Legal
Privacy Policy
Last updated: October 14, 2026
This policy explains how Museoo AB collects and uses personal data when you visit museoo.io, contact us, request a demo or a quote, apply for a job, or use the Museoo platform as a customer.
1. Who is responsible for your data
The data controller is Museoo AB, Swedish limited company (aktiebolag), registered with Bolagsverket (Swedish Companies Registration Office). Registered office: Dragarbrunnsgatan 46, 753 20 Uppsala, Sweden.
For any privacy question or request, write to info@museoo.io.
2. Scope
This policy covers this website and the data of our customers (museums, institutions and their team members).
When a museum publishes an audio guide with Museoo, the museum decides how its visitors' data is used and is the controller of that data. Museoo processes it on the museum's behalf, as a processor, under a data processing agreement. Visitors should refer to the privacy notice of the museum they are visiting.
3. What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, organisation, role, phone and message you send through our contact, demo or quote forms | Answer your request and prepare a demo or an offer | Steps prior to a contract; legitimate interest in answering business enquiries |
| Account and billing data of customers (contact person, company details, plan, codes sold, invoices) | Provide the service, invoice plan fees and commissions | Performance of the contract; legal obligation (accounting) |
| CV and information you send when applying for a job | Evaluate your application | Steps prior to a contract; your consent for keeping it for future openings |
| Browsing data collected by HubSpot cookies (pages visited, visit dates, approximate location) | Understand interest in Museoo and follow up on business contacts | Your consent, given through the cookie banner |
| Organisation inferred from your IP address by Leadfeeder (company name, pages visited, visit dates) | Understand which organisations are interested in Museoo | Your consent, given through the cookie banner |
| Ad interaction data collected by Google Ads cookies (ad clicked, pages visited, whether you sent a request) | Measure the results of our advertising | Your consent, given through the cookie banner |
| Aggregated, anonymous statistics from Umami (pages viewed, referrer, device type) | Measure and improve the website | Legitimate interest; Umami uses no cookies and does not identify you |
| Technical logs (IP address, browser, time of request) | Keep the website secure and working | Legitimate interest |
We do not sell your personal data and we do not use it for automated decisions with legal effects.
4. Who we share data with
We use carefully selected providers who process data on our behalf, under contracts that protect it:
- HubSpot — CRM, forms and website tracking (only with your consent)
- Leadfeeder (Dealfront) — identification of the organisations visiting the website (only with your consent)
- Google Ads — measurement of our advertising campaigns (only with your consent)
- Formspark — handling of form submissions
- Umami Cloud — cookieless, anonymous website analytics
- Vercel — website hosting
- Sanity — management of website content (blog, careers, support articles)
Data may also be shared with authorities when required by law, and with our accountants for invoicing and bookkeeping.
5. Transfers outside the EU/EEA
Some providers are based in, or may access data from, countries outside the European Economic Area, such as the United States. In those cases transfers rely on an adequacy decision (for example the EU–US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Requests and business contacts: up to 24 months after our last interaction, unless a contract follows.
- Customer and billing data: for the duration of the contract, then for 7 years as required by Swedish accounting law (Bokföringslagen).
- Job applications: up to 12 months after the recruitment ends, or longer only with your consent.
- HubSpot, Leadfeeder and Google Ads cookies: as described in the Cookie Policy.
7. Your rights
Under the GDPR you can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw it at any time — for cookies, through "Cookie settings" at the bottom of every page.
To exercise your rights, write to info@museoo.io. We reply within one month.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, www.imy.se) or with the data protection authority of the country where you live.
8. Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections, access controls and providers that meet recognised security standards.
9. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version; significant changes will be communicated to customers in advance.
Other legal documents