Privacy Policy Text for Your Website
A ready-worded section you can paste into your own privacy policy — twice, short and detailed. Below it: what you have to fill in, and the five places where the text stops being true once you change a setting.
Last updated: 16 October 2026
Before you use the text
This is not legal advice. The text describes what MousePlayer actually does — not what is legally sufficient in your case. For your website you are the controller; the completeness and accuracy of your privacy policy are yours to answer for. Have the text reviewed before you publish it.
Three things the text assumes:
- You obtain consent before recording starts. How to do that is described under MousePlayer and Consent. Without valid consent, no wording helps.
- You have accepted the Data Processing Agreement. It is concluded on registration and is available under DPA.
- Your settings match the defaults. If they do not, the text becomes wrong or incomplete in particular places — which five is explained further down.
The short version
For privacy policies that give each service one paragraph. The parts marked in yellow are yours to replace.
The detailed version
For privacy policies that list data categories, purposes and recipients separately — and for industries where people look more closely.
What you have to fill in
The parts marked in yellow. The retention period depends on your plan — it is also shown in your project under Settings.
| Placeholder | What belongs there |
|---|---|
[HOW TO WITHDRAW] | How your visitors take their consent back. With a consent tool that is its settings dialog — name the link or the button, for example "via the Cookie settings link in the footer". |
[RETENTION] | The retention period of your plan: Free 7, Small 30, Business 90 days. Enterprise as agreed with you. Do not state more than your plan actually provides. |
[YOUR CONTACT DETAILS] | Your own address or e-mail for privacy matters — not ours. For your visitors' data you are the controller and the first point of contact. |
[RECIPIENTS] | The interfaces you have switched on in your project – webhooks, BigQuery export, CRM, e-mail marketing, help desk, advertising networks, object storage or spreadsheets – each with the name of the provider. If you use none, delete the sentence. A BigQuery export can, on request, contain the individual events of the recording; if so, say this explicitly. |
| The heading | Adapt it to the structure of your privacy policy. The name of the service should appear in it so that a visitor can find it again. |
Five places where the text stops being true
The text describes the default settings. Change one of them and a correct sentence becomes a false promise — one that is then published on your website.
1. If you weaken the masking
The sentence "Every character of every form input is replaced" holds for full masking, which is the default. There are two weaker levels, and both require our written approval for your specific website. If you have one, replace the paragraph:
Selective masking: "Input into name, address, e-mail, telephone, payment and free-text fields is fully obscured. In other fields the digits are replaced and the remaining text is recorded." — No masking: "Your form input is recorded as you enter it. Password and payment fields are excluded."
2. If you exclude areas or paths
Excluding paths from recording or marking areas with data-mp-mask does not make the text wrong — but it does make it incomplete in your own favour. A sentence such as "The checkout and the customer area are not recorded" is a promise you keep and one that reassures your visitors. It is worth mentioning.
3. If you export data
Webhooks, BigQuery export and the other interfaces (CRM, e-mail marketing, help desk, advertising networks, object storage, spreadsheets) are set up by you, running with your credentials into systems you have chosen. MousePlayer does not know the recipient, which is why the detailed version contains the placeholder [RECIPIENTS]. If you use an interface, the destination belongs in your privacy policy — and, depending on where it goes, in your record of processing activities as well.
4. If you switch on exit prediction or an offer
Every visit is then scored in its first seconds, and an overlay on your page may follow from the result. Both belong in your privacy policy, because both go beyond plain recording: the scoring as profiling within the meaning of Art. 4(4) GDPR, the overlay as a measure the visitor actually sees. State the purpose, say that no decision with legal effect follows from it, and add the two storage keys mp_seen_before and mp_offer_* from the table below. For that overlay you are the controller — the wording, the threshold and whether it appears at all are yours.
5. If you switch on a survey
Then a question appears on your site, and the answer is stored together with the recording of the visit. This belongs in your privacy notice: name the purpose, say that answering is voluntary and that the answer is attached to the visit, and — if you ask a follow-up with free text — that the text is cleaned of e-mail addresses, IP addresses and longer digit sequences such as phone numbers before it is sent. Add the storage key mp_umfrage from the table below. You are the controller for the question and the follow-up; do not ask anything aimed at health, origin or another special category of personal data.
For your cookie and storage table
MousePlayer sets no cookies on your website. If you maintain a cookie table, the entries below belong under "local storage" — they are created only after consent and are removed on withdrawal, provided the script is running on the page at that moment.
| Key | Storage | Purpose | Duration |
|---|---|---|---|
mp_visitor_id | localStorage | Random identifier that makes repeat visits from the same browser distinguishable | Until withdrawal or until browser data is cleared |
mp_session_data | localStorage | Identifier of the current visit including its origin, so that multi-page journeys are held together | 30 minutes without activity |
mp_pv_count_* | localStorage | Counts the page views within one visit | Same as the session |
mp_tab_id | sessionStorage | Distinguishes several open tabs of the same session | Until the tab is closed |
mp_design_sent | sessionStorage | Remembers that this page's colours and font have already been measured in the tab; contains no information about the visitor | Until the tab is closed or until withdrawal |
mp_err_sig | sessionStorage | Remembers which script errors on this page have already been reported in the tab, so an error firing in a loop arrives only once; contains no information about the visitor | Until the tab is closed |
mp_reibung | sessionStorage | Keeps the last three pages visited and the times of reloads, to recognise an immediate return or repeated reloading as a usability problem | Until the tab is closed |
mp_user_id | localStorage | Only if you pass your own user identifier yourself | Until withdrawal |
mp_seen_before | localStorage | Only where exit prediction is switched on: records that the browser has been here before — one of the features of the prediction | Until withdrawal or until browser data is cleared |
mp_offer_* | localStorage | Only where you switch on an offer: counts how often it was shown today, so the daily cap is kept | One entry per calendar day; until withdrawal or until browser data is cleared |
mp_umfrage | localStorage | Only where you switch on a survey: keeps, per survey, whether this browser is part of the sample and when it was last shown, so nobody sees the same question too often; contains no answers | until consent is withdrawn or browser data is cleared |
There is one further key that does not belong in the table: mp_exclude is something you set in your own browser to keep your own visits out of the recordings. It is created only by your own action and never on a visitor's device.
The link to the self-service page is not decoration
A visitor's identifier lives in the storage of your website. Browsers keep that storage separate per site, and MousePlayer deliberately does not merge it — which is why mouseplayer.com cannot read it on its own. Anyone who wants to see or delete their data gets there through the link in your privacy policy. Without it, the route is effectively closed to your visitors, and the request lands on your desk instead.
That is why both versions of the text point to mouseplayer.com/my-data. Keep it, even if you shorten everything else. How the page works is described under Access and Erasure.
The link can carry the identifier itself. MousePlayer.privacyUrl() returns the finished address including this browser's identifier — the visitor then has nothing to type on the target page. The language follows your page's lang attribute. Without consent nothing was recorded, there is no identifier, and the function returns null: a link that finds nothing would be worse than the static one.
Attach the call to the click, not to page load. mp.js loads asynchronously, and privacyUrl only comes into being behind the consent gate — so when an inline script runs, the function is usually not there yet. The static link in href stays and covers every case where nothing loaded.
Where the statements come from
Every sentence in the text can be checked against a document. If you want to delete or reword one of them, look there first to see what actually happens:
- Data Processing Agreement — your obligations and ours, instruction binding, notification paths
- Technical and Organizational Measures — what limits access to the recordings
- Sub-processors — who else is involved, where, and on what basis
- Our own Privacy Policy — the same operations from our side, including the split of roles between your website and ours