Privacy Policy

Last updated October 22, 2026

Mousepad is an AI builder for websites and business apps. It is run by Health Council Inc. (“we”, “us”). This policy explains what personal information we collect when you use Mousepad (mousepad.app, studio.mousepad.app and our industry and language sites such as restaurants.mousepad.app and es.mousepad.app), where it comes from, why we use it, who receives it, how long we keep it, and the choices and rights you have.

It does not cover the apps and websites you build with Mousepad. For those, you decide what your visitors and customers share, and we handle that data on your behalf (see Apps you build).

If you live in California or another US state with a privacy law, this policy is also our notice at collection: see What we collect, How we use it, Who receives it, How long we keep it and US state privacy rights. If you are in the European Economic Area, the United Kingdom or Switzerland, see also Legal bases and Your rights in Europe.

What we collect and where it comes from

What you give us

• Your account. Your email address and name, and your password, which our sign-in provider keeps; we never store it ourselves. Settings you choose, such as your language and the kind of business you run.
• Your product email choices. Whether you want product emails, and a record of each choice: when, how (for example the box on the sign-up form, or an unsubscribe link), the version of this policy, and, for the choice on the sign-up form, the country you were in, as far as we could tell (see Product email).
• How you found us, saved once when you sign up: the campaign tags in the link you followed, the site that sent you (its name only, never the full address), the first page you visited and, if it was one of our industry sites, its kind of business, the language you were using, whether you came through an invite, and the country you were in, as far as we could tell.
• What you create. What you describe and say in the builder (prompts and chat messages), files you attach (images, PDFs and text files), and the apps, code and images the builder makes for you. If you talk to the builder, Amazon Web Services turns your voice into text, and may read replies aloud; we keep the text, not the recording. We also take screenshots of your apps, to show them on your dashboard.
• People you invite. If you invite someone to your workspace, their email address and the role you give them. Only someone signed in with that address can accept.
• Payments. If you buy a plan, credits or a domain, our payment processor, Stripe, collects your card details; we never see your full card number. We keep your plan and the name and email on your billing account; Stripe keeps your invoices.
• Domains you buy. If you buy a domain through Mousepad, the owner’s name, address, phone number and email address, which domain registries require. We pass them to our domain registrar, Namecheap, to register the domain in your name with its privacy protection on. We delete our copy of the owner’s name, address and phone number once the domain is registered or the purchase fails, and the whole order a day after one you don’t pay for; we keep the owner’s email address with the domain’s record.
• Your AI visibility questions. If you turn on AI visibility checks for a site, the questions your customers might ask, your business name, your competitors’ names, and, if you choose to give them, a city and a country.
• Messages. What you write when you email us.

Please don’t put sensitive personal information, such as health information or government ID numbers, into Mousepad (see Apps you build).

What we collect automatically

• Cookies, and what your browser keeps for our sites (see Cookies).
• How you use our sites and the studio, through our analytics (see Analytics).
• Service logs: which account made a request, which part of the service it reached, whether it worked and how long it took. Our logs don’t record what you typed or built.

What we get from others

• Google, if you choose Continue with Google: your name, email address and Google account ID. We ask Google only for your basic profile and email, never for your contacts, files or anything else.
• Stripe: whether your payments went through, and, for the referral checks, whether two cards are the same card (see Referrals).
• Google Search Console, if you connect it to a site (see Google Search Console): the searches that showed your site on Google, how often people saw and clicked it, and which pages they landed on. Google adds these up before we receive them, so they contain no information about who the visitors were.
• Public sources. We sometimes make a free sample website for a business and email its owner, using information the business has made public, such as its name, address, phone number and services. The site is taken down after 14 days unless the owner claims it. To have one removed sooner, email us.

How we use it

• To run Mousepad: build, host and publish your apps, keep your work, and sign you in.
• To generate your apps with AI (see Who receives it).
• To bill you, register domains you buy, and give credits for referrals (see Referrals).
• To show you how your site is doing in search, suggest fixes, and suggest keywords, if you connect Google Search Console (see Google Search Console).
• To check how AI assistants answer questions about your business and your competitors, and show you the results, if you turn on AI visibility checks.
• To keep Mousepad safe: to stop abuse, phishing and spam, and to investigate problems. Before an app is published, we automatically check its code for signs of phishing, such as a page that asks for another company’s password; a finding asks you to fix it or confirm before you publish.
• To send you service emails, such as sign-in codes and notices about your account or your apps.
• To send you product updates and tips by email, if you’re enrolled (see Product email).
• To understand how people find and use Mousepad, so we can improve it, and to choose which product emails may help you. For this we use how you found us, your plan, the kind of business you run, and whether you’ve built or published a site. We also check whether your email address is on a company’s own domain, or a free email service, a school, a government or a throwaway address, and we estimate how well Mousepad fits you, so a person on our team can choose whom to write to. We never use what you build or type in the builder for any of this.
• To answer you when you contact us.
• To keep the records tax and accounting law requires, to answer lawful requests, to enforce our Terms of Service, and to protect the rights and safety of our users, the public and us.

We don’t sell your personal information, we don’t show you ads, and we don’t use what you create to train AI models.

Legal bases in the European Economic Area, the United Kingdom and Switzerland

If you are in one of these places, Health Council Inc. is the controller of the personal information this policy describes (for the apps you build, we act on your behalf). We rely on these legal bases:

Product email

Besides service emails, we send occasional product updates and tips: new features, guides and ideas for your sites.

• When you’re enrolled. In most countries, creating an account enrols you, and the sign-up form says so next to the button. In the European Economic Area, the United Kingdom, Switzerland and Canada, we email you only if you tick an unticked box on the sign-up form. We can tell roughly where you are so we know whether to ask first; if we can’t tell, we ask with the box.
• Accounts made before October 9, 2026 aren’t enrolled. Mousepad asks you once, in the studio, whether you’d like these emails.
• Unsubscribing. Every product email has an unsubscribe link; on the page it opens, one click unsubscribes you, without signing in. You can also turn Product emails off in your settings at any time. Unsubscribing doesn’t stop service emails about your account.
• Our record. We keep a record of each choice you make, with the version of this policy in force, so we can show what you agreed to.

Our team sends product emails using our customer relationship tool, Attio (see Who receives it).

Analytics

We use PostHog to understand how people use mousepad.app, our industry and language sites, and the studio.

• First-party. PostHog’s code is part of our own site, and what it records goes through our own web addresses to PostHog in the United States.
• What it records. On our marketing pages: the pages you view, the links and buttons you click, the site that sent you, the kind of site you seem interested in, your browser and device type, and your approximate location from your IP address. In the studio: only named actions (your answer in the cookie banner included), such as starting sign-up or answering the email question; never the text on the screen or what you type. When you’re signed in and PostHog keeps its cookie (see below), we link studio activity to your account’s ID, with its plan, kind of business and language, whether it’s one of our own team’s accounts, and the campaign source that first brought you; never your email address or name. We never send PostHog your prompts, your sites or anything you build.
• Outside the regions below there’s no banner, and analytics run as described here. PostHog keeps an ID for your browser in a cookie shared across the mousepad.app sites, and in your browser’s storage. If you choose No cookies under Cookie settings, our analytics stop counting your visits altogether.
• In the European Economic Area, the United Kingdom and Switzerland a banner asks first, and nothing about your visit is recorded until you answer. We can tell roughly where you are so we know whether to ask first; if we can’t tell, we ask. If you choose Allow cookies, PostHog keeps its cookie and its ID for your browser as described above. If you choose No cookies, PostHog sets no cookie, and keeps in your browser only its note of your answer and, until you close the tab, a note about that tab. PostHog then still counts your visit, without a cookie, from your IP address and browser.
• Your choice. A cookie remembers your answer, whichever it is, on every mousepad.app site, the studio included. You can change it at any time with Cookie settings at the foot of mousepad.app’s pages (the studio shares the choice).
• Do Not Track and Global Privacy Control. If your browser sends either signal, our analytics in your browser don’t run at all, and no choice in the banner can turn them on: Cookie settings only tells you they’re off.
• How you first arrived. Separately from PostHog, your browser keeps how and when you first came to our sites (the campaign tags in the link, the site that sent you, the first page you visited, and whether you came by an invite link) for 30 days, whatever you choose about analytics. The campaign tags, the site that sent you and the first page are sent with your sign-up, as part of how you found us. They are also passed along in the link when you go from one of our sites to the studio, or from an industry or language site to mousepad.app, so that site knows how you first arrived.
• Account events. Separately from the cookie banner, our servers tell PostHog when an account reaches certain steps, such as creating an account, a first build or publish, a plan upgrade or buying credits. Each of these events carries a random ID for the account, the product, plan and kind of business, whether it belongs to our own team and, for a purchase, the billing period, whether it’s a trial or the credit pack; never your name, your email address or anything you build. This happens whatever you choose about analytics and whatever your browser signals.
• We don’t record your screen or your sessions (no session replay), and our pages load no advertising or third-party tracking scripts.

Cookies and similar technologies

Cookies are small files a website keeps in your browser. Our sites also keep some information in your browser’s storage, which works much like a cookie. Some of it lasts only until you close the tab, and the rest for the times given below. We set all of it ourselves, on our own sites. When you sign in with Google or pay through Stripe, you go to their pages, and their own policies cover the cookies they use.

Needed to run Mousepad

• Keeping you signed in: up to 7 days, ending after 12 hours without use.
• Signing in with Google: up to 15 minutes, while you sign in.
• Remembering your answer to our cookie question: 180 days, on every mousepad.app site, the studio included.

Preferences and work in progress

Your browser keeps what lets Mousepad pick up where you left off: things like your language and display settings, a description you started typing, what you’ve already seen, what our sign-up form showed you, with the email you typed and, as far as we could tell, the country you were in (until you finish signing up), the look you picked and your answers to the studio’s questions about your app (until you close the tab), a domain order you started (until you close the tab), an invite code you opened (for 30 days), and, once you use invites, a random ID for your browser (see Referrals).

How you first arrived

How and when you first came to our sites, kept in your browser for 30 days whatever you choose about analytics. It is passed along in the link when you go from one of our sites to the studio, or from an industry or language site to mousepad.app, and it’s saved with your account if you sign up (see Analytics).

Analytics

PostHog’s cookie and what it keeps in your browser, as Analytics describes. These are what Cookie settings turns on and off. On mousepad.app, your browser also keeps the kind of site you seem interested in (30 days), which Cookie settings turns off too.

Your choices

• Cookie settings, at the foot of mousepad.app’s pages, lets you allow or refuse analytics cookies at any time; the studio shares the choice. In the European Economic Area, the United Kingdom and Switzerland, a banner asks you first.
• Your browser’s settings let you delete or block cookies and what your browser keeps for our sites. If you block the ones needed to run Mousepad, you won’t be able to stay signed in.
• Global Privacy Control and Do Not Track. If your browser sends either signal, our analytics in your browser don’t run at all.

We don’t use advertising or social media cookies.

Referrals

• When you open someone’s invite link, we keep its code in your browser for 30 days, so it can be applied when you sign up.
• Your browser gets a random ID, which it sends with referral requests. We use it only to stop people claiming their own invite from their own browser.
• To allow one referral per person, we compare email addresses without the differences that don’t make a new address (letter case, “+” tags, and dots in Gmail addresses), and we don’t accept throwaway email services.
• Before paying a referral reward for a subscription, we ask Stripe whether the card that paid is one the person who invited you has saved. We compare the cards as Stripe identifies them, never their numbers.
• The person who invited you sees, on their invite page, how many of their invites joined, built a site or subscribed, and the credits they earned. They don’t see your name or email address.

Google Search Console

You can connect Google Search Console to a site you publish with Mousepad. If you do:

• We store your Google sign-in tokens, kept sealed, and your site’s Search Console numbers: the searches that showed your site, how often people saw and clicked it, and which pages they landed on. Google adds these up before we receive them, so they contain no information about who your visitors were.
• We use them only to show you how your site is doing in search and to suggest fixes. We don’t use them for advertising, we don’t sell them, and we don’t use them to train AI models.
• To let Google confirm that you own the site, we add a verification tag to your site’s pages. The tag stays on the site after you disconnect, so you keep your access in Search Console.
• When you disconnect a site, we stop reading from Google and delete the Search Console numbers we stored for it. When you remove the Google connection from your workspace’s connection settings, we delete your sign-in tokens. You can also remove Mousepad’s access at any time in your Google Account settings.

Mousepad’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who receives it

We share personal information only as this section describes.

Companies that help us run Mousepad

They receive only what they need, and only to provide their part of the service:

Anthropic and OpenAI process this under their business terms for developers, which don’t allow them to use it to train their models. For AI visibility checks they receive no information about your site’s visitors.

Others

• People you choose. Members of a workspace see its apps, as its owner decides. What your published apps show publicly, anyone can see. The person who invited you sees only what Referrals describes.
• Professional advisers, such as lawyers and accountants, when they advise us.
• Authorities and others, when the law requires it, or to protect the rights and safety of our users, the public or us.
• A buyer or successor, as part of a merger or sale of our business, in which case this policy continues to apply to your information.

Apps you build

Each app you publish has its own database. What your visitors and customers enter into your app is your data: we store and back it up for you, and we access it only to run, secure and support the service, or when the law requires it. You are responsible for telling your own users how you use their information.

Mousepad is not for health information. Don’t use Mousepad, or apps built with it, to collect or store protected health information. We don’t sign business associate agreements for Mousepad.

Where your data is

Mousepad runs in the United States. If you use it from elsewhere, including the European Economic Area, the United Kingdom or Switzerland, your information is transferred to and stored in the United States, where data protection law may not protect it as fully as the law where you live. The companies in Who receives it may process it in the United States or in other countries. To ask how your information is protected when it’s transferred, email us.

How long we keep it

We keep personal information for as long as we need it for the purposes in this policy, including to meet legal, tax and accounting requirements and to resolve disputes. In particular:

• Your account and your apps: while you have an account, until you delete them or ask us to.
• Your product email choices: while you have an account, and afterwards for as long as we may need to show what you agreed to.
• Google Search Console data: until you disconnect the site, and our sign-in tokens until you remove the connection; the daily totals are kept for 400 days, and the numbers by page and by search for 180 days.
• AI visibility results: 400 days.
• Analytics: until we no longer need them to understand how Mousepad is used.
• Service logs: up to 1 year.
• A domain owner’s name, address and phone number: until the domain is registered or the purchase fails, or for a day if the order isn’t paid. After that, only the registrar keeps them; we keep the owner’s email address with the domain’s record.
• Backups: your app’s database backups are kept for 7 to 30 days depending on the site’s type, and our own backups for up to 35 days, so deleted data can remain in backups until they expire.
• Billing records: as long as tax and accounting law requires.

Security

We encrypt your data in transit and at rest, keep each customer’s data separate, limit which of our people can reach it, and keep logs of access. No service can promise perfect security; if a breach affects your information, we’ll tell you as the law requires.

Children

Mousepad is for businesses and adults. It isn’t meant for anyone under 18, and we don’t knowingly collect information from children. If you believe a child has given us personal information, email us and we’ll delete it.

Your choices and rights

Choices everyone has

• You can change your settings in Mousepad, such as your language, and delete an app in a workspace where you can publish.
• You can stop product emails with the unsubscribe link in any of them, or by turning Product emails off in your settings.
• You can change your analytics choice at any time with Cookie settings at the foot of mousepad.app’s pages (the studio shares the choice), or turn our analytics in your browser off by turning on Global Privacy Control or Do Not Track (see Cookies).
• You can choose not to give us information, but we need your email address to make your account, and some features need more, such as a card to pay or a domain owner’s details to register a domain.
• To get a copy of your information, correct it, or delete your account, email privacy@mousepad.app.

Your rights in Europe

If you are in the European Economic Area, the United Kingdom or Switzerland, you can ask us to:

• Access your personal information: tell you how we use it and give you a copy.
• Correct it if it’s wrong or incomplete.
• Delete it when there’s no good reason for us to keep it.
• Transfer it: give you, or a company you choose, a copy in a machine-readable format.
• Object to our using it where we rely on our legitimate interests, and to product emails at any time.
• Restrict how we use it, for example while we check that it’s accurate.
• Withdraw your consent at any time, where we rely on it. This doesn’t affect what we did before.

If you’re not satisfied with our answer, or with how we use your information, you can complain to the data protection authority where you live or work: in the United Kingdom, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner.

US state privacy rights

Depending on the state you live in, such as California, Colorado, Connecticut or Virginia, you may have the right to:

• Know and access: ask what personal information we’ve collected about you, where it came from, why we collected it and who we disclosed it to, and get a copy of it.
• Delete personal information we collected from you.
• Correct personal information that’s wrong.
• Opt out of the sale or sharing of your personal information and of targeted advertising. We don’t do either, so there’s nothing to opt out of.
• Appeal if we turn down your request.
• Be treated the same whether or not you use these rights.

What we collect, in the categories California law uses: identifiers (your name, email address, account ID and IP address); customer records (your billing name and email, and a domain owner’s address and phone number); commercial information (your plan and purchases); internet activity (how you use our sites and the studio, and service logs); approximate location (the country or area your IP address points to); audio (your voice, if you talk to the builder, which we turn into text without keeping the recording); professional information (the kind of business you run and your company’s domain); inferences (our estimate of how well Mousepad fits your needs); and sensitive personal information (your email address with your password, which we use only to sign you in). We collect these from the sources in What we collect, use them for the purposes in How we use it, and disclose them only as Who receives it describes.

We don’t sell or share personal information, including that of anyone under 16, and we don’t share it with other companies for their own marketing.

Making a request

To use any of these rights, email privacy@mousepad.app or write to us at the address under Contact. We’ll confirm it’s you before acting, and reply within 30 days. Someone you authorise can make a request for you; we may ask them for proof that you did, and ask you to confirm who you are. If we turn down your request, we’ll tell you why, and you can appeal by replying to our answer. If we turn down your appeal, you can contact your state’s attorney general.

Other websites and services

Our sites link to other websites and services, and apps you build can connect to them. We don’t control them, and their own privacy policies apply to what you share with them.

Changes

If we change this policy, we’ll update the date above, and for significant changes we’ll tell you by email or in Mousepad before they take effect.

Contact

Health Council Inc. Email privacy@mousepad.app, or write to us at 2375 East Imperial Hwy., STE 1102, Brea, CA 92821.

Health Council Inc. has appointed Prighter EU Rep GmbH as its representative in the European Union. For privacy questions or to exercise your data rights, contact our representative through our Prighter contact page, or write to Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. Include reference ID-14628030393.