddle as Merchant of Record

MotionValidator uses Paddle as our payment processor and merchant of record. This means:

• Paddle processes all payments on our behalf.
• We never see, store, or have access to your payment card details.
• We only receive your email address from Paddle to provision your account.
• Paddle handles all payment data in compliance with PCI DSS standards.

Information Shared with Paddle

We share only your email address with Paddle to process payments and fulfill your subscription. For complete details on how Paddle handles payment information, please review Paddle's Privacy Policy.

Payment Data We See

We receive transaction confirmations from Paddle (purchase date, amount, subscription status) but never receive your payment card number, CVV, or other sensitive payment details.

Data Sharing and Disclosure

We Do Not Sell Your Data

We do not sell, rent, or license your personal information or documents to third parties. Period.

Service Providers

We share limited information with service providers who help us operate MotionValidator:

• Paddle: Payment processing (email address only).
• AI Inference Providers: Anonymized, PII-stripped document content for language model processing (SOC 2, ISO 27001, HIPAA, PCI DSS certified).
• Infrastructure Providers: Hosting and storage (AWS or similar providers in California and Virginia).

We never share any identifying information about you with any third-party service provider, except for Paddle, with whom we share your email address at the point you choose to subscribe to MotionValidator.

Legal Process and Subpoenas

We are committed to protecting your documents and information, but we will comply with valid legal process.

We will comply with lawful subpoenas and court orders from US courts with proper jurisdiction. However:

• We will challenge overbroad or improper requests.
• Because documents auto-delete after 7 days, we often will not have responsive materials.
• Our log files never contain identifying information.
• We are "subpoena-resistant by design" due to our automatic deletion architecture.
• We will notify affected users of any legal process unless specifically and expressly prohibited by court order.

If your account becomes subject to a subpoena or court order, we will inform you as soon as legally permissible.

Attorney-Client Privilege

We recognize that documents uploaded to MotionValidator may contain privileged attorney-client communications. We protect privilege through:

• No human review of document contents (processing is automated).
• Automated PII redaction before any processing.
• No sharing of document content with unauthorized third parties.
• Secure automatic deletion.
• Contractual protections with all service providers.

Security

We take security seriously. Our infrastructure includes:

• Encryption: TLS 1.3 for data in transit; AES-256 for data at rest.
• Network Security: Isolated VPC architecture, multi-layer firewalls, intrusion detection.
• Access Controls: Role-based access, multi-factor authentication for administrative access.
• Monitoring: Comprehensive audit logging and real-time anomaly detection.
• Third-Party Certification: We use only SOC 2, ISO 27001, HIPAA, and PCI DSS compliant service providers.

Our practices are designed around SOC 2 Type II and ISO 27001 principles. We are working toward formal certification in 2026. For complete details, see our Security & Trust page.

Your Rights and Choices

Access and Correction

You may access and update your account information at any time through your account settings.

Data Deletion

• Documents: Delete any document manually at any time, or allow automatic deletion after 7 days.
• Account: Request full account deletion by emailing support@motionvalidator.com.

Marketing Communications

We send only transactional emails necessary to provide our service (verification reports, billing notifications, important service updates). You cannot opt out of these essential communications while maintaining an active account.

Geographic Scope and GDPR

This service is designed exclusively for attorneys practicing in the United States. Our servers are located in the US, and we do not offer services to individuals in the European Union.

We believe the EU General Data Protection Regulation (GDPR) does not apply to MotionValidator because we do not target or serve EU residents. If you are located in the EU, please do not use our service.

Children's Privacy

MotionValidator is a professional service for attorneys. We do not knowingly collect information from anyone under 18 years of age.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email and by updating the "Last Updated" date at the top of this policy.

Important: Policy changes apply only to information collected after the effective date of the change. We will not retroactively apply new policies to documents already processed.

Data Breach Notification

In the unlikely event of a security incident affecting your data, we will:

1. Contain and investigate the incident immediately.
2. Notify affected users within 72 hours.
3. Provide details about what data was affected and steps we've taken.
4. Recommend actions you should consider taking.

Contact Us

Email: support@motionvalidator.com
Response Time: Within 24 hours for privacy and security inquiries

Mailing Address:
Citational Limited
3rd Floor, 86-90 Paul Street
London, England, United Kingdom
EC2A 4NE