Privacy Policy

1.1   ArtGuide is operated by UX LAB LIMITED, a company registered in New Zealand. We operate the ArtGuide web application available at art-guide.app (the Service), which provides AI-powered audio guide descriptions for museum artworks.

1.2   This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service. By using ArtGuide, you agree to the collection and use of information in accordance with this policy.

1.3   If you have any questions about this Privacy Policy, please contact us at uxlab.nz@gmail.com.

2.1 Information you provide directly

2.1.1   Email address, when you sign up via magic link email authentication.

2.1.2   Name and profile picture, when you sign in via Google or Facebook. We receive only the basic profile information those services share with us.

2.2 Information collected automatically

2.2.1   Scan history, including the artworks you photograph or identify, artwork titles, and museum names.

2.2.2   Usage data, including how you interact with the Service, features used, and scan counts.

2.2.3   Device information, including browser type, operating system, and device type.

2.2.4   IP address and approximate location, used to comply with regional legal requirements and to improve the Service.

2.3 Payment information

2.3.1   We use Stripe to process payments. We do not store your credit card details or full payment information on our servers. Stripe's privacy policy is available at stripe.com/privacy.

2.4 Analytics information

2.4.1   We use Google Analytics 4 to understand how users interact with ArtGuide. This collects anonymised usage data including pages visited, time spent, and general location at country or city level. This requires your consent in regions where applicable. See clause 7 for details.

3.1   To provide and operate the ArtGuide Service, including authenticating your account and tracking your free scan allowance.

3.2   To process payments for Day Pass and Weekly Pass purchases via Stripe.

3.3   To generate personalised audio guide descriptions using AI. Your artwork photos are sent to OpenAI's API for processing and are not stored by us beyond the duration of your session.

3.4   To improve and develop the Service, including understanding which artworks and museums are most used.

3.5   To communicate with you about your account or in response to support requests.

3.6   To comply with legal obligations.

3.7   To analyse usage patterns via Google Analytics, with your consent where required.

4.1   We do not sell your personal information.

4.2   We share your information only with the following third-party service providers, and only to the extent necessary to operate the Service.

4.3   Supabase is our database and authentication provider. It stores your account information and scan history. Data is stored on servers within the European Union.

4.4   OpenAI processes artwork images to generate identifications and audio descriptions. Images are sent to OpenAI's API and are subject to OpenAI's privacy policy at openai.com/privacy.

4.5   Stripe processes payments and is subject to Stripe's privacy policy at stripe.com/privacy.

4.6   Google Analytics provides anonymised usage analytics and is subject to Google's privacy policy at policies.google.com/privacy.

4.7   Vercel hosts the ArtGuide web application and is subject to Vercel's privacy policy at vercel.com/legal/privacy-policy.

4.8   All third-party providers are contractually required to protect your information and use it only for the purposes we specify.

5.1   Account information is retained for as long as your account is active, or until you request deletion.

5.2   Scan history is retained for 12 months from the date of each scan, then automatically deleted.

5.3   Payment records are retained for 7 years as required by New Zealand tax law.

5.4   Analytics data is retained in accordance with Google Analytics default retention settings, which is 14 months.

6.1 All users

6.1.1   Right to access. You can request a copy of the personal information we hold about you.

6.1.2   Right to correction. You can ask us to correct inaccurate information.

6.1.3   Right to deletion. You can request that we delete your account and associated personal data, subject to legal retention requirements.

6.1.4   Right to data portability. You can request your data in a portable format.

6.2 European Economic Area users

6.2.1   If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR).

6.2.2   Right to object to processing. You can object to processing of your personal data in certain circumstances.

6.2.3   Right to restrict processing. You can ask us to restrict how we use your data.

6.2.4   Right to withdraw consent. Where processing is based on consent, such as analytics cookies, you can withdraw consent at any time.

6.2.5   Right to lodge a complaint. You have the right to lodge a complaint with your local data protection authority.

6.2.6   Our legal basis for processing your personal data is: contract performance to provide the Service you have signed up for; legitimate interests to improve and secure the Service; consent for analytics; and legal obligation for payment records.

7.1   ArtGuide uses essential cookies required for authentication and core Service functionality. These cannot be disabled without preventing the Service from working correctly.

7.2   ArtGuide uses Google Analytics 4 cookies to understand usage patterns. These require your consent if you are located in the EU or EEA, and can be declined via our cookie consent banner without affecting your ability to use the Service.

7.3   If you are located in the EU or EEA, you will be presented with a cookie consent banner when you first visit ArtGuide. You can update your preferences at any time via the cookie settings link in the footer.

8.1   We implement appropriate technical and organisational measures to protect your personal information.

8.2   All data is transmitted using HTTPS encryption.

8.3   Our database uses row-level security to ensure users can only access their own data.

8.4   Authentication is handled by established OAuth providers and Supabase's secure authentication infrastructure.

8.5   We do not store payment card details. All payment processing is handled by Stripe's PCI-compliant infrastructure.

8.6   No method of electronic transmission or storage is completely secure. While we use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

9.1   UX LAB LIMITED is based in New Zealand. Your information may be processed and stored in countries other than your own, including the United States and European Union member states, where our service providers operate.

9.2   We ensure appropriate safeguards are in place for all international data transfers in accordance with applicable data protection law.

10.1   ArtGuide is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13.

10.2   If you believe we have inadvertently collected personal information from a child under 13, please contact us at uxlab.nz@gmail.com and we will delete it promptly.

11.1   We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page with an updated date.

11.2   We encourage you to review this policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

12.1   If you have any questions about this Privacy Policy, wish to exercise your rights, or have a complaint about how we handle your personal information, please contact us using the details below.