Effective October 9, 2026
This Privacy Policy explains how [Company legal name] (“Payformotive”, “we”, “us”) collects, uses and protects personal data when you visit our website or use the Payformotive platform (the “Service”).
1. Our role
Payformotive is used by organizations to manage their employees’ goals, reviews and compensation. When an organization (our “Customer”) puts its employees’ data into the Service, the Customer is the controller of that data and we process it on the Customer’s behalf and under its instructions. If you are an employee and have questions about how your employer uses Payformotive, please contact your employer first.
We are the controller for data about website visitors, people who contact us, and the account and billing details of our Customers.
2. Data we collect
Data you or your organization provide
- Account details: name, work email address, job title, role in the Service and who you report to.
- Performance data: company and personal goals, self reviews, manager reviews, ratings and notes.
- Compensation data: current salary, merit budgets, proposed and approved increases.
- Communications: messages you send us, such as support requests or contact forms.
- Billing details: billing contact and payment information, which is handled by our payment provider.
Data collected automatically
- Log and device data such as IP address, browser type, pages visited and the time of each request, used to run and secure the Service.
- Cookies and similar storage that keep you signed in, as described in our Cookie Policy.
3. How we use data
- To provide the Service: running review cycles, showing each person the goals, reviews and pay information they are permitted to see, and calculating merit increases.
- To generate suggested goals using artificial intelligence, based on your organization’s goals and each employee’s role.
- To secure the Service, prevent abuse and fix problems.
- To communicate with you about your account, support requests and changes to the Service.
- To meet legal, tax and accounting obligations.
We do not sell personal data, and we do not use Customer Data to advertise to anyone.
4. Legal bases
Where data protection laws such as the GDPR apply, we rely on: performance of our contract with the Customer; our legitimate interests in running, securing and improving the Service; compliance with legal obligations; and consent where the law requires it. For Customer Data, the Customer is responsible for having a lawful basis to process its employees’ data.
5. Artificial intelligence
To draft suggested goals, we send a third-party AI model provider the goals the suggestions should support, the employee’s name, job title and job description, and their manager’s name. We send only what is needed to produce the suggestion, and we never send salary, rating or review information. Suggestions are always reviewed by a person before they are used.
6. Who we share data with
We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions. These include:
- Database, authentication and application hosting (Supabase);
- Website hosting and content delivery (Cloudflare);
- AI model access for suggested goals (OpenRouter and the model provider it routes to);
- Email delivery and payment processing providers.
We may also disclose data if the law requires it, to protect our rights or the safety of others, or as part of a merger or acquisition, in which case we will tell affected Customers.
7. International transfers
Our providers may process data in countries other than your own. Where data protection law requires it, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
8. Retention
We keep Customer Data for as long as the Customer’s account is active and as instructed by the Customer. After an account ends, we delete Customer Data from our active systems within 30 days of the export window closing, and from backups on their normal rotation. We keep billing records for as long as tax law requires.
9. Security
We protect data with encryption in transit, access controls that separate each organization’s data and limit what each person can see by role, and restricted internal access. No system is perfectly secure, but we will notify affected Customers without undue delay if we become aware of a breach involving their data.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. If your data is in Payformotive because of your employer, we will pass your request to them and help them respond. Otherwise, contact us at [legal@yourdomain.com]. You also have the right to complain to your local data protection authority.
11. Children
The Service is for workplaces and is not directed at children under 16. We do not knowingly collect their data.
12. Changes to this policy
We may update this policy. We will post the new version here with a new effective date and, for material changes, notify account administrators in advance.
13. Contact
[Company legal name], [Registered address]. Email: [legal@yourdomain.com]