Mousaion

Privacy Policy

Last updated August 29, 2026. Mousaion is operated by GEARU LLC (“we,” “us”).

This policy describes how we collect, use, disclose, and retain information when you visit mousaion.ai, create an account, connect sources, or use our API and MCP tools. It is meant to meet common U.S. expectations, including the California Consumer Privacy Act as amended by the CPRA (“CCPA”), and to be readable for visitors elsewhere. It is not legal advice.

1. Who this covers

Account holders and users of the hosted Mousaion service. If you connect Google Drive, GitHub, or other systems, we process that content as a service provider to your organization.

Website visitors who load marketing or sign-in pages without an account.

We do not knowingly collect personal information from children under 13 (or under 16 where that is the applicable age). Mousaion is a business product, not directed at children. If you believe we have information about a child, email privacy@mousaion.ai and we will delete it.

2. Information we collect

You provide

Collected automatically

From others

3. How we use information

We use information to:

Dream and related features send prompts and retrieved context to language models hosted on Amazon Bedrock (and may fall back across models we configure). We do not use your organization content to train foundation models for other customers.

4. How we share information

We share information only as needed to run the product:

We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are used in the CCPA. We do not use sensitive personal information to infer characteristics about you beyond operating your account.

5. Google user data (Limited Use)

If you connect Google Drive, we request Google OAuth access (typically identity scopes such as email and profile, plus Drive read-only) so we can sync files you authorize into your organization's brain. We use that data only to provide and improve that user-facing feature: filing, search, context for agents, and Dream for your organization. We store an encrypted refresh token and copies of authorized file content in our systems for your org. We do not sell Google user data, do not use it for advertising, and do not use it to train generalized foundation models.

Mousaion's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

You can disconnect Drive in the product (when the connector is enabled) or revoke access in your Google Account. Humans at GEARU do not read your Drive files except with your request (for example, support), for security or legal reasons, or as otherwise allowed under Limited Use.

6. California (CCPA / CPRA)

If you are a California resident, you have the right to: know the categories and specific pieces of personal information we collected; know the categories of sources, purposes, and third parties; delete personal information (subject to exceptions); correct inaccurate information; opt out of sale or sharing (we do not sell or share as defined above); limit use of sensitive personal information; and not be discriminated against for exercising these rights.

Categories we may collect, depending on how you use Mousaion: identifiers (email, IP, account IDs); commercial information (plan, invoices via Stripe); internet activity (product logs); professional information (org and repo names); and customer content you store (which may include whatever is in your documents).

To exercise rights, email privacy@mousaion.ai from the address on your account. We will verify the request and respond within the time the CCPA requires (generally 45 days). You may use an authorized agent as the statute allows. You may appeal a denial by replying to our decision email.

“Do Not Sell or Share My Personal Information”: we do not sell or share personal information as defined by the CCPA. If that changes, we will update this policy and provide an opt-out.

California Civil Code § 1798.83 (Shine the Light): we do not disclose personal information to third parties for their direct marketing.

7. Other U.S. and international notes

We host data in the United States (AWS us-east-1 and Vercel). If you access the service from the EEA, UK, or Switzerland, we transfer information to the U.S. using the mechanisms our processors provide (including Standard Contractual Clauses where they apply). Where GDPR or UK GDPR applies to us as a controller (for example, your account email), our legal bases are contract, legitimate interests in operating a secure SaaS product, and consent where we ask for it (such as optional connectors). Where we process your documents as a processor, your organization is the controller.

Some states (including Virginia, Colorado, Connecticut, Utah, Texas, and others) grant similar access, deletion, and opt-out rights. Use the same email to make a request; we will honor applicable state law.

8. Retention and security

We keep account and content data for as long as your organization is active and for a short period after deletion or closure so we can complete backups, resolve disputes, and meet legal duties. Logs are kept for a limited operational window. OAuth refresh tokens are encrypted at rest. No method of transmission or storage is 100% secure.

9. Your choices

10. Changes

We may update this policy. The “Last updated” date will change. Material changes will be indicated in the product or by email to the address on your account where required.

11. Contact

GEARU LLC
Privacy: privacy@mousaion.ai
Product: https://mousaion.ai

Also see our Terms of Service.