Data Processing Agreement (DPA)

1. Definitions

• "Controller" means the natural or legal person (the Customer / Website Owner) who determines the purposes and means of the processing of Personal Data.
• "Processor" means MousePlayer, processing Personal Data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person (End-User) processed by the Processor on behalf of the Controller.
• "End-User" means a visitor to the Controller's website whose interactions are recorded by MousePlayer.
• "Sub-processor" means any further third party engaged by the Processor to process Personal Data on behalf of the Controller.

2. Roles and Scope of Processing

MousePlayer provides real-time session recording, heatmaps and analytics infrastructure. In providing these services MousePlayer processes data exclusively on behalf of and on documented instructions from the Controller.

3. Obligations of the Controller

• Obtaining lawful consent: the Controller is responsible for securing valid, informed consent from End-Users before the MousePlayer script is initialised, in accordance with the ePrivacy Directive and the GDPR. MousePlayer reads the consent signal; it does not obtain the consent.
• Prohibition of special categories: the Controller must not transmit special categories of personal data (including health data, credit card numbers, passwords or government identifiers) to MousePlayer.
• Transparency: the Controller must disclose the use of session recording in its own privacy policy.
• Lawful basis: the Controller warrants that all Personal Data transferred to MousePlayer has been collected lawfully.
• Marking sensitive areas: the Controller is responsible for identifying regions of its site that display personal data and marking them with data-mp-mask or the class mp-masked, and for excluding paths that must not be recorded at all. See section 4 on the limits of automatic masking.

4. Obligations of the Processor

• Instructions: MousePlayer processes Personal Data only on documented instructions from the Controller, unless required otherwise by Union or Member State law; in such a case MousePlayer informs the Controller of that legal requirement before processing, unless that law prohibits such information. Instructions are this agreement, the settings the Controller makes in its project and instructions in text form to office@mouseplayer.com. Where MousePlayer considers that an instruction infringes data protection law, it informs the Controller without undue delay (Art. 28(3), second subparagraph, GDPR).
• Confidentiality: persons authorised to process the data are bound to confidentiality or are under an appropriate statutory obligation of confidentiality.
• No processing before consent: the script assigns no identifier, sets no cookie, stores nothing and opens no connection until a consent signal is present. A missing signal is treated as refusal, except in a region the Controller has expressly released under section 11.3 of the Terms of Service; regions where consent is required by law, including the EU and the EEA, cannot be released. A Global Privacy Control signal overrides every other signal.
• IP masking: the full IP address is used in working memory for connection setup, country derivation and abuse defence. Where abuse defence blocks an address, it is held in a cache for the duration of the block, at most 24 hours. The web server logs, which record every request including the connections of the tracking script, contain the full address and are erased after 14 days. An End User’s address is written to the database only in masked form and is not displayed in the dashboard.
• URL redaction: values of parameters in the query and in the fragment of an address that commonly carry personal data or access credentials (for example ?email=, ?token=, ?code=, #access_token=) are redacted in the browser before the address is transmitted.
• Masking of form input – three levels: full masking replaces every character of every entry before it leaves the browser and is the default for every property. Selective masking keeps names, addresses, e-mail, telephone, payment fields and free-text areas fully masked and replaces only digits elsewhere. No masking records input as typed.
• The two weaker levels require written approval: MousePlayer enables them only for a named property, on the Controller's reasoned request, and records the approval with its time and grantor. The restriction is enforced on MousePlayer's servers: where a stored level exceeds the approval, it is reduced to the approval before the setting reaches the browser. Withdrawal of an approval takes effect on the next connection and returns the property to full masking.
• Two limits that no approval lifts: fields recognised as passwords or payment data stay fully masked on every level; and masking never extends to content the website itself renders into the page – a confirmation page that prints an address is part of the DOM snapshot and therefore part of the replay. Recognition reads the field's name, id, type and autocomplete attribute against a list covering English, German and Polish terms; a field matching nothing counts as an ordinary field. Regions marked data-mp-mask or mp-masked are excluded entirely. The Controller must not rely on automatic recognition alone.
• Assistance: MousePlayer assists the Controller in fulfilling End-User requests under Chapter III GDPR and in meeting its obligations under Art. 32 to 36 GDPR.
• Contact point, and no data protection officer: data protection matters under this agreement reach MousePlayer at office@mouseplayer.com. No data protection officer has been designated. The assessment under Art. 37(1)(b) GDPR is recorded, with its date and its reasoning, in section 9 of the Records of Processing: regular and systematic monitoring is met, large scale is not met on present figures. Because the second limb turns on the number of end users observed – a figure the Controller's own traffic determines, not MousePlayer – it is measured daily and the assessment is repeated above 100000 end users a month across all Controllers, and in any event annually. A designation, whether required or voluntary, is published in this agreement and notified to the supervisory authority.

5. Security of Processing

MousePlayer implements technical and organisational measures appropriate to the risk, including encryption in transit, logical separation of Customer workspaces on every read and write path, server-side enforcement of the role model, and automatic termination of unauthorised live viewer connections. All connections from the internet run exclusively over HTTPS or WSS: those of the tracking script – normally over WebSocket, over HTTP as a fallback where no WebSocket connection can be established, and as an HTTP upload for large page snapshots – as well as those to the application and the API. Encryption ends on MousePlayer’s own server. Within its own local network at the same site, connections to the database and to the cache run unencrypted; they are password-protected and cannot be reached from the internet.

The measures are described in full and kept up to date in the Technical and Organizational Measures, which form an integral part of this agreement.

6. Sub-processors

The Controller grants MousePlayer general written authorisation to engage sub-processors. The current list, with purpose, categories of data and place of processing, is published at Sub-processors.

Transmissions the controller switches on. MousePlayer offers bridges that send data to recipients the controller chooses themselves: to a webhook address they provide, to their customer relationship system, to their helpdesk or ticketing system, to their email and lifecycle marketing system, to their ad account with an advertising network (Conversions API), to their own object storage or spreadsheet, and to their issue and task tracking system. This list deliberately names categories rather than providers: which providers are available within a category changes with the feature set, and that changes nothing about who plays which role. What governs is what the controller has actually switched on in their project settings. These transmissions only take place if the controller switches the respective bridge on and stores their own credentials; that is the instruction they rest on. The recipients are not sub-processors of MousePlayer — the contractual relationship with them, including any safeguards for transfers to third countries, exists between the controller and the respective recipient. What exactly is transmitted is set out in the Record of Processing Activities, section 4. Transmission to Meta happens exclusively for sessions with consent given and exclusively for fulfilled goals; name, email address, phone number and IP address are excluded from it.

No third party takes part in the recording itself: the tracking script transmits exclusively to MousePlayer's own infrastructure. One recipient exists beyond that: a daily off-site copy of the complete database and of the recording archive — including session recordings — is stored with Google (Google Cloud Storage, bucket in Warsaw). It has been held there encrypted since 11 August 2026: encryption takes place on our own server before the transfer (rclone crypt) and covers file and directory names as well; the keys are held on our own server. Google does not receive them and cannot read the content, but remains a sub-processor — encryption is a technical measure, not a change of role. The previous, unencrypted target folder holding the copies from before 11 August 2026 was deleted on 12 August 2026.

MousePlayer informs the Controller 30 days before a new sub-processor begins processing or an existing one is replaced. Within that period the Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may terminate the affected service. Notification is given by e-mail and as a notice in the logged-in area; an objection is to be sent in text form to office@mouseplayer.com. MousePlayer binds each sub-processor by contract to data protection obligations under Art. 28(4) GDPR that provide sufficient guarantees of appropriate technical and organisational measures – for providers that offer only standard terms, their data processing terms – and remains fully liable to the Controller for their performance.

The former exception no longer exists. Until 5 September 2026 the off-site backup copy described above was held in a private Google account for which data processing terms are not available; this deviated from the sentence above and from Art. 28(4) GDPR, and version 1.3 of this agreement disclosed it openly. Since 5 September 2026 the copy has been held in Google Cloud Storage (region europe-central2, Warsaw) and is covered by the Google Cloud Data Processing Addendum; the copies previously held on the private account were deleted on 6 September 2026, after a restore from the new destination had been verified. Encryption before transfer remains in place. Generated texts are phrased by a language model on MousePlayer's own hardware; no external AI service is involved.

7. Data Subject Rights

MousePlayer assists the Controller, taking into account the nature of the processing, in responding to requests from End-Users. Deletion of an individual session and of all sessions of one visitor is available in the application to the owner and admin roles. In addition, an information page is available to End Users through which they can obtain information about their sessions and request their erasure, provided they hold their visitor identifier (section 14.4 of the Terms of Service). Requests that End Users address directly to MousePlayer are referred to the Controller, who is informed without undue delay.

One limitation is stated openly: because IP addresses are stored only in masked form, the masked address alone does not always identify every recording belonging to one person. The more precisely a request can be narrowed down (site, approximate time, page), the more completely it can be fulfilled.

Records of consent decisions are retained beyond the erasure of a recording. They contain no behavioural data, only the fact, time and source of the decision, and serve the accountability obligation under Art. 5(2) GDPR.

8. Personal Data Breach

In the event of a personal data breach affecting the Controller's data, MousePlayer notifies the Controller without undue delay and no later than 48 hours after becoming aware of it. The notification contains the information the Controller needs to meet its own obligations under Art. 33 and 34 GDPR.

Reporting address: office@mouseplayer.com

9. Retention and Erasure

Erasure is automatic and runs unattended:

• Free: 7 days · Small: 30 days · Business: 90 days · Enterprise: as agreed individually.
• After a downgrade a grace period of 30 days applies, and when a paid subscription ends one of at least 30 days; during that period the longer previous retention continues.
• Shorter periods apply: recordings of sessions identified as automated (bots) are cleared after one day and the sessions deleted after 14 days; for a free account classified as suspected of abuse at registration, recordings are deleted after 24 hours.
• Application access logs are erased after 60 days, web server logs after 14 days, security logs after 72 hours; expired or revoked share links are erased together with their view log 90 days after expiry or revocation.

At the end of the services MousePlayer returns or erases the data at the Controller’s choice: return takes place by the Controller retrieving its data through the exports under sections 24.1 and 24.1a of the Terms of Service before erasure; MousePlayer does not owe return in any other form. On termination of the Controller's account, MousePlayer erases all associated Personal Data within 30 days, unless Union or Member State law requires further storage. The deletion is started by the Customer in the account settings; no request by e-mail is required. It first archives the account: access ends at once, nothing is recorded or shown any more, and for 30 days we can still restore it on request in case the deletion was a mistake. After that period it is erased permanently; when starting the deletion, the Customer can also choose permanent erasure at once. A project or a workspace that the Customer deletes is likewise archived for 30 days first and can be restored in the dashboard during that time. An account on the free plan to which no one has signed in for 24 months is deleted under section 6.5 of the Terms of Service after a notification has been delivered; this deletion does not archive first. Three things are deliberately kept, because the law requires it or because they document a decision rather than a person: the record of acceptance of these documents, the security and change log (with the user reference removed), and support requests. A workspace can be transferred to another account instead of being deleted with it. The transfer only takes effect once the recipient has expressly accepted it; the invitation expires after three days. With the acceptance the recipient becomes the owner and thereby the Controller's contract partner for that workspace, and the recipient's plan applies from that moment — which may shorten the retention period of the recordings it contains.

Backups, stated with figures. An off-site copy is made daily and held encrypted; daily copies are kept for 7 days and weekly copies for 364 days. Personal Data erased in the live system remains inside those copies until they expire – at most 364 days after the erasure. This also applies to session recordings that are moved from the database to the recording archive after 7 days: the archive has been part of the backup since 6 October 2026, and the same maximum period applies to its contents.

Selective erasure inside a backup is not performed. A copy is a single sealed archive whose purpose is to be a faithful image of one point in time; opening it, removing something and sealing it again would destroy that property and the ability to show that nobody tampered with it. Backups serve no purpose other than restoring the system after a loss – they are not searched, not analysed and not disclosed. Where a backup is restored, the erasure requests recorded for End Users are executed again before the system returns to service; the record of those requests is kept for that purpose and holds nothing beyond what repeating the erasure requires. For a deleted Controller account the position differs and is stated rather than glossed over: its deletion deliberately leaves no record identifying it, so a restored copy would contain an account deleted after the date of that copy. A restore follows only a total loss; where it happens MousePlayer says so.

10. Audits, Term, Governing Language

• Audits. MousePlayer makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it; the scope, form and frequency of audits are governed by the following sentences. The audit is carried out primarily by making available reports on the technical and organizational measures or by way of written questionnaires. The Controller may request an on-site audit (an inspection within the meaning of this section) only where there is a concrete suspicion of a breach of data protection obligations; the Controller must announce it at least 30 days in advance in text form. The Controller may request only one on-site audit per calendar year under the preceding sentence; that audit is free of charge. Where a personal data breach within the meaning of section 8 has affected data of the Controller and that breach was caused intentionally or negligently by MousePlayer, by its employees, by the persons it uses to perform its obligations under this agreement or by its sub-processors, the Controller may request an on-site audit, whether or not an on-site audit has already taken place in the calendar year concerned; the Controller must request that audit within three months of the notification under section 8. Each such personal data breach gives rise to one on-site audit under the preceding sentence; once that audit has been carried out, or once the three-month period has expired without such a request having been made, the same breach can no longer be relied on for another on-site audit. An on-site audit under the two preceding sentences is free of charge in every case; where no on-site audit has yet taken place in the calendar year concerned, it counts as the on-site audit for that calendar year, and no further on-site audit arises from that counting. Together with the notification under section 8, MousePlayer provides the Controller with the documentation of that personal data breach, so that the Controller can assess whether these conditions are met. Only on-site audits are counted towards the one audit per calendar year referred to above; reports and written questionnaires are not counted. No on-site audit takes place other than in the cases described in the preceding sentences. The Controller bears the costs of an audit only where that audit is permitted under the preceding sentences and is not free of charge under them, and only in so far as it exceeds the customary and reasonable effort. An independent report on the technical and organizational measures, a certificate or detailed self-assessments are accepted as evidence, in so far as such evidence exists; the status of external audits and security certifications is stated in section 6 of the Technical and Organizational Measures. The purpose of these provisions is to keep on-site audits to the necessary minimum. Mandatory statutory audit rights of the Controller under Art. 28(3)(h) GDPR and the powers of the supervisory authorities remain unaffected.
• Term. This agreement takes effect when the Controller begins using the service and remains in force for as long as MousePlayer processes Personal Data on the Controller's behalf.
• Related documents. Technical and Organizational Measures, Sub-processors, Privacy Policy.
• Version: 1.6 · Effective: 16 October 2026 · replaces version 1.5 of 7 October 2026. Changed: section 2 lists the categories of data processed in full; section 4 states that a blocked address is held in a cache for at most the configured block duration and that values in the fragment of an address are redacted as well; section 5 describes the transport paths accurately, including the unencrypted connections within the own local network; sections 6 and 9 state that the recording archive has been part of the backup since 6 October 2026; section 9 states the shorter periods for bot sessions and accounts suspected of abuse, the grace period after a subscription ends and the deletion of unused accounts on the free plan. Also part of this version: section 2 names the subject matter and purpose, the types of personal data and the persons who open a share link; section 4 names the information given before processing required by law, the form of instructions, the notice of unlawful instructions, regional release, the web server logs and the configured block duration; section 6 describes how sub-processors are bound by contract and the form of notification and objection, and no longer says that the keys are held solely on our server; section 7 names the information page for End Users and the handling of requests addressed directly to us; section 9 names return or erasure at the Controller’s choice, the grace periods, the web server logs and the erasure of share links. Version 1.5 replaced version 1.4 of 17 September 2026. Changed: section 9 – a deletion started by the Customer first archives the account, and the projects or workspaces it deletes, for 30 days before they are erased permanently; the Customer can choose permanent erasure at once. Version 1.4 replaced version 1.3 of 19 August 2026. Changed: section 6 – the exception for the off-site backup has lapsed, because since 5 September 2026 the copy is held in Google Cloud Storage in Warsaw under the Google Cloud Data Processing Addendum; plus the sentence that generated texts are phrased on own hardware. Version 1.3 replaced version 1.2 of 11 August 2026. Changed: section 4 gains a contact point and the Art. 37 assessment; section 6 names the sub-processor that operates without an Art. 28 agreement, which the previous wording did not disclose; section 9 states the backup retention with figures and what happens on a restore.
• Governing language. In case of divergence between language versions, the English version prevails.