# Privacy Policy Muze B.V. (trading as Muze, “Muze”, “we”, “us”, or “our”) is a company registered in the Netherlands under Chamber of Commerce number 96166649, with its registered office at Bloemgracht 59-1, 1016 KE, Amsterdam. Muze is the controller of your personal data when you use the Muze services, including the website muze.so [http://muze.so], mobile and desktop apps, APIs, widgets, embedded features, and any other products or services that link to this Privacy Policy (collectively, the “Services”). If you are a resident of India, the controller of your personal data is our affiliate Stroopwafel Private Limited (CIN U62011KA2025PTC209024), with its registered office at 12/1 FE, Lake Shore Homes, Kasavanahalli, Bengaluru 560035, Karnataka, India. References to “Muze” in this Policy include the relevant controller for your jurisdiction. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, and what rights and choices you have. By accessing or using the Services, you confirm that you have read and understood this Privacy Policy and consent to the processing described here where consent is the applicable legal basis. We process personal data only where we have a lawful basis under applicable data-protection laws, including the General Data Protection Regulation (GDPR), the EU-US Data Privacy Framework (where applicable), the Digital Personal Data Protection Act 2023 (India), and other relevant laws. -------------------------------------------------------------------------------- 1. CATEGORIES OF PERSONAL DATA WE COLLECT 1.1 DATA YOU PROVIDE DIRECTLY a. Account registration information (username, email address, phone number, password, date of birth) b. Profile information (display name, bio, profile picture, header image, location, website link) c. Content you create or upload (posts, replies, direct messages, media files, live streams) d. Contacts you choose to upload or sync e. Payment and billing information (when you use paid features) f. Communications you send us (support requests, feedback, reports) g. Preferences, settings, and survey responses -------------------------------------------------------------------------------- 1.2 DATA COLLECTED AUTOMATICALLY a. Device and browser information (device type, operating system, unique device identifiers, browser type and version, IP address) b. Log and usage data (pages viewed, interactions, timestamps, referring URLs, search terms) c. Approximate or precise location data (if you enable location services or as derived from your IP address) d. Cookie and similar technology identifiers (see Section 9) e. Inferred data (for example, interests or demographic categories derived from your activity) -------------------------------------------------------------------------------- 1.3 DATA RECEIVED FROM THIRD PARTIES a. Advertising and measurement partners (advertising IDs, campaign performance data) b. Third-party services you connect (for example, single sign-on providers) c. Publicly available data or data from other users (for example, when you are mentioned or tagged) We may combine data from these sources to provide and improve the Services. -------------------------------------------------------------------------------- 2. PURPOSES AND LEGAL BASES FOR PROCESSING We process your personal data for the following purposes and legal bases: a. To create and manage your account, deliver content, enable messaging and interactions, and provide core functionality – necessary to perform our contract with you (the Terms of Service). b. To personalize your experience (recommendations, feeds, suggested accounts, content ranking) – based on our legitimate interests in improving user experience or on your consent where required by law. c. To show relevant advertising and measure advertising effectiveness – based on our legitimate interests in funding the free Services or on your consent where required. d. To develop, train, and improve machine-learning and AI models (including generative features) using your content and interactions – based on our legitimate interests in innovation and service improvement; you may opt out at any time (see Section 6). e. To ensure safety, security, and integrity (fraud prevention, content moderation, abuse detection) – based on our legitimate interests in platform safety and on legal obligations. f. To conduct research, analytics, and product development – based on our legitimate interests in improving the Services. g. To communicate with you (service notifications, policy updates, support, optional marketing) – necessary to perform our contract, to meet legal obligations, or based on your consent. h. To comply with legal obligations and respond to lawful requests – required to meet legal obligations. -------------------------------------------------------------------------------- 3. HOW WE SHARE PERSONAL DATA We do not sell your personal data. We share personal data only in these limited situations: a. With your consent or at your direction (for example, when you share content publicly or connect third-party apps) b. With service providers acting as processors under strict data processing agreements (for example, cloud hosting, analytics, payment processors, customer support tools) c. With affiliated companies within the Muze group for the purposes described in this Policy d. With advertising and analytics partners (typically in pseudonymized or aggregated form) – you can opt out in settings e. For legal reasons (to comply with law-enforcement requests, court orders, or to protect rights, property, or safety) f. In connection with a business transfer (merger, acquisition, or sale of assets) – the successor will be bound by this Policy or provide equivalent protection Public content you post may be shown off-platform (for example, via search engines or embeds) and is visible to anyone. -------------------------------------------------------------------------------- 4. INTERNATIONAL DATA TRANSFERS Your personal data may be transferred to and processed in the Netherlands, other EEA countries, the United States, India, and other countries where our service providers operate. When we transfer personal data outside the EEA or India, we ensure an adequate level of protection by using: a. European Commission adequacy decisions b. Standard Contractual Clauses (SCCs) approved by the European Commission and/or Indian authorities c. The EU-US Data Privacy Framework (for qualifying transfers to the US) d. Binding corporate rules or other approved mechanisms, where applicable You may request a copy of the relevant safeguards by contacting privacy@muze.so [privacy@muze.so]. -------------------------------------------------------------------------------- 5. DATA RETENTION We keep personal data only as long as needed for the purposes in this Policy and to meet legal obligations. a. Account data: kept while your account is active plus 30 days (reactivation window) b. Public content: kept until deleted by you or us; copies may remain in backups for up to 180 days c. Direct messages: kept until deleted or account deactivation d. Analytics and usage logs: up to 18 months e. Advertising data: up to 12 months f. Financial records: up to 7 years (or as required by tax law) g. Data needed to prevent abuse (for example, banned account identifiers): kept indefinitely After the retention period, data is securely deleted or anonymized. -------------------------------------------------------------------------------- 6. YOUR RIGHTS AND CHOICES Subject to local law, you have the right to: a. Access, correct, and receive a copy of your data (portability) b. Request erasure (“right to be forgotten”) c. Request restriction of processing d. Object to processing based on legitimate interests e. Withdraw consent (where processing is based on consent) f. Opt out of AI training, personalized ads, and data sharing with business partners (via Settings → Privacy & Data) g. Be free from discrimination for exercising your rights You can exercise most rights directly in the app or on the website, or by submitting a request at https://muze.so/privacy-request [https://muze.so/privacy-request]. We verify requests and respond within legal timeframes (usually 30 days). Authorized agents may act on your behalf with proof of authorization. -------------------------------------------------------------------------------- 7. CHILDREN’S PRIVACY The Services are not intended for individuals under 15 years of age. We do not knowingly collect personal data from children under 15. If we learn that we have collected such data, we will delete it promptly. Parents or guardians can contact privacy@muze.so [privacy@muze.so] to request removal. 8. SECURITY MEASURES We use technical and organizational measures to protect your data, including encryption (TLS 1.3 in transit, AES-256 at rest), access controls, regular security audits, and incident-response procedures. You are responsible for keeping your password confidential and enabling two-factor authentication. -------------------------------------------------------------------------------- 9. COOKIES AND SIMILAR TECHNOLOGIES We use cookies and similar technologies for authentication, security, analytics, personalization, and advertising. You can find details and manage your choices in Settings → Privacy → Cookies & Tracking and in our Cookie Notice at https://help.muze.so/cookies [https://help.muze.so/cookies]. -------------------------------------------------------------------------------- 10. CHANGES TO THIS PRIVACY POLICY We may update this Policy from time to time. We will notify you of material changes at least 14 days in advance by email and in-app notice, unless changes are required sooner for legal, security, or new-feature reasons. Your continued use of the Services after the effective date means you accept the updated Policy. -------------------------------------------------------------------------------- 11. CONTACT INFORMATION Data Protection Officer / Privacy Team Email: privacy@muze.so [privacy@muze.so] Postal address: Muze B.V. Privacy Office Bloemgracht 59-1 1016 KE Amsterdam Netherlands