Privacy Policy for VibeMuse

Effective Date: May 22, 2026

Welcome to VibeMuse ("we," "us," or "our"). For the purposes of applicable data protection laws, Dataocean AI Inc., a company incorporated under the laws of the State of Washington, having its registered office at 100 N Howard St, Spokane, WA, 99201-0508, USA, is the data controller of your Personal Information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the VibeMuse iOS mobile application and related websites that link to this Privacy Policy (collectively, the "Service").

1. Information We Collect

We collect information that can identify, relate to, describe, or be reasonably linked with you ("Personal Information").

Information You Provide Directly.

Account and Authentication Data: When you register, you may choose to use your email address or third-party authentication services (such as Apple Sign-In or Google Sign-In). If you use these services, we will receive your basic profile information (e.g., email address and name) strictly to create and authenticate your account.

(2) Multimodal Inputs (Images, Voice, and Video): When you use our text, voice, video modes or "Snap & Learn" feature, we process the media you capture or upload to generate AI-powered guides. Biometric Disclaimer: Please note that any audio recordings or video frames are processed solely to understand your query regarding the artworks. We do not collect, extract, or store any biometric identifiers (such as voiceprints, facial geometry, or face recognition data) to identify you or any other individual.

Information Collected Automatically. We automatically collect certain technical and usage data when you interact with the Service. This includes your device model, operating system version, unique device identifiers, IP address, locale, and language preferences. We also collect behavioral data such as the artworks you view and your selected AI persona. This data helps us improve the Service and is analyzed in aggregate.

Others.

(1) Chat History: To provide a personalized experience, we collect and store your interaction history, including the artworks you have scanned and your AI-generated guides, as part of your chat history. This data is securely stored on our cloud-hosted servers (including a PostgreSQL database and related application infrastructure linked to your account) and is linked to your account. You may clear your active chat history from your view or delete your entire account and associated data at any time.

(2) Cookies and Tracking Technologies: While VibeMuse is primarily a mobile application, we and our authorized service providers use local storage (such as authentication or session tokens stored on your device to keep you logged in) and embedded SDKs to collect essential usage data. We do not use any non-essential tracking technologies without your consent.

1A. Purchases, Subscriptions, and Payment Transaction Data

How payments work. Paid features are currently offered through in-app purchases processed by Apple through the Apple App Store. We use RevenueCat as a subscription and entitlement management service to help us validate purchases, sync your subscription status across devices, and support features such as Restore Purchases. Payment card numbers and full wallet details are collected and processed by Apple; we do not receive your full card number or full wallet details.

What we record (transaction-level data). When you purchase or manage a subscription or other in-app product, we may collect and retain transaction records needed to operate the Service and meet legal obligations. This may include: the product or plan you selected (for example, Day Pass, Monthly, or Annual), displayed price and currency, tax-related amounts where available, country or region code, Apple App Store transaction-related metadata, subscription status events (such as renewal, cancellation, or refund indicators), and limited transaction identifiers needed for customer support, fraud prevention, accounting, and dispute handling. We do not store raw payment receipts in full, complete bank account numbers, or your full billing street address as part of these records.

Why we keep it. We use this information to: (a) activate, maintain, and restore your paid entitlements across devices; (b) provide customer support and investigate billing issues; and (c) comply with tax, financial record-keeping, and regulatory requirements.

Retention. We retain Personal Information only as long as necessary for the purposes described in this Policy. Certain transaction records may be retained for longer periods where required for tax, accounting, or legal compliance, after which we delete or irreversibly anonymize them consistent with our retention practices. Operational security and integrity events related to purchase flows may be retained for a shorter period for monitoring and abuse prevention.

Account deletion and financial records. If you request deletion of your account, we will delete or anonymize Personal Information associated with your account in line with applicable law. Please understand that where we are required to retain certain transaction information for legal or financial compliance, we may retain limited non-identifying or anonymized records (for example, aggregated totals) rather than fully deleting all historical transaction data.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your account and authenticate you when you log in.
• To provide paid features you purchase and to record and support entitlements tied to your account.
• To power the "Snap & Learn" feature by sending uploaded images and queries to our AI processing partners (OpenAI, and MiniMax where we use it for text-to-speech) to generate artwork descriptions, and to support artwork knowledge retrieval using structured reference data and processing on our own systems.
• To understand how users interact with the Service, identify areas for improvement, and develop new features.
• To send you important service notifications and security alerts.

3. Our Lawful Basis for Processing (For EEA/UK Users):

If you are located in the European Economic Area (EEA) or the UK, we process your personal data under the following lawful bases:

Contractual Necessity: To provide the Service you requested, such as creating your account, delivering purchased entitlements, and generating AI guides for artworks.

Legitimate Interests: To analyze aggregated usage data to improve our Service, maintain security, prevent fraud, and keep limited purchase records needed to operate billing and entitlements.

Legal Obligation: Where we must process and retain certain transaction records to comply with tax, accounting, or regulatory requirements.

Consent: We may use your email address to send you updates and promotional offers. If we do so, we will provide a clear mechanism for you to opt out of receiving such communications at any time.

4. How We Share Your Information

We do not sell your Personal Information to third parties. We share information only with third-party service providers who perform services on our behalf:

We may also disclose your information if required to do so by law, court order, or government regulation.

No sale / no cross-context behavioral advertising. To the extent required by applicable U.S. state privacy laws, we do not "sell" or "share" Personal Information for cross-context behavioral advertising as those terms are defined under those laws.

5. International Data Transfers

VibeMuse operates globally, and our primary servers and third-party service providers (such as our cloud hosting and database providers, OpenAI, MiniMax, Cloudinary, RevenueCat, Apple, and other service providers described in this Policy) are located in the United States or other countries. By using the Service, you acknowledge that your Personal Information may be transferred to, stored, and processed in the United States or other countries where our partners operate, which may have data protection laws different from those of your country of residence. We ensure appropriate safeguards are in place for such transfers where required.

6. Data Security

We implement industry-standard technical and organizational measures (such as encrypted data transmission and access controls at the application and infrastructure layers) designed to secure your Personal Information from accidental loss and unauthorized access. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

7. Data Retention and Your Right to Delete Your Account

We retain your Personal Information only for as long as necessary to provide the Service and for the purposes described in this Policy, including legal, tax, and accounting obligations for transaction records where applicable. You have the right to delete your account and associated personal data at any time, subject to applicable exceptions. To do so, navigate to the Account Deletion option in the app's Profile → Security (Delete Account), following the path implemented in the current app.

8. Children's Privacy

The Service is not directed to children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect Personal Information from children. If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us at privacy@vibemuse.app. If we become aware that we have collected Personal Information from a child without legally valid consent, we will take immediate steps to delete such information from our servers and deactivate the associated account.

9. Your Privacy Rights

Depending on your location (e.g., under the GDPR, UK GDPR, or U.S. state privacy laws), you may have the following rights regarding your Personal Information:

The Right to Access: You can request a copy of the personal data we hold about you.

The Right to Rectification: You can request that we correct any inaccurate or incomplete data.

The Right to Erasure / Deletion: You can request the deletion of your account and personal data (accessible directly via Profile → Security → Delete Account in the app), subject to exceptions required by law.

The Right to Data Portability: You can request to receive your data in a structured, commonly used format where applicable.

The Right to Withdraw Consent: You may withdraw your consent to our processing at any time (e.g., opting out of marketing emails).

U.S. state privacy rights: Depending on where you live, you may have additional rights such as opting out of certain processing activities, appealing certain decisions, or contacting your local regulator. We will not discriminate against you for exercising privacy rights granted by law.

To exercise any of these rights, please contact us at privacy@vibemuse.app. We will respond in accordance with applicable law.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Effective Date" at the top. If changes are material, we will provide additional notice as required by law (for example, via the Service or email).

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@vibemuse.app or visit https://vibemuse.app/privacy.