Support
Last updated 7 October 2026. This policy replaces the version dated 28 February 2025 and takes effect on publication.
MuseMuse Holdings Ltd, a company registered in England and Wales with its registered office at 71 to 75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, is the controller of the personal data described in this policy.
This policy applies to the MuseMuse mobile application for iOS and Android and to the website at musemuse.app. It does not apply to any third party service you reach from them.
We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, and, where it applies to you, Regulation (EU) 2016/679.
Data you provide. When you create an account we process your email address and a password, which is stored only as an irreversible hash. Where you authenticate using Sign in with Apple or Sign in with Google we process the account identifier supplied by that provider. Where you use Apple's private email relay we process only the relay address. We also process your name where you choose to supply it, and the content of any correspondence you send us.
Device and technical data. Device model, operating system version, application version, language and region settings, IP address, and diagnostic data generated when the application fails.
Location data. Approximate device location, where you have granted the relevant permission. See clause 4.
Usage data. Tours started, progressed and completed; artworks viewed and saved; quiz responses and scores; and the museums to which your account has access.
Transaction data. Confirmation from the App Store or Google Play that a purchase has been made, what it relates to, and whether a subscription remains active. We do not receive or process payment card details.
We do not request, and do not require, personal data falling within the special categories defined in Article 9 of the UK GDPR.
We process personal data for the purposes and on the lawful bases set out below.
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and administering your account, and supplying the content you have purchased | 2.1, 2.5 | Performance of a contract |
| Synchronising your progress, saved artworks and quiz results across devices | 2.4 | Performance of a contract |
| Identifying museums near your current position | 2.3 | Consent |
| Measuring how the application is used in order to improve it | 2.2, 2.4 | Consent |
| Measuring the effectiveness of our advertising | 2.2 | Consent |
| Identifying and correcting faults in the application | 2.2 | Legitimate interests in maintaining a functioning service |
| Responding to your correspondence | 2.1 | Legitimate interests in supporting users |
| Sending you marketing communications | 2.1 | Consent |
| Preventing fraud and unauthorised access | 2.1, 2.2 | Legitimate interests in protecting the service |
| Meeting accounting, tax and other legal obligations | 2.5 | Compliance with a legal obligation |
Where we rely on consent, you may withdraw it at any time within the application settings or by writing to us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect your access to content you have purchased.
Where we rely on legitimate interests, we have carried out a balancing assessment and will supply a summary of it on request.
The application uses approximate device location to identify museums near you. Precise location is not requested.
Location data is processed to return the relevant result and is not retained. We do not compile a location history.
Granting this permission is optional. Where it is refused the application remains fully functional and museums may be found by search instead. You may withdraw the permission at any time in your device settings.
Analytics. We process usage data to understand how the application performs and where it fails users. This processing is carried out on the basis of your consent and may be disabled at any time in the application settings.
Diagnostics. Where the application fails, technical data describing the failure is transmitted to us. This processing is carried out on the basis of our legitimate interests in maintaining a functioning service.
Advertising measurement. We measure whether our own advertising results in installations of the application. This processing is carried out on the basis of your consent. On iOS, consent is obtained through the App Tracking Transparency prompt; where permission is refused, no such measurement takes place. On Android it may be controlled in the application settings and in your device advertising settings.
We do not display third party advertising within the application, and we do not process personal data for the purpose of profiling you for advertising by others.
Website cookies. Our website uses Google Analytics, provided by Google Ireland Limited, to understand which pages are read and how visitors move through the site. Google Analytics sets cookies (_ga and _ga_*) that store a random identifier for up to 2 years, and processes your IP address in shortened form. These cookies are set only if you select Accept in the cookie banner. If you select Decline, or make no choice, no analytics cookies are set and no analytics data is collected. You can change your choice at any time using the Cookie settings link at the foot of every page. Our website sets no advertising cookies.
We store your cookie choice in your browser's local storage so that we do not ask you again on each visit. This is strictly necessary to respect your choice and does not require consent.
All purchases are made through the App Store or Google Play. Apple and Google act as the merchant of record, take payment and hold your payment details. We do not receive, store or have access to payment card data.
Cancellations and refunds are administered by Apple or Google under their own terms, and their respective privacy policies govern their processing of your payment information.
We disclose personal data to the following categories of recipient, each of which acts as our processor under a written contract and may not use the data for its own purposes:
The operators of the App Store and Google Play act as independent controllers in respect of your purchase, authentication and account relationship with them.
We will provide the identity of the processors engaged in respect of your personal data on written request.
We do not sell personal data, and we do not disclose personal data to third parties for their own direct marketing purposes.
We may disclose personal data where required by law, in response to a valid order of a court or competent authority, or where necessary to establish, exercise or defend legal claims. In the event of a merger, acquisition or sale of assets, personal data may be transferred to the acquiring party, and we will notify you before that transfer takes effect.
Some recipients are established outside the United Kingdom and the European Economic Area. Where personal data is transferred outside those territories, we rely on an adequacy decision covering the destination, the UK International Data Transfer Addendum, or the European Commission's Standard Contractual Clauses, together with any supplementary measures required.
A copy of the safeguard relied upon for a given transfer is available on written request.
We retain personal data for no longer than is necessary for the purposes for which it is processed, in accordance with the following periods.
| Category | Retention period |
|---|---|
| Account data and associated usage data | For the life of the account, and 30 days following a deletion request |
| Transaction records | 7 years from the end of the relevant accounting period |
| Analytics data | 12 months |
| Website analytics cookies | Up to 2 years, or until you decline or clear your cookies |
| Diagnostic and error data | 90 days |
| Advertising measurement data | 6 months |
| Correspondence | 2 years from the last contact |
| Location data | Not retained |
On expiry of the applicable period, personal data is deleted or irreversibly anonymised. We may retain data for longer where required to comply with a legal obligation or to establish, exercise or defend legal claims.
We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, irreversible hashing of passwords, access control on the basis of necessity, and logging of administrative access.
Where a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and will notify you without undue delay where the risk is high.
Subject to the conditions set out in applicable law, you have the right to:
Requests should be sent to contact@musemuse.app. We will respond within one month of receipt. That period may be extended by two further months where a request is complex, in which case we will tell you within the first month. No fee is payable unless a request is manifestly unfounded or excessive.
We may request information reasonably necessary to confirm your identity before acting on a request.
The application is not intended for children under 16, and we do not knowingly process the personal data of children under that age.
Where we become aware that an account has been created by a child under 16, we will delete it and the associated personal data. If you believe this has occurred, please write to us at the address in clause 15.
We do not carry out automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you.
We may amend this policy from time to time. The date at the head of this policy records the most recent amendment.
Where an amendment materially affects how your personal data is processed, we will notify you within the application or by email before it takes effect.
Enquiries and requests under this policy should be addressed to contact@musemuse.app, or by post to:
MuseMuse Holdings LtdYou have the right to lodge a complaint with a supervisory authority. In the United Kingdom this is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (ico.org.uk). If you are in the European Economic Area you may complain to the supervisory authority of the member state in which you reside, work, or where the alleged infringement occurred.