Privacy and security

getmotrix.com sets no cookies, has no forms and runs no analytics scripts, visitor tracking or advertising. Its fonts, images and scripts are served from this site; nothing is loaded from third parties.

Requests to this site and to the app pass through Cloudflare and the hosting server. Both process technical request data, such as IP address, browser user agent, the address requested and the time, to deliver the pages and keep them secure. Cloudflare’s servers also ask your browser to report failed connections, not successful ones, to Cloudflare’s network error logging endpoint for up to 7 days after your last visit (the NEL and Report-To headers).

On the hosting server, only this website keeps a request log; the app’s server writes none. The log has one line per request with the IP address, browser, address requested and time, and no fixed retention period: lines are kept until newer ones overwrite them, at most about 30 MB of log lines, and the whole log is deleted whenever the site is redeployed.

From 1 October 2026 until 3 October 2026, a copy of every log line was also written to the hosting server’s system journal and system log. Both delete old entries automatically: under the server’s current settings, the last of those copies will be deleted by 3 February 2027. Error messages from the web server, which are rare and can include the IP address of the request that caused them, also go to the system journal and system log, and under the server’s current settings are deleted from them automatically within about 4 months.

The log is also used to count requests from search-engine and other crawlers, by crawler name and page, to check that they can reach getmotrix.com. Only those totals are kept; they contain no IP addresses, and requests from people’s browsers are not counted. A status check also reads this log to count server errors and measure response times. It keeps only those figures: no IP addresses, browsers or addresses requested.

Cloudflare’s own logs follow Cloudflare’s policy.

The app at app.getmotrix.com has no analytics or advertising. Without an account it keeps your preferences, saved and recently opened vehicles, recently opened documents, recent searches and procedure progress in your browser’s local storage only. It also sets a few small functional cookies (page layout, navigation rail, how you identified an example vehicle), which your browser sends with each request so that the app’s server can render the page you asked for.

What you type into the finder or search (a plate, a VIN or a query) becomes part of the address requested, so it is part of the request data described above. Use the app’s fictional plates and VINs.

A real Dutch plate is looked up only when you are signed in: it travels in the body of the request, not in the address, to the open data service of the Dutch vehicle registration authority, the answer is kept in the server’s memory for up to an hour, and Motrix writes only a salted hash of the plate to its own logs.

Accounts are by invitation only: there is no public sign-up. An account holds your display name, the public key of each passkey you add with its name, when it was added and last used and whether it is synced, the hashes of your ten recovery codes (the codes are shown once and never stored), your language, region, time zone and unit settings, the vehicles you choose to save to your account (an example vehicle, and a plate and a nickname if you add them), the versions of these terms and this notice that you accepted and whether you ticked the optional box for news by email (Motrix sends no email today, so the choice is only recorded), and a record of security events, such as signing in, signing out and using a recovery code. There is no password, and Motrix asks for no email address and no phone number for an account. The invitation of a workshop’s owner holds a label that Motrix typed to recognise it, such as the workshop’s name and never an email address, the keyed hash of its link, its dates and whether it was used. If Motrix grants your account a plan, that is recorded with a last day and the reason Motrix gave.

Sessions are kept on the Motrix server, not sent to anyone else: a session holds a keyed hash of its token, when it started and was last used, a short description of your browser and device, such as “Safari on iPhone”, and how you signed in. A session stops working after 30 days without use, or after 90 days at most. The cookie that holds it is called __Host-motrix-sid and is HttpOnly and Secure. The counters that limit failed attempts and the security log keep a keyed hash of your IP address, never the address itself. Every night the server deletes sessions that ended more than a day ago, expired sign-in challenges and failed-attempt counters whose time has passed; the record of security events stays.

A workshop that Motrix has invited can create an organisation and keep its own records in it. These are the records the workshop chooses to enter: its profile (names, registration and tax numbers, address, phone and email), its members (display name, roles, the seat a member holds, and the contact details and hours the workshop records for a member), its invitations (a label, the roles and the days the link works, with only a keyed hash of the link), its customers and companies (names, email, phone, postal address, language, contact preferences and whether the customer agreed to reminders, notes), their vehicles (licence plate, VIN, make and model, odometer readings, the registration facts read for the plate, notes), and the work done on them: work orders, tasks, time worked, appointments, inspections and their photos, parts, estimates and the customers’ answers, invoices, payments, credit notes, documents, imports, exports, maintenance rules and items and an audit log of who changed what.

Motrix sends no email for a workshop: when staff prepare a message for a customer they copy or print it, and the record keeps only which template was used, for which customer and vehicle, when and by whom, never the text. Photos are re-encoded, and their location and camera data are dropped, before they are stored. Records are kept apart for each organisation: a person sees an organisation’s records only as a member of it, and only what their role allows. A customer who opens an approval link sees only the estimate that link names.

When a workshop looks up a Dutch licence plate, Motrix sends that plate to the open data service of the Dutch vehicle registration authority, keeps the registration facts it returns with the vehicle, and keeps only a salted hash of the plate in its own logs. A plan, seats or module access that Motrix grants a workshop is recorded with a last day and the reason Motrix gave.

The records of accounts and organisations are stored as an append-only log of events. The primary copy is in Google Drive, in a Google account that Motrix uses for this purpose, and Google keeps those files under its own terms, in its own data centres, which can be in the European Union or the United States.

A copy that the app reads from, which can be rebuilt from the log, is kept on the Motrix server, and so are sessions and the sign-in counters, which are not sent to Google. Every night the app also copies the whole log to a backup folder on the Motrix server and to a separate backup folder in the same Google account, and each keeps the last 14 days of copies; older copies in the Google account are moved to its bin.

The app never edits or deletes a stored event: a change is a new event on top of it. It does not yet delete personal data on request.

Without an account you can clear the app’s browser storage and cookies at any time in your browser’s settings. Request logs are kept as described above.

With an account you can see your sessions and end any of them, add and remove passkeys, and make new recovery codes in the app.

You also have the rights the law gives you over your personal data, such as access, correction and deletion. You can change your display name and settings in the app, and a workshop can correct and export its customers and vehicles. The app cannot yet delete personal data or export everything held about one person on request, and this notice does not yet give a contact to write to: both will be added with the data controller’s details.

getmotrix.com is served over HTTPS only, with HTTP Strict Transport Security. Its pages load nothing from other sites and run under a strict Content Security Policy that allows only this site’s own scripts, styles, fonts and images. This website has no forms and no sign-in, so it holds no passwords or personal profiles. Accounts exist only in the Motrix app, by invitation only, as described above.