Privacy Policy

This policy explains what personal information Histoki ("we", "us") collects through histoki.com and the Histoki platform, how we use it, and the choices you have.

Information we collect

• Information you give us: name, email address, organisation and message content when you email us or request a demo.
• Customer account data: login details and content museums upload to the platform (text, images, audio).
• Visitor usage data: anonymous, aggregated guide usage such as stops played, listening time, language and device type. We do not require museum visitors to create an account.
• Technical data: IP address, browser type and pages visited, collected in server logs for security and reliability.

How we use information

To provide and improve the service, respond to requests, send service messages, keep the platform secure, and meet legal obligations. We do not sell personal information and we do not share it for cross-context behavioural advertising.

Sharing

We share information only with service providers that host, process or support the platform under contract, when required by law, or as part of a merger or acquisition.

Retention and security

We keep personal information only as long as needed for the purposes above or as required by law, and protect it with reasonable administrative, technical and physical safeguards.

Your US privacy rights

Depending on your state (including California under the CCPA/CPRA, and Virginia, Colorado, Connecticut, Utah, Texas and others), you may have the right to:

• know and access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• obtain a portable copy;
• opt out of sale, sharing or targeted advertising (we do none of these);
• not be discriminated against for exercising these rights.

To make a request, email privacy@histoki.com. We will verify your request and respond within the time required by law. An authorised agent may submit a request on your behalf. If we deny a request, you may appeal by replying to our decision.

Global Privacy Control

We honour Global Privacy Control (GPC) browser signals as an opt-out request.

Your rights in the EU, EEA and UK (GDPR)

For people in the European Economic Area, Switzerland and the United Kingdom, Histoki is the data controller for website and demo-request data. For content and visitor data processed inside the platform, the museum is the controller and Histoki acts as processor under a Data Processing Agreement (Article 28 GDPR), available on request.

Our legal bases are:

• performance of a contract, to provide the service to customers;
• legitimate interests, to answer enquiries, secure and improve the service;
• legal obligation, for tax and accounting records;
• consent, where we ask for it, which you can withdraw at any time.

You have the right to access, rectify, erase, restrict or object to processing of your data, and to data portability. Contact privacy@histoki.com; we reply within one month. You may also complain to your local data protection authority.

Where data is transferred outside the EEA, we rely on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. We do not use automated decision-making that has legal effects on you.

Children

The platform is offered to institutions, not children. We do not knowingly collect personal information from children under 13, in line with COPPA. Kids' tours run without collecting children's personal information.

Cookies

This website uses only cookies that are necessary for it to function. We do not use advertising cookies.

Changes and contact

We will post any changes on this page with a new date. Questions: privacy@histoki.com.