Privacy policy
Last updated:
MuseMe builds personalised visits for museums, heritage sites and cultural venues. This policy explains how we collect, use and protect personal data on our website and in our products, in line with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Who we are
The data controller for this website is MuseMe SAS, 1 Rue Marguerin, 75014 Paris, whose registration in Paris is in progress. For any question about your data, write to privacy@themuseme.com.
When a museum or cultural institution uses MuseMe for its visitors, that institution is the data controller for its visitor data. MuseMe acts as its processor and handles that data only on its written instructions, under a data processing agreement (Article 28 GDPR).
2. What we collect
- Contact and meeting requests: name, work email, institution, type of institution and your message.
- Newsletter: first name, email and role.
- Guide and white paper downloads: first and last name, work email, institution, role, country and whether you agreed to receive updates.
- Visitor app: language, interests and visit preferences you choose, plus usage data such as stories played. No account is needed to use the visitor app.
- Technical data: IP address, browser type and pages visited, collected through cookies only where you consent (see the cookie policy).
We do not collect sensitive data. We do not use your data for automated decisions that have legal or similarly significant effects on you.
3. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Reply to your requests and arrange meetings | Steps taken at your request before a contract (Art. 6(1)(b)) |
| Send the newsletter | Your consent (Art. 6(1)(a)) |
| Send the guides you request | Steps taken at your request (Art. 6(1)(b)) |
| Send occasional updates, if you ticked the box when requesting a guide | Your consent (Art. 6(1)(a)) |
| Provide and improve services for our institutional clients | Performance of a contract (Art. 6(1)(b)) and our legitimate interest in improving our product (Art. 6(1)(f)) |
| Personalise the visit in the visitor app | On behalf of the institution, under its own legal basis |
| Audience measurement on our website | Your consent (Art. 6(1)(a)) |
| Security and legal obligations | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
4. Who we share it with
We never sell or rent personal data. We share it only with service providers that help us run MuseMe (hosting, AI processing, email delivery and analytics). Each one is bound by a data processing agreement and acts only on our instructions.
Our database, back end and file storage are hosted in the European Union. On this website, your data goes to these providers:
| Provider | What it does for us | Where your data is |
|---|---|---|
| Vercel Inc. | Serves our websites, processes technical data such as your IP address and carries the forms you send us | United States |
| Brevo | Sends our emails and keeps our newsletter and guide lists | European Union |
| Google (Google Workspace) | Our team mailbox, where your messages arrive | European Union and United States |
| PostHog | Audience measurement, only if you accept it | European Union (Frankfurt) |
Transfers to Vercel and Google in the United States rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. If another provider ever needs to transfer data outside the European Economic Area, we will rely on the same safeguards and tell you here.
5. How long we keep it
| Data | Retention |
|---|---|
| Contact and meeting requests | 3 years from our last exchange |
| Newsletter subscribers | Until you unsubscribe, or 3 years after you last opened or clicked one of our emails |
| Guide download leads | 3 years from our last exchange |
| Visitor app data | As set by the institution in its contract with MuseMe |
| Cookie consent choice | 6 months |
| Audience measurement cookie | 1 year. Data collected through it is kept for 25 months maximum |
After these periods, data is deleted or fully anonymised.
6. How we protect it
We use encryption in transit and at rest, access limited to the people who need it, regular backups and hosting of our data in the European Union. If a data breach is likely to put your rights at risk, we will notify the CNIL within 72 hours and inform you where required.
7. Your rights
Under the GDPR you have the right to access, correct and delete your data. You can also restrict or object to its use, ask for a portable copy and withdraw consent at any time. Under French law you can also give instructions about your data after your death.
To exercise a right, email privacy@themuseme.com. We reply within one month. If your data was collected by a museum through the visitor app, we will pass your request to that institution and help it answer.
If you believe your rights are not respected, you can complain to the CNIL, 3 place de Fontenoy, 75007 Paris, cnil.fr.
8. Changes to this policy
We may update this policy as our services or the law change. The date at the top shows the latest version. We will tell you about significant changes by email or on this page.