PRIVACY POLICY

Last updated June 8, 2026

This Privacy Notice for MUSAY Inc. ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://www.musay.com or any website of ours that links to this Privacy Notice
• Download and use our mobile application (MUSAY), or any other application of ours that links to this Privacy Notice
• Use MUSAY Inc.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@musay.com.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics using the table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. This includes your responses to MUSAY's MyStory, our AI-powered feedback tool.

Do we process any sensitive personal information? We do not ask for sensitive personal information or collect it through our forms. Because MUSAY's MyStory invites open-ended reflection, your free-text responses may contain sensitive information you choose to share. We use it to generate aggregated, de-identified insights, and — for users 18 and older — it may inform the personalized recommendations we provide to our partners. We do not use it for advertising. You can tell us not to use your sensitive information for personalization at any time. See "Sensitive Information" in Section 1 and Section 13.

Do we collect any information from third parties? We do not buy or obtain personal information about you from data brokers, list vendors, or data-enrichment services. The one exception is that if you choose to register or log in using a social media account, we receive certain profile information from that provider at your direction (see Section 7). Service providers that process information on our behalf — such as our analytics providers — are described in Sections 4 and 5.

How do we process your information? We process your information to provide, improve, and administer our Services, to generate aggregated, de-identified analytics for participating cultural institutions and independent venue partners and to communicate with you. We also apply artificial intelligence and machine learning techniques to MUSAY MyStory responses for analytics purposes. We process your information only when we have a valid legal reason to do so.

In what situations and with which types of parties do we share personal information? We share aggregated, de-identified analytics with participating cultural institutions & independent venue partners. With your consent, we may also share individual excerpts ("quotes") from your MUSAY MyStory responses, or your name and email address, with a specific institution — for example, when you opt in to share quotes or to take part in a venue's incentive program. See Section 4 for all the ways we share information.

How do we keep your information safe? We implement reasonable technical and organizational security measures. No internet transmission or storage technology is fully secure, so we cannot guarantee that unauthorized parties will not defeat our security.

What are your rights? Depending on where you are located, applicable privacy law may provide you with rights regarding your personal information, including the right to access, correct, delete, and withdraw consent for certain data-sharing activities.

How do you exercise your rights? The easiest way is by contacting us at privacy@musay.com.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. AI-POWERED FEATURES
7. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
14. GEOLOCATION
15. DO WE MAKE UPDATES TO THIS NOTICE?
16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names
• phone numbers
• email addresses
• usernames
• passwords
• age
• and other information you choose to provide through the Services

MUSAY MyStory Responses. When you engage with MUSAY's MyStory — whether initiated by a participating cultural institution or through the MUSAY app — we collect your responses, including demographic information, free-text feedback, and any other information you provide during the conversation. If you have a MUSAY account, your MUSAY MyStory responses are saved to your account so you can access them later.

Sensitive Information. We do not ask you for sensitive personal information (such as information revealing racial or ethnic origin, religious beliefs, or health), and we do not collect it through our registration forms or demographic fields. Because MUSAY's MyStory invites open-ended reflection, your free-text responses may contain sensitive information you choose to share. We use this information to generate aggregated, de-identified insights for participating cultural institutions, and — for users 18 and older — it may inform the personalized recommendations we provide (see Section 2 and Section 13). We do not use it to deliver advertising or to make decisions that produce legal or similarly significant effects on you. You can choose not to include sensitive information in your MUSAY MyStory responses, and you can tell us not to use your sensitive information for personalization as described in Section 13.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Instagram, Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in Section 7 below.

Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

• Geolocation Information. We may request access or permission to track location-based information from your mobile device, either continuously or while you are using our mobile application(s), to provide certain location-based services. If you wish to change our access or permissions, you may do so in your device's settings.
• Mobile Device Access. We may request access or permission to certain features from your mobile device to provide and improve the Services. These may include location services, camera, contacts, calendar, and other features. You can manage these permissions at any time in your device's settings.
• Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model, Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the phone network associated with your mobile device, your mobile device's operating system or platform, the type of mobile device you use, your mobile device's unique device ID, and information about the features of our application(s) you accessed.
• Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information generally does not directly identify you (it does not include your name or contact information), but it may include identifiers such as your IP address and device characteristics, along with other device and usage information — operating system, language preferences, referring URLs, device name, country, location, how and when you use our Services, and other technical information. Some of this information may be considered personal information under applicable law, and we treat it accordingly (see Section 8). It is primarily needed to maintain the security and operation of our Services and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

• Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically record in log files when you access or use our Services. This may include your IP address, device information, browser type and settings, information about your activity in the Services (such as date/time stamps, pages and files viewed, searches, and which features you use), and device event information (such as system activity, error reports — sometimes called "crash dumps" — and hardware settings).
• Device Data. Information about the computer, phone, tablet, or other device you use to access the Services. Depending on the device, this may include your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location Data. Information about your device's location, which can be either precise or imprecise; how much we collect depends on the type and settings of your device. For example, we may use GPS and similar technologies to collect precise geolocation data, or derive a more approximate location from your IP address. Precise geolocation is collected only with your express consent (see Section 14). You can opt out by refusing access or by disabling your device's Location setting; if you opt out, you may not be able to use certain aspects of the Services.

Google API

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see Section 11 below.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.
• Improve, develop, and validate our analytics algorithms and models.
• Reprocess previously collected MyStory responses using updated analytics methods to improve the quality of insights.
• Generate aggregated, de-identified analytics for participating cultural institutions.
• Apply artificial intelligence and machine learning techniques to MyStory responses to generate insights, including sentiment analysis and trend identification.
• Provide personalized recommendations. For users 18 and older, we may use automated models to analyze the interests reflected in your activity — including in your MyStory responses — to suggest content, exhibits, or experiences that may be relevant to you. Because your responses may touch on sensitive topics, this processing may involve sensitive information, and you can tell us not to use your sensitive information for personalization (see Section 13). This feature is not available to users under 18.

Note on AI Processing: MUSAY's MyStory is powered by AI (as described in Section 6). In addition to powering the conversation itself, our AI tools process your MUSAY MyStory responses for analytics purposes, including sentiment analysis and trend identification, and — for users 18 and older — may generate personalized recommendations based on the interests reflected in your activity (see Section 13). If you opt in to share quotes with a cultural institution, our automated tools also select which excerpts to share (see Section 4 for details on the quote-sharing consent process).

If you indicate interest in sharing feedback directly with an institution, we may notify you if that institution enables the ability to receive visitor feedback in the future.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We process your personal information when we have a valid legal reason to do so under applicable law.

We process your personal information based on applicable US federal and state law, including with your consent, to perform our contractual obligations, to comply with legal requirements, and to pursue our legitimate business interests. As our operations evolve, we will update this Privacy Notice to reflect any additional legal requirements that become applicable.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We share data with third-party service providers who perform services on our behalf, including cloud hosting, analytics, authentication, and AI-powered features. These providers access personal information only as needed to perform their services and are required to protect it. We require our service providers to protect personal information and to use it only as directed for the purposes of providing their services.

Participating Cultural Institutions & Independent Venue Partners. We share information with participating venues in four ways:

1. Aggregated Analytics (Default): We share de-identified, aggregated demographic data about visitor interactions (such as age ranges, general location data, visit patterns, and aggregated MyStory insights) with participating venues to help them understand visitor engagement. This data cannot identify individual users.

2. Venue Incentive Programs (With Your Consent): Some venues may offer discounts, benefits, or promotional offers in exchange for your contact information. If you choose to participate in these optional programs, we will share your name and email address with that specific venue so they can provide you the offered benefit. Participation is voluntary, and you may decline without affecting your ability to use MUSAY services.

3. MUSAY MyStory Quotes and Contact Sharing (With Your Consent): When you use MUSAY's MyStory at a participating venue, you may choose to share excerpts from your responses with that institution. You may also separately choose to share your contact information so the institution can follow up about your feedback. Both choices are voluntary, off by default, and not required to use MUSAY's MyStory. Your consent applies only to the specific institution and session.

   If you opt in to share quotes, MUSAY uses automated tools to select relevant excerpts from your responses. Your quotes are shared without your name or contact information attached unless you also choose to share your contact information. Consented quotes are personal data — we do not claim to de-identify them, because verbatim text carries inherent re-identification risk regardless of whether your name is attached. The institution that receives your quotes becomes responsible for how it uses them, in accordance with its own privacy practices.

   You can withdraw consent at any time through your account settings. If you withdraw consent, we notify the institution and require them to delete the relevant data within 30 days. This pathway is separate from Aggregated Analytics — the de-identified data we share with institutions is not affected by your quote-sharing choices.

4. Feedback Interest Signal: You may indicate that you would like a participating cultural institution to hear your feedback directly. This is an expression of interest, not consent to share your data — it does not cause your responses to be shared with the institution. We may use this preference to notify you if the institution enables the ability to receive visitor feedback in the future, at which point you will be asked for consent before any data is shared. We report the number of visitors who have expressed interest to the institution as part of our aggregated analytics; this count does not identify individual users.

Our Business Model — What We Share and What We Don't. MUSAY does not sell your personal information to third parties for their advertising or marketing purposes. We generate revenue by providing aggregated, de-identified analytics to participating cultural institutions based on visitor interactions, including MUSAY MyStory responses. Individual responses are never shared with an institution unless you explicitly opt in to share quotes with that specific institution (see above). We do not share your personal information with data brokers, advertisers, or any party other than the cultural institution you are providing feedback about.

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Mapping Services. We use mapping services to provide location-based features within the Services. Your location data may be processed by our mapping service provider in accordance with its privacy policy.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use cookies and similar technologies to collect usage information and improve the Services.

We use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. These technologies help us maintain security, prevent crashes, fix bugs, save your preferences, and support basic site functions.

We use Google Analytics to understand how users interact with our Services. To opt out of being tracked by Google Analytics, visit https://tools.google.com/dlpage/gaoptout. For more on Google's privacy practices, see the Google Privacy & Terms page.

We do not display third-party advertisements within our Services and do not use tracking technologies to serve targeted advertising. We may advertise our own Services on third-party platforms (such as social media), which are governed by those platforms' privacy policies.

6. AI-POWERED FEATURES

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

Our Services include features powered by artificial intelligence, including MyStory — an AI-powered tool that helps you capture and reflect on your experiences at cultural institutions. When you use MyStory, you are interacting with an AI system. We also use AI to process your responses for analytics purposes, including sentiment analysis and trend identification; and, for users 18 and older, we may use AI to generate personalized recommendations based on the interests reflected in your activity (see Section 13). If you opt in to share quotes with an institution, our AI selects relevant excerpts from your responses (see Section 4). We may add AI-powered features to the Services in the future and will update this Privacy Notice accordingly.

AI Service Providers. We provide AI-powered features through third-party service providers. We select providers whose data handling practices are consistent with our commitments in this Privacy Notice, and we maintain agreements with these providers that govern how they process your information. Our current AI service providers are listed on our trust center at https://trustcenter.musay.com.

7. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services let you register and log in using your third-party social media account details (like your Instagram or X logins). If you do, we will receive certain profile information about you from your social media provider. This information may vary by provider but will often include your name, email address, friends list, and profile picture, along with other information you choose to make public on that platform.

We will use this information only for the purposes described in this Privacy Notice or otherwise made clear to you on the relevant Services. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We retain different categories of information for different periods, based on the purpose for which it was collected.

The periods below reflect the purpose for which each category was collected:

Category	Retention	What Happens After
Account information (name, email, username)	Life of account	Deleted within 90 days of account closure
MyStory responses (account users)	Life of account	Deletable by you at any time through account settings
MyStory responses (non-account visitors)	Up to 36 months	Anonymized or deleted
Consented quotes and contact info	While your consent is active	Deleted on consent withdrawal; institution notified to delete within 30 days
De-identified data (processed values with identity link removed)	Indefinitely	No longer personal information
Aggregated analytics	Indefinitely	No longer personal information; not affected by account closure or content deletion
Device and usage data	Up to 36 months	Deleted or anonymized
Privacy request records (deletion, access, correction, consent withdrawal, etc.)	48 months from request date	Retained as a compliance record under applicable state privacy laws (e.g., CCPA §1798.130). Record contains request type, dates, identifier sufficient to verify the request, and outcome.

When you delete content or close your account, we remove the personal data from our active systems. Data already de-identified or aggregated is retained because it can no longer identify you. We may retain personal information beyond these periods where required by law.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect any personal information we process. However, despite these safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to minors.

MUSAY complies with the Children's Online Privacy Protection Act (COPPA), including the 2025 COPPA Final Rule. The Services are intended for users aged 13 and older. We screen users at registration to confirm they meet this age requirement. We do not knowingly collect personal information from children under 13.

We do not retain personal information from any user known to be under 13 for any purpose, including analytics improvement or algorithm training. If data from an under-13 user is identified after processing, both the raw MyStory responses and any derived processed data are deleted.

Quote sharing, contact sharing, and feedback interest for users under 18: The quote-sharing consent, contact-sharing consent, and feedback interest signal are all disabled for users under 18. Users under 18 may use MUSAY's MyStory, but their responses are processed only through the aggregated, de-identified analytics pathway. We do not engage in behavioral advertising or profiling of users under 18.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your state or country of residence, you may have rights that allow you greater access to and control over your personal information.

Depending on your state or region of residence, you may have rights under applicable privacy law. These rights include:

• Access: You may request access to the personal information we maintain about you.
• Correction: You may request correction of inaccurate personal information.
• Deletion: You may delete individual content (including MUSAY MyStory responses) or your entire account through your account settings. When you delete content, we remove the associated personal data from our active systems. De-identified or aggregated data derived from that content is retained, as it can no longer identify you.
• Withdraw consent: If you have opted in to share quotes or contact information with a cultural institution, you may withdraw that consent at any time through your account settings. On withdrawal, MUSAY notifies the institution and the institution must delete the relevant data within 30 days. Withdrawal does not affect processing that occurred before withdrawal.
• Portability: You may request a copy of the personal information you have provided to us.
• Opt-out of marketing: You may unsubscribe from marketing communications at any time.

To exercise any of these rights, or for questions about our processing, contact us at privacy@musay.com.

Account Information. If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements.

Cookies and similar technologies: Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove or reject cookies, this could affect certain features or services of our Services.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. The World Wide Web Consortium discontinued the DNT standardization effort in 2019, and DNT has been effectively superseded by other opt-out preference signals such as Global Privacy Control (described below). We do not currently respond to DNT browser signals.

California law requires us to disclose how we respond to web browser DNT signals. As described above, we do not respond to DNT signals at this time.

Global Privacy Control. Global Privacy Control (GPC) is a browser-based signal that lets users opt out of the sale of their personal information or its sharing for cross-context behavioral advertising under California and similar state privacy laws (see globalprivacycontrol.org). MUSAY does not sell personal information or share it for cross-context behavioral advertising (see §13). Our analytics on www.musay.com operate under a service-provider relationship with Google for first-party analytics only — not for advertising or personalization. Because no sale or share is occurring, GPC signals are not applicable to MUSAY's processing today. If our processing ever changes such that GPC becomes applicable, we will update this Privacy Notice and implement the corresponding controls.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Depending on your state of residence, you may have additional privacy rights under applicable state laws.

Depending on your state of residence, you may have rights under applicable state privacy laws, including the right to know what personal information we collect, the right to access or delete your personal information, the right to correct inaccuracies, and the right to opt out of certain data practices.

MUSAY does not sell your personal information as defined by applicable state privacy laws, and does not share your personal information for advertising purposes.

Automated Processing and Personalized Recommendations. MUSAY uses artificial intelligence and machine learning to power MyStory and to process your responses for analytics purposes such as sentiment analysis and trend identification. For users 18 and older, we may also use automated models to analyze the interests reflected in your activity — including in your MyStory responses — to provide personalized recommendations, such as suggesting content, exhibits, or experiences you may find relevant. These models identify patterns and affinities in your responses; because your responses may reflect sensitive topics, the affinities the models identify can correlate with sensitive characteristics, and to that extent this processing may involve your sensitive personal information. We use it only to provide recommendations and our other described purposes — not to deliver advertising, and not to make decisions that produce legal or similarly significant effects on you. This processing may be considered profiling under some state privacy laws. Personalized recommendations are not available to users under 18.

Your choices. You can tell us not to use your sensitive personal information for personalization at any time through your account settings or by contacting privacy@musay.com. If you do, we will not use sensitive information to tailor your recommendations; recommendations may continue based on other, non-sensitive information, and you can still use the Services. This setting is turned off (opted out) for users under 18. When you opt in to share quotes with an institution, our automated tools select relevant excerpts from your responses — but the decision of whether to share is yours (via the opt-in toggle), and you can withdraw that consent at any time.

To exercise your privacy rights or for questions about our processing, contact privacy@musay.com.

14. GEOLOCATION

Precise geolocation data is collected only with your express consent and can be revoked at any time through your device settings.

15. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date at the top. If we make material changes, we may notify you either by prominently posting a notice of the changes or by sending you a direct notification. We encourage you to review this Privacy Notice frequently to stay informed of how we are protecting your information.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at privacy@musay.com or contact us by post at:

MUSAY Inc.

73 White Bridge Road, Suite 103-130

Nashville, TN 37205

United States