Privacy policy

The data controller is MOTEX CHILE SpA, Chilean tax ID (RUT) 78.344.932-3, a stock corporation (SpA) incorporated in Chile, legally represented by Cristian Richard.

Motex acts in two distinct capacities with respect to personal data, and this is the most important distinction in this policy:

• As data controller, for the data of people who visit the site, write in through the contact form, or hold an account on the platform. Here Motex decides what those data are used for.
• As tercero mandatario o encargado ("third-party processor," the term used by Chilean law) — for the data contained in the court case files that each client organization uploads or consults through the platform. In that case, Motex processes the data on the client’s behalf and following its instructions; it is the client who decides on that data.

Chile is currently governed by Ley N.º 19.628 (Law on the Protection of Private Life), in its full text, in force since 1999. Ley N.º 21.719 (the Personal Data Protection Law, which creates the Data Protection Agency and replaces most of the provisions of Ley N.º 19.628) has already been published in the Official Gazette — on December 13, 2024 — but is not yet in force: its own text sets its effective date for December 1, 2026 (Article primero transitorio).

This policy is drafted to comply with the law in force today while also being ready for the new framework. Wherever the text describes a right, an obligation, or an authority that only exists as of December 1, 2026, it says so expressly. Nothing described as currently in force is enforceable under the new regime before that date, and nothing described as applicable from that date is enforceable today.

MOTEX CHILE SpA is a company incorporated in Chile. Chilean personal data protection law applies directly to its processing, under the general territorial criterion, without needing to rely on the extraterritorial application rules that Ley N.º 21.719 reserves, from December 1, 2026, for controllers with no domicile in the country (Article 1 bis, letter c, new).

The same applies under Ley N.º 19.628 in force today: as a Chilean company, Motex is subject to Chilean data protection law without any special rule of territorial extension being necessary.

Contact data

Name, company or firm, email address, and the content of the message sent through the form.

Account data

User identification, the organization they belong to, role, and platform access logs.

Case file content

Court documents and their associated data: parties, representatives, RUT, matters, amounts, deadlines, and hearings. Part of this comes from what the Judiciary publishes and part is uploaded by the client itself. Motex processes this data as the client’s tercero mandatario o encargado, not as controller (see section 1).

Text of analyzed filings

Writ analysis retains the text extracted from the document, not the original PDF file.

Credentials for court services

When a lawyer registers their password to access restricted cases, the password is not stored on the platform: it is sent once to an encrypted vault, and only an opaque reference is kept.

Technical data

Activity and error logs generated by use of the site and the application.

Data is processed to:

1. 1.Provide the contracted service: assemble each case’s file, classify it, calculate deadlines, and show the status of the portfolio.
2. 2.Respond to commercial inquiries received through the contact form.
3. 3.Administer accounts, access, and permissions within each organization.
4. 4.Maintain service security, prevent misuse, and audit access.
5. 5.Comply with legal obligations and respond to requests from authorities.

Client data is never used to train third-party models.

For data from court cases specifically, the basis invoked is assisting the client — or its lawyer — in exercising its right of action or defense, in cases that concern it. The development of this basis and the caveat pending legal validation that applies to it are in section 7.

Under Ley N.º 19.628, this processing is based on performance of the service contract, on the consent of whoever writes in through the form, and on compliance with legal obligations. From December 1, 2026, Ley N.º 21.719 expands the menu of lawful bases — among them, the controller’s legitimate interest — and requires declaring, for each purpose, which of those bases is invoked. That detailed declaration by purpose will be completed before that date.

To operate, Motex relies on providers that process data on its behalf and under its instructions — what Chilean law, from December 1, 2026, calls "terceros mandatarios o encargados." The categories of providers are:

• Cloud infrastructure and document storage.
• Text recognition in documents, to read scanned filings that lack a text layer.
• Language models, used to classify documents and answer queries about the portfolio.
• Site usage analytics.
• Meeting scheduling.
• Email.

The named list of providers, with their commercial name and country of operation, is available to anyone who requests it by writing to the email address in section 16.

Motex collaborates with its clients and uses public information for that purpose. Processing of the data contained in court case files is based on assisting the client — or its lawyer — in legitimately exercising its right to sue or to defend itself, in cases that concern it. The purpose is not to exploit judicial data for its own sake: it is instrumental to that right of action or defense.

The information processed is public. Court proceedings are public, except for the exceptions the law expressly establishes (Código Orgánico de Tribunales — Judicial Organization Code —, Article 9).

The content of a court case file may include, depending on the case, data about the parties, matters, rulings, and convictions. The legal definition of "sensitive data" set out in Ley N.º 21.719 — ethnic or racial origin, political, union, or trade affiliation, socioeconomic status, convictions, religious beliefs, health, biometric data, sex life, sexual orientation, and gender identity (Article 2, letter g, new) — does not mention, in its literal text, data on judicial proceedings, convictions, or infractions as a separate category. This is a point Motex treats with caution and not as settled: the reading that this data is not "sensitive" on its own is an interpretation still pending validation with legal advice, not a certainty, and in any case a labor or family case file may also reveal some of the data that is listed in the legal definition.

Separately, the Judiciary’s own electronic case-management system has its own rules on the processing of the personal data it contains: Ley N.º 20.886 (Electronic Judicial Case-Management Law) subjects that processing to specific conditions, including an express prohibition on mass processing of that data without prior authorization (Article 2, letter c). Motex’s position is that its processing falls within the purpose described above — assisting the client in exercising its right of action or defense. This framing is Motex’s own criterion and is pending legal validation before this policy’s final publication.

Motex offers a connector based on the MCP protocol (Model Context Protocol), at https://legal.motex.ai/api/mcp. It lets an artificial intelligence assistant chosen by the user — for example Claude, ChatGPT, or Gemini — query the information of the user’s organization in Motex and, with the user’s confirmation, modify it. The assistant is operated by a third party the user chooses, and is governed by that third party’s terms and privacy policy. This section describes only what happens on Motex’s side.

Identity and authorization

The user authorizes the assistant through OAuth 2.1. The authorization server is Supabase Auth: it issues and manages the access tokens, and Motex validates them against it on every request. Motex does not receive the password of the Google account the user signs in with. If the person had no account, one is created with the email address and profile data Google provides, together with a personal workspace on the free plan. If the person is already a user of a client organization, the assistant accesses that organization with the same permissions the person has in it.

What Motex receives

Only the calls the assistant makes to the connector’s tools: the tool name, its arguments — for example, a RIT and a court, or the text of a task — and technical request data, such as the client making it and the protocol version. Motex does not receive the user’s conversation with their assistant or its history, and does not store them.

What Motex returns

The response to each call — case data, case-file documents, tasks — is delivered to the assistant, that is, to the provider the user chose. From that moment on, its processing is subject to that provider’s terms. The connector only returns information from the organization the authorizing user belongs to.

Data the user creates or modifies

Registered cases, tasks, calendar events, and filings created through the connector remain on the platform just as if they had been created from the application, and follow the retention periods in section 10. In a free-plan personal workspace, which has no contract, they are kept while the account exists or until the user requests deletion.

Record of document-reading spend

Each time the connector transcribes a scanned document, Motex records an entry with the organization, the user who requested it, the amount in US dollars, the concept, the date, and a technical fingerprint of the request that prevents counting it twice. It is used to enforce the plan’s monthly allowance. It does not store the content of the document or of the request. It is kept while the organization exists and is deleted with it.

Usage analytics

Each use of the connector generates an event in PostHog with the tool and capability used, the user’s identifier, the organization’s identifier and name, the AI client and its version, and whether there was an error. Only when the assistant is missing a capability does the event include the phrase it uses to describe what was asked; in every other call that phrase is not sent, because the assistant writes it from the conversation. Before sending, the call’s arguments and the response are removed: the RIT, the text of a task, and the content of a document are not sent. The purpose is to measure connector usage.

Technical logs

Each request leaves a technical log with the application’s hosting provider, with the method, access level, organization, the client making it, and its user agent. It does not include the content of the call or the access token.

Providers involved

Supabase (authentication and database), Vercel (application hosting and technical logs), PostHog (usage analytics), Amazon Web Services (document storage and, through Amazon Bedrock, reading scanned documents with a language model), and Google (sign-in). If someone tries to connect with the email address of a client firm in which they are not enabled, that email address is shared with the Motex team through its internal messaging tool (Slack) to resolve access. The Judiciary is the public source of the cases that are registered; Motex queries it for the case by RIT and court, not for user data. What sections 6 and 9 say about providers and international transfers also applies to these transmissions.

How to withdraw access

The user can withdraw access at any time by removing the connector in their assistant’s settings. Whoever uses a personal connector URL can regenerate it from Motex, which immediately invalidates the previous one. To revoke an authorization from Motex, or to request deletion of the account and its data, write to the email address in section 16.

Information that passes through the connector follows the rule in section 5: it is not used to train third-party models.

MOTEX CHILE SpA is a Chilean company, but part of the personal data it processes does leave Chile: it is sent to providers established abroad, within the categories described in section 6 — cloud infrastructure, document text recognition, language models, and usage analytics. Each of those transmissions is an international transfer of personal data.

The text of Ley N.º 19.628 in force today sets no specific regime for these transfers. From December 1, 2026, Ley N.º 21.719 requires international transfers of personal data to have adequate safeguards when the destination country does not have a level of protection declared adequate by the Agency — for example, standard contractual clauses or another recognized instrument. Motex is reviewing, together with its providers, which instrument corresponds to each transfer before that date.

The law requires that data be kept only for as long as necessary to fulfill the purpose of the processing. On that basis, Motex’s criterion distinguishes three types of data:

Client case-file documents and data

Kept for as long as the contract with the client organization lasts. At the end of the contract, the client has 30 calendar days to export its information. Once that period has elapsed, it is deleted.

User account data

Identification, organization, role, and permissions of the user. Kept for as long as the account is active and, when the organization’s contract ends, the same 30-calendar-day period applies before deletion.

Technical usage logs

Activity and error logs generated by use of the site and the application. Kept for as long as the contract of the organization they belong to lasts and, upon its end, deleted following the same 30-calendar-day period.

In all three cases, deletion may be postponed when a legal obligation exists to retain the data longer.

Today, under Ley N.º 19.628, any person may request, free of charge and regarding their own personal data:

• Access. Know what data of theirs is processed and for what purpose.
• Rectification. Correct inaccurate or incomplete data.
• Cancellation or deletion. Request that data be suppressed where appropriate.
• Blocking. Request the temporary suspension of processing.

From December 1, 2026, Ley N.º 21.719 expands this catalog to six rights: access, rectification, erasure, objection, portability, and blocking, with a 30-calendar-day response period, extendable once by another 30 days.

Requests are sent to the contact listed in section 16, with identity verification. When the data appears in a client organization’s case file, the request is forwarded to that organization, since it is the one that decides on its information as controller of that processing.

The platform is built on four security commitments:

Per-organization isolation

Each organization operates in a sealed, independent environment. One organization’s case files and data are never mixed with another’s.

No model training

Client information is never used to train third-party models.

Encryption in transit and at rest

Data is encrypted from the first document to the last record.

Client control

Every record belongs to the client. It can be exported or deleted whenever required.

From December 1, 2026, Ley N.º 21.719 requires reporting to the Agency, by the most expeditious means possible and without undue delay, any security breach that causes destruction, leakage, loss, or alteration of personal data, or unauthorized access, whenever there is a reasonable risk to data subjects. The law sets no numerical time limit for that report — there is no "72-hour" rule in the legal text — it uses the open-ended formula "without undue delay." If the breach affects sensitive data, data of children under 14, or economic, financial, or commercial data, the law also requires notifying the affected data subjects directly.

Ley N.º 21.719 leaves the appointment of a data protection officer as a voluntary feature within an infraction-prevention model that a company may adopt (Articles 49 and 50, new). Motex does not appoint an officer: privacy inquiries and requests are handled directly at the email address in section 16, cristian@motex.ai.

Ley N.º 21.719 requires, from its effective date, that every legal entity not incorporated in Chile that processes the data of people residing in the country designate and keep up to date, before the Agency, an email address or other equivalent electronic means of communication, so that data subjects can exercise their rights and receive communications from the Agency (Articles 10 and 14, new).

MOTEX CHILE SpA is a company incorporated in Chile, so this specific requirement does not apply to it. The channel for exercising rights and for any communication with Motex is, directly, the email address in section 16.

This policy may be updated when the service, the applicable regulation — in particular, with Ley N.º 21.719 taking effect on December 1, 2026 — or the providers change. The date of the last update appears at the top of the document. Relevant changes are communicated to clients through the usual channels.

Questions about this policy and requests to exercise rights:

Email

cristian@motex.ai

Controller

MOTEX CHILE SpA — RUT 78.344.932-3, legally represented by Cristian Richard.

You can also write in from the contact page.