Privacy Policy
Last updated November 10, 2026
This policy explains what personal data mostra handles, why, for how long, and what your rights are. It's for builders (people with a mostra account), reviewers (people who comment through an invite link), and anyone who visits mostra.design or a site that uses the mostra script.
Who is responsible
In this policy, "we" and "us" mean mostra. For the personal data described in What we collect, and why, we decide how it is used (the GDPR calls this the controller).
- Email: [email protected]
Write to [email protected] about anything in this policy.
Our two roles
- For data about builders' accounts, billing, support emails, our website and our server logs, we're the controller: we decide why and how it's processed.
- For what's inside a customer's projects, the customer (the person or organization that runs the project) decides how it is used, and we handle it only on the customer's behalf (the GDPR calls us the processor), under our Data Processing Agreement. That covers reviewers' names and email addresses, comments, verdicts, and what's said through Talk, which turns a reviewer's spoken feedback into comments. If you're a reviewer, the customer's own privacy notice applies, and requests about your data should go to the customer. If you're a reviewer is a short summary of what happens to it in mostra.
What we collect, and why
Your account
- What: your email address and name; your password (as a hash), if you set one; your login sessions; your workspace, projects and their settings; your API keys (as hashes) and connected agents; and when you accepted our terms.
- Why: to create your account, log you in and provide mostra (Article 6(1)(b) GDPR: our contract with you), and to keep accounts secure (Article 6(1)(f): our legitimate interest in security).
- How long: as long as your account exists, and a login session for at most 28 days. After you ask us to delete your account, we delete it within 30 days. Copies in our database backups are deleted when those backups expire, at most 28 days after the data itself is deleted.
Emails we send you
We send login links, email confirmations and email-change confirmations through Resend, for the same reason and on the same basis as your account. We also email you, through Resend and on the same basis, when your workspace has used most or all of its monthly talking minutes. When people leave feedback on your projects, we also email you what they wrote, through Resend and on the same basis, at most once an hour for each project. You can turn this off in your settings. We don't send marketing email.
Billing
- When you subscribe to a paid plan, you pay on Stripe's checkout. The seller is Link, a Stripe service, which acts as the merchant of record. Stripe and Link each decide how they use your payment details (they're independent controllers), under their own privacy policies (Stripe, Link). We never see your card details.
- What we hold: we give Stripe your email address for the checkout, and keep your plan and the state of your subscription.
- Why: to know which plan your workspace is on and to link it to your billing (Article 6(1)(b) GDPR: our contract with you).
- How long: as long as the workspace exists.
Emails you send us
- What: your email address, your message, and anything you choose to send with it.
- Why: to answer you (Article 6(1)(f) GDPR: our legitimate interest in answering), and to handle complaints (for consumers, Article 6(1)(c): our legal duty to handle them).
- How long: as long as we need to deal with the matter, and then until any claims about it are time-barred.
Server logs
- What: when a browser, the mostra script or a coding agent contacts our server, it logs the IP address, the time, the address requested and where the request came from, and details of the browser.
- This includes ordinary visitors of sites that use mostra: their browser downloads the script from our server, so their IP address and the page they're on reach these logs, even though the script does nothing else for them.
- Why: to keep mostra secure, stop abuse and find faults (Article 6(1)(f) GDPR: our legitimate interest in running a secure, working service).
- How long: at most 60 days.
- Separately, to prevent abuse, we keep the IP addresses of people who join a project, sign up or log in, and a scrambled copy of the email addresses we write to, for at most 16 days.
Cookies and browser storage on mostra.design
| What it does | Stored as | How long |
|---|---|---|
| Keeps you logged in during a visit, and protects forms against forged requests. | Cookie | Until you close the browser |
| Keeps you logged in between visits, when you choose "Keep me logged in" or have just signed up. | Cookie | At most 28 days |
| The light or dark theme you picked, if you picked one. | Local storage | Until you switch back to the system theme |
The dashboard may also keep small technical values in your browser's session storage to keep its live connection working. All of this is strictly necessary for a service you asked for, so the law doesn't require your consent for it. We don't use advertising or tracking cookies, and the analytics on our home page sets no cookies.
Our home page
- The demo on the home page keeps its comments in your browser tab, and a reload removes them. If you try Talk there, your browser or a speech model on your device turns speech into text, and the audio isn't sent to our server. Some browsers, such as Chrome, send the audio to their maker to do this.
- When you press Stop, what you said and what you pointed at go through our server to OpenAI, in the United States, whose model turns them into comments. OpenAI processes them for us, and keeps them only for a limited time, under its terms for business customers. Our server doesn't keep them: the comments go back to your browser.
- An AI agent answers the comments you leave in the demo. Your comments, with the thread and the part of the page each is on, go through our server to OpenAI, in the United States, whose model writes the answer. OpenAI handles them as described for Talk above.
- Our server keeps the agent's conversations, and your IP address, to limit how much each network can use the demo, and deletes them within 16 days of your last use. Our legal basis is our legitimate interest (Article 6(1)(f) GDPR) in showing how mostra works, answering questions about it and keeping the demo from being abused. Please don't write or say anything personal in the demo.
- The contact form opens your own email app. Nothing reaches us until you send that email.
- We count visits to the home page with Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser. When the page loads, your browser tells Cloudflare which page it opened, which page linked to it, what browser it is and how fast the page loaded, and Cloudflare uses your IP address to work out your country. We see only totals, such as visits per day, country or referring site, for up to the last six months. Our legal basis is our legitimate interest (Article 6(1)(f) GDPR) in knowing how many people visit and how they find us.
Visitors of sites that use mostra
If you visit a site that uses mostra and haven't opened an invite link, the script only checks whether you have one, then does nothing. It sends nothing to us and stores nothing in your browser. The only trace is the download of the script itself, in our server logs.
If you're a reviewer
When you give feedback on a site through mostra, the customer who invited you decides what's collected and how long it's kept, and we process it on that customer's behalf. In short:
- What mostra stores: your display name and, if you give one, your email address; your comments, replies and verdicts; with each comment, the page and the part of it you commented on, and details of your browser; and, if you use Talk, when and how long you talked.
- Who sees it: the project's builders, its other reviewers, and the coding agents its builders connect.
- Talk: recording starts only when you press Talk. Your browser, or a speech model on your device, turns your speech into text. Some browsers, such as Chrome, send the audio to their maker to do this. The text, what you pointed at and text from the pages you visited then go to OpenAI, in the United States, whose model turns them into comments under your name. We store the comments, not the audio.
- In your browser, for the site you're reviewing: what keeps you signed in for 30 days, your settings, and unsent drafts.
- How long: until a builder deletes it, or until the customer's workspace is deleted, after which we delete it within 30 days. Copies in our database backups are deleted when those backups expire, at most 28 days after the data itself is deleted.
- Your rights: to access, correct or delete your data in a project, ask the customer, usually the person who invited you. If you write to us instead, we'll pass your request on to the customer.
Who receives personal data
- Our hosting provider, Hetzner Online GmbH, which runs our server and database in Finland.
- Cloudflare, a company in the United States, which delivers our website, the mostra script and our API, and protects them from attacks. This covers visitors to customers' sites that load the mostra script. Cloudflare also counts visits to our home page.
- Resend, in the United States, which sends our emails.
- OpenAI, in the United States, for Talk and for the agent on our home page, as described above.
- Stripe and Link, for payments, as independent controllers.
- The email services that receive what you send to our address.
- Inside a project: the project's builders, its reviewers (who don't see comments marked as team only), and the coding agents its builders connect.
- Public authorities, when the law requires it.
We don't sell personal data.
Transfers outside the European Economic Area
Resend, OpenAI and Stripe process data in the United States, and so may the services that receive the email you send us. Cloudflare processes it in data centers around the world. These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses in our agreements with the provider. Email us for a copy of these safeguards.
Your rights
For the data we control, you have the right to:
- get a copy of your data, and information about how we use it;
- have it corrected;
- have it deleted;
- have its use restricted;
- receive the data you gave us, in a machine-readable format, or have it sent to someone else;
- object to our use of it based on our legitimate interests.
Email [email protected] to use them. We answer within one month, and we may ask you to confirm who you are, for example by writing from your account's address.
You can also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or to the data protection authority in the EU country where you live or work.
Do you have to give us your data?
You need an email address to create an account, and we can't create one without it. Everything else is up to you. As a reviewer, you need a display name to comment through a shared invite link, and an email address is optional.
Automated decisions
We don't make decisions about you based only on automated processing that have legal or similarly significant effects on you. Talk uses an AI model to turn what you said into comments, which isn't a decision about you.
Security
We protect personal data with technical and organizational measures that fit the risk, such as encrypted connections and limits on who can access it.
Children
mostra isn't meant for children. Builder accounts are for people aged 18 or older.
Changes to this policy
When we change this policy, we update this page and the date at the top. If a change affects how we use your data in a meaningful way, we email builders before it applies.