Privacy policy
This one policy covers both the MotifHR website at motifhr.com and the MotifHR application at app.motifhr.com. You do not need to look anywhere else: wherever you are using MotifHR, this is the policy that applies.
Who is responsible for your information
This depends on which part of MotifHR you are using, and the difference matters for who you ask about your rights.
- The website. Heaptify is responsible. It is a public page with nothing to sign in to.
- The application. Your employer is responsible for your records, because they decide what to hold and why. Heaptify holds and processes those records on their instruction, as their service provider. If you want to see or correct your own leave records, ask your employer first; we will help them, but we will not change their records on our own initiative.
The website
The website deliberately collects almost nothing. There are no accounts, no forms, no cookies, no analytics and no access logs. We cannot tell you how many people have read it.
One thing does happen that you should know about. The page loads its typefaces from Google Fonts, which means your browser makes a request to Google and Google can see your IP address and which page requested the font. We do not receive that information, and we do not use it. If you would rather avoid it, a content blocker will stop the request and the page will still work with your device's own fonts.
If you email us using the contact link, we receive your message and your email address, and we keep it for as long as we need to answer you.
The application: what is held
When your employer uses MotifHR, these records exist about you.
| Kind | What that means |
|---|---|
| About you | Name, work email address, phone number, job title, the country you work in, your start date, your role in the system, and who your manager is. |
| Your leave | The dates you requested, whether it was a whole or half day, the type of leave, the reason you typed, who approved or declined it, any note they added, and the status of the request. |
| Your entitlement | How many days you get, how many you have taken, what is awaiting a decision, what remains, days carried over, and any manual adjustment an administrator has made with the reason for it. |
| Emergency contact | The name, phone number and relationship of the person you nominated. This is information about someone else, so please only enter it if they are content for you to. |
| Messages sent | A copy of notification emails the system sent about you or to you, including the address, subject and body. |
| Calendar sharing | Whether you chose to publish your leave to your own calendar app, and the secret address used for it. |
Health information
Sick leave is one of the leave types, so a record that you were absent through sickness is health information about you, and the law treats that as especially sensitive. The same is true if you type a medical detail into the reason field.
MotifHR does not ask for a diagnosis, a doctor's note or any medical detail, and you should not put one in. Your employer is responsible for deciding whether recording sickness absence in this way is lawful and proportionate for them, and for telling you about it. Colleagues who are not your manager or an administrator cannot see your entitlement figures, though approved absence is visible on the shared calendar, which is the point of a shared calendar.
Why it is held
Your employer holds these records to manage leave: to decide requests, to keep an accurate count of entitlement, to let colleagues plan around absence, and to meet their own record-keeping obligations as an employer. In data protection terms this normally rests on their legitimate interests as an employer and on their obligations under employment law, rather than on your consent — which matters, because it means you are not asked to consent and cannot be penalised for withholding it.
Heaptify does not use these records for anything of its own. We do not sell them, we do not profile anyone, we do not use them to train anything, and we do not advertise.
Where it is stored
All application data is stored on Amazon Web Services in the London region (eu-west-2), in the United Kingdom. Amazon provides the database, the sign-in service, the file storage and the email sending, acting on our instruction as our own service provider.
If your employer or its staff are in Türkiye, this means the records are held in the United Kingdom rather than in Türkiye. Your employer should satisfy itself that this suits its obligations, including under Turkish data protection law, before using MotifHR.
Who else sees it
- Colleagues at your employer — your manager and administrators see your records; colleagues see approved absence on the shared calendar.
- Amazon Web Services — as the provider of the infrastructure it runs on.
- Google — only for the website's typefaces, as described above. Google is not involved in the application.
- date.nager.at — a public holiday reference the application reads to fill in each country's public holidays. It is asked about countries and dates only, and no personal information is sent to it.
Nobody else. We do not pass records to any other company, and we would not do so without telling your employer first.
If you share your calendar
You can choose to follow your leave in your own calendar app. That works through a private address containing a long random code. Anyone who has that address can read your leave dates without signing in, so treat it like a password. You can replace it at any time in the application, which immediately stops the old one working.
How long it is kept
Records are kept for as long as your employer keeps using MotifHR, because leave history is what makes entitlement add up over time. When someone leaves, their access is switched off but their leave history stays, so your employer's records remain complete.
When your employer stops using MotifHR, or asks us to delete its data, we delete or irreversibly anonymise it within a reasonable period. If you want your own records deleted, ask your employer, because it is their decision to make.
Your rights
Under UK data protection law, and under Turkish law where it applies to you, you can ask to see the information held about you, to have mistakes corrected, to have it deleted, to restrict or object to how it is used, and to receive a copy in a portable form. You can also complain to a regulator.
For records in the application, please ask your employer first, since they decide what is held. If they need our help to answer you, we will give it. For anything to do with the website, or if you cannot get an answer, write to us at contact@heaptify.com and we will respond within one month.
In the United Kingdom you can complain to the Information Commissioner's Office. In Türkiye you can complain to the Personal Data Protection Authority (KVKK).
Keeping it safe
Access needs a password and a verified email address. Traffic is encrypted in transit, and data is encrypted where it is stored. Access within a company is limited by role, and when someone is deactivated their sign-in stops working.
No system is perfect, and we would rather say so than claim otherwise. If something happens that puts personal information at risk, we will tell the affected employer promptly so they can meet their own obligations, and we will tell regulators where we are required to.
Children
MotifHR is a workplace tool and is not intended for anyone under 16. We do not knowingly hold information about children.
Changes to this policy
We will update this policy as the product changes. The date at the top shows when it last changed, and where a change materially affects you we will tell administrators by email.
Contact
Any question about privacy, or about this policy, goes to contact@heaptify.com.