This Privacy Policy was last updated on 31 October 2026.
This Privacy Policy explains how WhichMuseum collects and uses personal data when you use our websites, such as whichmuseum.com and whichmuseum.nl, and our apps for iOS and Android (together the "Site"; the apps are the "Apps"). "We", "us" and "WhichMuseum" mean WhichMuseum B.V.
We take your trust in us seriously. We collect only what we need to run the Site, we do not sell your personal data, and the Apps contain no advertising and do not track you across other companies' apps and websites.
If you have questions about this Privacy Policy or your personal data, e-mail [email protected] or use our contact page.
Who is responsible
WhichMuseum B.V., Bilderdijkstraat 118-3, 1053 KZ Amsterdam, the Netherlands, is the controller of your personal data under the General Data Protection Regulation (GDPR). You can reach us at [email protected].
Information that we collect
- When you use the Site without an account
You can use most of the Site without an account. Our servers then receive the technical information every connection carries: your IP address, the address of the page or the request (including search words and, in the Apps, a rounded location; see D), the time, your browser or app version, your device's operating system and language, and the page you came from. We keep this in server logs to run, secure and troubleshoot the Site.
When you search, your search words are sent to our servers to find results. We do not store them with an account. On the website we look at searches only in aggregate, to improve the search function; we do not make reports about individual visitors.
On the website we also use cookies and similar technologies; see section 6.
- When you have an account
If you create an account, we store your name (shown with your reviews), your e-mail address, your password (stored as a secure hash, so we cannot read it), your profile photo if you add one, and your settings and preferences.
You can also sign in with Apple, Google or Facebook. We then receive your name, your e-mail address and an identifier for that account from them, and use them to create or link your WhichMuseum account. If you use Sign in with Apple, you can choose to hide your e-mail address: Apple then gives us a private relay address, we send our e-mails there, and Apple forwards them to you. On iPhone, Facebook sign-in uses Facebook's Limited Login, which Facebook does not use for advertising or tracking; on Android and the website you sign in on Facebook's own website.
- Reviews, photos, lists, reports and blocks
When you write a review or rating, add photos to it, or make a list, we store it with your account. Reviews, ratings, photos and public lists are shown publicly with your name.
When you report a review, we store which review and museum you reported, your account, the reason you chose (spam, offensive, inappropriate, not about the museum, or other), the note you add (up to 500 characters), the account that wrote the review (so we can recognise repeated abuse) and the date. The person whose review you reported is not told who reported it. When you block a user, we store that block with your account; the blocked user is not told.
- The Apps
The Apps work without an account. If you sign in, B and C apply to the Apps too. This part describes what is specific to the Apps.
- Location. The Apps use your location only after you allow it in your device's settings, to show museums near you, on maps and in the home screen widgets. Before it leaves your device, the location is rounded to about 100 metres. We use it only to answer that request and do not store it with your account; it does stay in our server logs for their retention period (section 7). For the home screen widgets, the Apps keep the last rounded location on your device: on Android because Android gives widgets no location of their own, on iOS for when a new location does not come in time. It is deleted when you withdraw the permission. To show the name of the place you are in, your device's own map service (Apple on iOS, Google on Android) turns the location into a place name under its own privacy policy. You can withdraw the permission at any time in your device's settings; the Apps then work without nearby results.
- Camera and photos. When you add a photo to a review or your profile, the Apps ask for your camera or show your photo library only at that moment. We receive only the photos you choose or take. Before uploading, the App removes the photo's metadata, including the place where it was taken.
- Crash reports. When an App crashes or runs into an error, it sends a crash report to Sentry: the error, the app version, the device model and operating system, the steps that led to it (such as which screen was open and which addresses were requested, without search words or locations) and, for about 1 in 10 uses, performance measurements. The report carries a random identifier that the App creates when it is installed, so we can count how many installations an error affects. It is not your device's identifier and is not linked to you or your account. We do not send your name, e-mail address, user ID, IP address, screenshots or recordings.
- Usage statistics. To learn how the Apps are used and where they fall short, the Apps send events to PostHog: which screens you open, such as a museum or place page, and actions such as choosing a place, saving a museum, starting or sending a review and tapping a ticket offer, how many results a search found and which kind of result you tapped, and when the App is installed or updated, opens, goes to the background or fails to load. Each event carries technical details such as the app version, the platform and the language, and a random identifier that the App stores on your device. While you are signed in, the events are linked to your account's user ID, together with that device's earlier events; when you sign out, the App starts a new random identifier. The events never contain your search words, your location, your name or e-mail address, or the text, rating or photos of a review. We do not use them for advertising and do not share them with advertisers.
- App updates. To install improvements without a new store version, the Apps ask our update service (Expo) whether an update is available. Expo receives the app version, the platform and a random identifier for the installation, which is not linked to you.
- Maps. The maps in the Apps are loaded from OpenFreeMap, which receives your IP address and the part of the map you view, not your location or account.
- Reminders. Exhibition reminders are scheduled on your device. We do not use push notifications, and no notification data leaves your device.
- Only on your device. The Apps keep recently viewed museums and searches, your chosen place and range, appearance, language and a copy of your blocked users on your device only. Your sign-in is kept in your device's secure storage (Keychain on iOS, Keystore on Android).
- Ticket offers. When you tap a ticket offer, the partner's website (such as Tiqets or GetYourGuide) opens. The App passes only information that identifies the offer, not personal data. What the partner collects is described in their own privacy policy.
The Apps do not use cookies, advertising identifiers or App Tracking Transparency, and do not track you across other companies' apps and websites.
- When you contact us
When you send us a message through the contact form or by e-mail, we use your name, e-mail address and message to answer you. We also send you service e-mails, such as a confirmation of your account, a password reset or the confirmation that your account was deleted.
- When you use the Site without an account
Why we use your information and on what basis
Purpose Legal basis (GDPR article 6) Your account, your reviews, photos and lists, sign-in with Apple, Google or Facebook, service e-mails Performance of our agreement with you (1 b) Showing museums near you, on maps and in the widgets Performance of our agreement (1 b), only after you allow location in your device's settings Search, the website and the Apps working, server logs, security and preventing abuse (including reCAPTCHA on the website) Our legitimate interest in a working and secure Site (1 f) Moderating reviews and photos, handling reports and blocks Our legitimate interest in a safe Site and our legal obligations for user content (1 c, 1 f) Crash reports in the Apps Our legitimate interest in finding and fixing errors (1 f); the data is not linked to you Usage statistics in the Apps Our legitimate interest in understanding how the Apps are used and improving them (1 f); you can object by e-mail (section 8 A) Analytics and advertising cookies on the website Your consent (1 a), which you can withdraw at any time Answering your questions Our legitimate interest in helping you (1 f), or our agreement when it is about your account (1 b) Keeping data required by law, handling legal claims Legal obligation (1 c) or our legitimate interest (1 f) Where we rely on our legitimate interest, you may object (section 8). We do not use your data for automated decisions that affect you, and we do not sell it.
With whom we share your information
- Service providers
We use the companies below to run the Site. They process personal data only on our instructions, under a data processing agreement.
- Google Cloud (Google Ireland Ltd.): hosting, databases, storage of photos and server logs, in the EU.
- Cloudflare, Inc.: network, security and caching between you and our servers.
- Mailgun (Sinch): sending service e-mails.
- Slack (Salesforce): internal notices to our moderators about reported reviews, with the reporter's and author's names and an excerpt of the review.
- Sentry (Functional Software, Inc.): crash reports from the Apps, stored in the EU (Germany).
- PostHog Inc.: usage statistics from the Apps and the website, stored in the EU (Germany).
- Expo (650 Industries, Inc.): delivering updates to the Apps.
- DeepL SE: translating texts such as reviews.
- On the website: Google (Tag Manager, Analytics, reCAPTCHA and the consent message), Plausible (cookieless visitor statistics), Adobe Fonts (fonts), LocationIQ (map tiles) and Tiqets (ticket widget).
- Apple, Google and Facebook
When you sign in with Apple, Google or Facebook, that company handles the sign-in under its own privacy policy. Google may use your IP address to estimate your general location to prevent fraud during sign-in. We receive only what is described in section 2 B.
- Advertisers on the website
The website shows advertisements. With your consent, Google and the advertising partners listed in our consent message may use cookies to show and measure ads. They act under their own privacy policies; see Google's privacy policy. We may tell advertisers how often their ads were shown or clicked, in aggregate only. The Apps show no advertisements.
- Public contributions and museums
Your reviews, ratings, photos, public lists and your name are visible to everyone. We may share statistics with museums, such as how many people viewed their page, in aggregate only.
- Legal requests and changes to our company
We disclose personal data when the law requires it, or when it is necessary to identify, investigate or prevent wrongdoing in connection with the Site, or to protect the rights and safety of WhichMuseum, our users or others. If WhichMuseum merges with or is acquired by another company, your data may pass to that company, which remains bound by this Privacy Policy.
- Links to other websites
The Site links to websites that are not ours, such as museums and ticket partners. We are not responsible for their privacy practices; read their privacy policies.
- Service providers
Data outside the European Union
We store your data in the European Union. Some service providers are based in the United States or may access data from there, including Google LLC (Analytics, advertising and reCAPTCHA on the website), Cloudflare, Slack, Expo, Adobe (Fonts), LocationIQ and, for support and maintenance, Sentry, PostHog and Mailgun. We only use them under the EU-US Data Privacy Framework, where the company is certified, or under the European Commission's standard contractual clauses.
Cookies and similar technologies
Website. We use cookies that are necessary for the website, such as keeping you signed in and remembering your choices. With your consent, we also use analytics cookies (Google Analytics) and advertising cookies (Google and the partners in our consent message). You can change or withdraw your consent at any time with Privacy settings at the bottom of every page. Plausible and PostHog count visits on the website without cookies: PostHog keeps its identifier only in the open page and records clicks on links and buttons, not recordings of your visit. You can also block cookies in your browser, but parts of the website may then stop working.
Apps. The Apps use no cookies and no advertising identifiers. They store only what is needed on your device, as described in section 2 D.
How long we keep your information
Data How long Your account, reviews, photos and lists Until you delete them or your account Photos you uploaded but did not add to a review 7 days Sign-in sessions of the Apps Until you sign out or delete your account; they expire after 1 year without use Failed sign-in attempts (hashed) 1 hour Reports and blocks Until the review is deleted or you or the other user delete the account Notices to moderators about a report Until the report is handled, at most 12 months Server logs (IP address, requests including search words and rounded locations) 30 days Crash reports (Sentry) 90 days Usage statistics (PostHog) At most 7 years, to compare use over time. Statistics linked to your account are deleted when you ask us to, and within 30 days after you delete your account Messages to support 2 years after our last contact Backups At most 30 days Data we must keep by law (such as invoices for business customers) As long as the law requires (7 years for tax records) Your rights
- Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict its use, to object to its use based on our legitimate interest, and to receive it in a common format (data portability). Where we use your data with your consent, you can withdraw that consent at any time. You can view and change most of your data yourself on your account page on the website or under My profile in the Apps. For anything else, e-mail [email protected]. We answer within one month and may ask you to confirm that the account is yours.
If you think we handle your data incorrectly, please tell us first. You also have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the authority in your own country.
- Delete your account
You can delete your account at any time:
- in the Apps: My profile › Delete account;
- on the website: sign in and choose Delete account in your account settings. Delete your account explains how;
- if you can no longer sign in: e-mail [email protected] from the e-mail address of your account. We delete your account within 30 days and confirm it by e-mail.
Deletion in the Apps or on the website takes effect immediately. We delete your profile (name, e-mail address, profile photo and settings), your reviews and ratings with their photos, your lists and saved museums, the reports you made and the reports about your reviews, your blocks, your requests to manage a museum, and the connections with Apple, Google and Facebook; you are signed out on all devices. Your reviews are deleted, not kept anonymously. You receive a confirmation by e-mail. We delete the usage statistics linked to your account (section 2 D) within 30 days.
After deletion, copies remain only in our server logs, in notices to moderators and in our backups, each for the period in section 7, and only data we must keep by law. If our editors chose one of your photos for a museum's own page, that photo stays on that page, without your name. If you used Sign in with Apple, you can also remove WhichMuseum from your Apple ID in your device's settings (Apple ID › Sign in with Apple). Museums cannot remove their listings, reviews and ratings by deleting their account.
- Blocking and reporting
In the Apps you can report a review and block a user. We use reports only to moderate content: our moderators receive each new report by e-mail and as an internal chat message, with the reason, your note, the number of reports for that review and an excerpt of it. After you report a review, you no longer see it. When you block a user, you no longer see their reviews; you can unblock them under My profile. Reports and blocks are deleted as described in section 7.
- Your rights
Children
The Site is meant for a general audience and not for children under 16. We do not knowingly collect personal data from children under 16. If we learn that a child under 16 has given us personal data, we delete it and close the account. If you know of such a case, please let us know through our contact page.
Security
We protect your personal data with technical and organisational measures. The website and the Apps use encrypted connections (HTTPS), passwords are stored as secure hashes, sign-in tokens in the Apps are kept in your device's secure storage, and only authorised people at WhichMuseum can access personal data. No system is completely secure, but we work to keep your data safe and will inform you and the authorities as the law requires if something goes wrong.
Changes to this Privacy Policy
We may update this Privacy Policy. The date at the top shows when it last changed. If a change significantly affects how we use your personal data, we will tell you by e-mail or with a notice on the Site before it takes effect. The latest version is always available here.