Privacy Policy

This Privacy Policy explains how ExhibIQ ("ExhibIQ," "we," "us") collects, uses, and shares information when a venue (museum, gallery, or similar organization) or its visitors use our AI exhibit-guide platform (the "Service"). It applies to curators and superadmins who manage a venue on ExhibIQ, and to visitors who scan a code and chat with the AI guide.

1. Information we collect

Account information. When a venue signs up, we collect the curator's name, email address, and a securely hashed password. We never store your password in plain text.

Venue content. Curators upload knowledge material (PDFs, images, exhibit descriptions), exhibit photos, and suggested questions. This content is used only to power that venue's own AI guide and is never shared with, or used to answer questions for, any other venue.

Visitor information. A visitor's activation code, and the short-lived session it creates, let them chat during their visit. We log the text of questions asked (to improve the guide and show curators what visitors are curious about) and, if voice mode is enabled, a temporary audio recording sent for transcription. We do not require a visitor to create an account, and we do not knowingly collect more personal information from a visitor than what they choose to type or say in a question.

Usage and device information. Like most web services, we automatically log technical information such as IP address, browser type, and timestamps -- used for security, rate-limiting abuse, and diagnosing problems.

Billing information. If a venue subscribes to a paid plan, information necessary to process payment (such as billing name, email, and amounts) is handled by our payment processor. We do not store full payment card numbers ourselves.

Cookies. We use a small number of strictly necessary cookies to keep you signed in (curator, superadmin, and visitor sessions each use their own, separate cookie) and to remember your selected language. We do not use third-party advertising or cross-site tracking cookies.

2. How we use information

We use the information above to: operate and improve the Service; generate AI answers grounded in a venue's own uploaded material; show curators analytics about what their visitors are asking; process payments and manage subscriptions; communicate with curators about their account; detect and prevent abuse; and comply with legal obligations.

3. AI processing and service providers

To generate answers, transcribe speech, and synthesize voice responses, visitor questions and the relevant venue-uploaded content are sent to our AI provider (OpenAI) for processing. Some venues may also use a third-party object storage provider (Supabase) to host uploaded images and audio. These providers process data on our behalf under their own data-processing terms and are not permitted to use it for their own purposes beyond providing the service to us. We do not sell personal information to anyone.

4. Data retention

A visitor's session and any offline data downloaded to their device expire automatically at the end of their activation window. Venue content and curator accounts are retained for as long as the venue's account is active, and for a reasonable period afterward for legal, accounting, and dispute-resolution purposes, after which they are deleted or anonymized.

5. Data sharing and disclosure

We do not sell your personal information. We share information only: with service providers who help us operate the Service (as described in Section 3); when a venue's own curator or superadmin accesses data scoped to that venue; if required by law, legal process, or to protect the rights, safety, or property of ExhibIQ, our users, or the public; or with your consent.

6. Data security

We use industry-standard measures -- including encrypted password storage, signed session cookies scoped separately per role, and per-venue data isolation -- to protect information in our care. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights and choices

A curator can review, correct, or delete their venue's content directly from the admin dashboard at any time. Curators and superadmins can request access to, correction of, or deletion of their personal account information, and visitors can ask a venue's curator (or us, via the contact details below) to delete records of their visit, by contacting us at hello@exhibiq.example. Depending on where you are located, you may have additional rights under applicable data protection law; we will honor valid requests consistent with those laws.

8. Children's privacy

The Service is intended for use by venues and their visitors generally, and is not directed at children under 13. We do not knowingly collect personal information from children under 13 without appropriate consent. If you believe a child has provided us personal information, please contact us and we will take appropriate action.

9. International data transfers

We and our service providers may process and store information in countries other than your own. Where required, we take steps intended to ensure such transfers comply with applicable data protection law.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify curators directly. Continued use of the Service after a change becomes effective constitutes acceptance of the updated policy.

11. Contact us

Questions about this Privacy Policy or how we handle your information can be sent to hello@exhibiq.example.