EU AI Act: How MousePlayer Uses Artificial Intelligence

1. What this page is for

The Artificial Intelligence Act (Regulation (EU) 2024/1689, "AI Act") entered into force on 1 August 2024. Its prohibitions apply since 2 February 2025, the obligations for general-purpose AI models since 2 August 2025, and the transparency obligations of Article 50 since 2 August 2026. This page explains, in plain language, where MousePlayer uses AI, which role we play under the Regulation, and which obligations follow from that. It is part of our legal documentation alongside the Privacy Policy, the Data Processing Agreement and the Records of Processing Activities.

2. Where MousePlayer uses AI - and where it does not

2.1 Not AI

• Session replay, heatmaps, live view, funnels, goals, segments. Recorded events are stored and rendered. Nothing is inferred.
• Engagement and value scores. Small whole numbers built from countable rules (duration, pages, scroll depth, rage clicks, reached goals). The rules are documented in the product and can be recalculated by hand.
• Frustration signals and friction score. Rage clicks, dead clicks, thrashing, JavaScript errors and similar signals are detected by fixed rules and thresholds, not by a learned model. A session's friction score is a weighted sum of these signals using fixed point values.
• Sequence patterns and anomalies. Frequent page sequences are counted; anomalies result from a statistical comparison of one day with the weeks before it (median and spread). Both are calculations over aggregated figures, not a learned model.

2.2 Statistical models (machine learning)

• Behavioural profiles. Visits are grouped by similarity of measurable behaviour (k-means clustering). A profile describes a group of visits, never a person. Names of groups are derived from which measured value deviates most from the average.
• Exit-intent prediction. A logistic regression trained on the past sessions of the same project estimates, from the first seconds of a visit, how likely an early exit is. The output is a probability with the factors that drove it. The trained model is evaluated in the visitor's browser; only the model weights are sent there.
• Churn indicator. For returning visitors, a score built from fixed rules over their own earlier visits (declining engagement, repeated short visits, friction in the latest visits, an overdue return). It is not a learned model and states its reasons.

2.3 Generative AI (language model)

A general-purpose language model is used in four places: (1) for short sentences about a visitor or a visitor group, (2) for longer visitor reports and their translation into further languages, (3) for suggestions for the wording of the exit offer, derived from the titles, headings and navigation of the project's recorded pages, and (4) in MousePlayer's support inbox, where it translates customer messages and writes draft replies that a person reviews before anything is sent. In cases 1 to 3 the model receives computed findings, not the raw recording, and must not add numbers, invent facts or attribute emotions. A guard compares every generated text against the input: texts that add figures, use the first person, invert a statement or, in offer suggestions, link to a page that was never recorded are rejected, and the computed template - or no suggestion - is shown instead. Generated text is labelled as such in the interface.

3. Our role under the Regulation

For the statistical models and the summary feature, MousePlayer is the provider of the AI system in the sense of Article 3(3): we develop them and operate them under our own name. Our customers are deployers (Article 3(4)) when they use these features in their projects. The language model we run is an open-weight general-purpose AI model of a third party; the obligations for the model itself (Article 53) rest with its provider. We do not train or modify that model. It runs on our own machines with graphics cards, located in the same local network and at the same site as MousePlayer's other servers - no visitor data or support message is sent to an external AI service, not even as a fallback when those machines are unavailable; in that case the computed template remains.

Risk classification. In our assessment, none of our AI features falls into the high-risk areas of Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice) or into Annex I. They are analytical aids for website operators. We therefore do not classify them as high-risk systems and review this classification whenever a feature is added or changed.

Prohibited practices (Article 5). MousePlayer does not perform emotion recognition, biometric categorisation, social scoring or predictive policing, and does not use subliminal or manipulative techniques. Our models measure clicks, scrolling and timing. They do not infer a person's emotional state - the instructions given to the language model expressly forbid it to attribute emotions or intentions.

4. Transparency (Article 50)

• There is no chatbot and no dialogue with visitors to your website. The only output that reaches a visitor at all is the overlay described in section 5: whether it appears is the operator's decision, and a statistical model or the rule-based churn indicator determines to which visitor and at what moment it is shown. Its wording may have been suggested by a language model; such a suggestion never goes live by itself, but only once the operator has reviewed and expressly adopted it, and he can change it beforehand. The text shown is therefore a text released by and under the responsibility of the operator. In our assessment no labelling duty under Article 50 follows from this; operators who want a label can include it in the offer text.
• All other language-model texts are shown only in the website operator's account and are marked there as generated; where a text is derived from computed findings, those findings are shown next to it. The support drafts are seen only by our staff, who review and adapt them before sending. In our assessment, the texts about visitors merely put already computed findings into words without substantially altering their content; we will review this classification under Article 50(2) once the European Commission publishes guidelines or a code of practice on it.
• We do not produce images, audio or video, and no deepfakes.

5. Human oversight and automated decisions

MousePlayer's AI outputs are information for people. No feature takes a decision with legal or similarly significant effect on a visitor. The exit-intent and churn signals can, if the operator enables it, trigger a message or an offer on the operator's website; whether, when and with what content this happens is decided and configured by the operator, who remains the controller for that use. We ask operators to keep such messages honest, clearly dismissible and free of pressure - the same standard that the Regulation's prohibitions and consumer law set.

Whether automated decision-making within the meaning of Article 22 GDPR occurs has been assessed for every feature and is documented in the Records of Processing Activities. The answer is no: the outputs are informational and do not produce legal effects.

6. Data used by the models

• Models are trained and evaluated per project, only on that project's own pseudonymous behavioural data. There is no model trained across customers.
• What a visitor TYPES reaches no model: input is masked in the browser according to the project's masking level, passwords and payment data always, and the findings contain no field values, only field types and the fact that something was entered. What your website itself OUTPUTS is a different matter and the limit of this promise – the summary report takes in the titles of the pages visited, the labels of the elements clicked and the paths visited (without the query string), and the offer-text suggestions take in the titles, headings and navigation of the recorded pages. If your page displays a name there, or writes one into the path of the address, it will appear among the findings. We do not strip it out, because a name cannot be told apart from a product designation by machine; where you want to avoid that, keep names out of page titles, labels and URLs.
• Model outputs have their own retention periods: sentences about visitors are deleted after 60 days (for Enterprise projects the retention of the plan applies instead), visitor reports after 180 days and the assignment of sessions to behavioural profiles after 180 days (details in the Privacy Policy); at the latest they are deleted with the final deletion of the project. Translations and draft replies in support are deleted together with the support request concerned.
• Visitors can exercise access and erasure as described under Access and Erasure. Erasure removes the visitor's data from the training basis with the next scheduled run.

7. Quality, logging and AI literacy

• Every learned model reports its own quality (for example the separation quality of profiles or the accuracy of the exit model on held-out data), and the interface says when a result is not reliable enough to act on.
• The exit model carries its version, its training date and its quality figure with it. Where the quality falls below our threshold it is marked unusable and is not used at all – it does not reach the browser, and no prompt based on it appears. Above the threshold the latest run replaces the previous one; we do not keep a version history. For behavioural profiles the interface shows a notice when the groups are only weakly separated.
• In line with Article 4, we ensure that the people who build and operate these features at MousePlayer are familiar with how the models work, their limits and the obligations of the Regulation. As a deployer, you have the same obligation for the people who work with MousePlayer's AI outputs on your behalf.

8. Changes and contact

We update this page whenever an AI feature is added, changed or removed. Questions and concerns about our use of AI go to office@mouseplayer.com. Complaints follow the procedure described under Complaints.

Operator: LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland.