Privacy Policy

1. Visitors (Anonymous Use)

No account is required to browse exhibits. Visitor interactions are designed to be anonymous by default.

• Digital Passport: The collection of artifacts you build is stored entirely on your own device using browser localStorage. This data never leaves your device and is not sent to our servers.
• Scan counting: When you open an exhibit, a scan event is recorded against that exhibit (incrementing its count). This is done using a short-lived httpOnly cookie for deduplication. No personally identifiable information is stored. The cookie expires after 24 hours.
• Offline cache: Exhibit content may be cached in your browser for up to 7 days to support offline viewing. This data stays on your device.

2. Curator Accounts

Curators are authenticated users provisioned by TapGlyph. We collect:

• Email address (used for login and password reset only)
• Museum assignment (which museum account you manage)
• Content you publish (exhibit titles, descriptions, uploaded media)
• Translation usage metrics (character counts per day, for quota management)

This data is stored in Firebase (Google Cloud, EU region where available) and is processed on the basis of our contractual relationship with you.

3. Contact Form (Lead Enquiries)

If you submit the contact form, we collect: name, work email, museum name, role, museum type, target timeline, and any message you provide. This data is used solely to respond to your enquiry and to recommend a suitable plan.

Legal basis: legitimate interest in responding to business enquiries. We retain lead data for up to 12 months, after which it is deleted.

4. Analytics

With your consent, we use Firebase Analytics (Google) to collect aggregate, anonymised usage data such as page views and session duration. This data helps us improve the platform. You can change your preference at any time below.

If you decline, no analytics data is collected. Error monitoring (Sentry) is used to detect application crashes; it does not collect personal data from visitors.

5. Cookies

We use cookies for the following limited purposes:

• Scan deduplication: httpOnly, session-scoped, no personal data
• Analytics consent: stores your preference (localStorage)
• Content language: remembers your chosen exhibit language (localStorage)

We do not use advertising cookies or third-party tracking cookies.

6. Third-Party Services

• Firebase / Google Cloud: authentication, database, file storage, analytics
• Google Gemini: AI-assisted translation of exhibit content (text only, no visitor data)
• Sentry: application error monitoring

Each provider has its own data processing terms. We do not sell data to third parties.

7. Your Rights (GDPR)

If you are based in the EU/EEA, you have the following rights regarding any personal data we hold about you:

• Access: request a copy of your data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: for analytics, use the control below at any time

To exercise any of these rights, contact us at contact@claudiovisentin.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

8. Data Retention

• Curator account data: retained for the duration of the subscription, then deleted within 30 days of termination
• Lead enquiry data: up to 12 months
• Scan counts: aggregated, not linked to individuals, retained indefinitely as exhibit statistics
• Visitor device data (passport, cache): controlled entirely by you — clear it at any time in your browser settings or via the Reset Log on the Passport page

9. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated to Curators by email. The “Last updated” date at the top of this page indicates when it was last revised.