Privacy Policy

1. Who we are

428 Museum provides augmented reality (AR) experiences for museums and cultural institutions, along with an admin panel to manage those experiences. This policy explains what personal data we collect, for what purpose, and what rights you have over it.

2. Data we collect

2.1 Contact form

When you submit the site’s contact form, we collect your name, email, museum or organization (optional), request category, subject and message. This data is stored in our database and forwarded by email to our sales or support team so we can respond to you.

2.2 Admin panel accounts

Access to the Super Admin panel requires an account with an email and password, managed by our authentication provider (Supabase). We don’t store passwords in plain text — this is handled directly by the provider.

2.3 Technical usage data

Our hosting provider (Vercel) may standardly log IP addresses and server access records for security and service-operation purposes. We currently don’t use third-party analytics tools or advertising pixels on the site.

2.4 QR code scans

Whenever someone scans one of our physical QR codes, we record the date and time of the scan along with an approximate location (country, city and low-precision coordinates) derived from the IP address at the moment of the connection. We don’t store the IP address itself, or any other data that identifies the person who scanned the code. We use this information solely so that client museums can confirm their experiences are being used within their own premises.

3. What we use your data for

• Responding to your inquiries or demo requests.
• Providing and managing the service for client museums.
• Sending operational communications related to your request.
• Keeping the platform secure and running correctly.

We don’t sell or rent personal data to third parties.

4. Who we share data with

We use external providers to operate the service, who process data on our behalf under their own security policies:

• Supabase — database and authentication.
• Resend — transactional email delivery (e.g. contact form notifications).
• Vercel — hosting and site delivery.

5. Your rights

Under Colombia’s Ley 1581 de 2012 and equivalent regulations, you can request access, correction, updating or deletion of your personal data, as well as revoke your authorization for its processing, by writing to admin@428museum.com.

6. Data retention

We retain contact form data and panel account data for as long as an active business relationship exists or as needed for the purposes described in this policy, unless the law requires a different period.

7. Changes to this policy

We may update this policy from time to time. We’ll post any changes on this same page with a new update date.

8. Contact

For privacy questions, write to us at admin@428museum.com.