Your stories.
Your privacy.

Who is responsible

House of Juju, Netherlands, is the controller responsible for personal information processed by the Museum of Human Emotion. For privacy questions or rights requests, email legal@mhe.com.

This notice covers the Museum of Human Emotion homepage and connected museum application, including accounts, artefacts, articles and shop listings.

Before publication: complete House of Juju’s contact address (street/number or postal address and city; postcode supplied: 1020 HH). Confirm whether a data protection officer is required.

Information we handle

• Account information: email address, account identifier, public name, authentication information, and optional profile photograph and biography.
• Your contributions: uploaded images, writing, titles, descriptions, selected emotions, drafts, publication and visibility settings, and museum submissions.
• Your activity: saved works, follow relationships, notifications and the information needed to operate those features.
• Shop listings: seller details, descriptions, images, prices and external purchase links you provide.
• Support and moderation: requests, reports, review decisions, feedback and relevant staff activity records.
• Technical information: hosting and authentication providers may process IP addresses, browser/device information and request or security logs when providing the service.

Most information comes from you or your use of the service. Review feedback comes from museum staff; a report may also contain information supplied by another person.

Account credentials are required to create and access an account. Optional profile details and contributions are your choice. Without the information needed for a particular feature, we may not be able to provide it.

Why we use it

Proposed GDPR basis mapping: the operator must confirm this against the actual service, terms and a documented legitimate-interests assessment before publication.

Accounts and requested features

To authenticate you, save your work and provide the features you request. Proposed basis: performance of our agreement with you, where the processing is necessary for that service.

Public display

To display work you choose to publish or submit for public museum selection, and associated author details. Confirm the publication terms and applicable legal basis before launch.

Security, support and moderation

To protect accounts, prevent misuse, handle reports and operate curator review. Proposed basis: legitimate interests in a secure, functioning museum, balanced against your rights; some requests may instead be necessary to provide the service or meet a legal obligation.

Legal requirements

To meet applicable legal duties and handle valid legal requests. Basis: the relevant legal obligation, where one applies.

Optional tracking or communications

If introduced, non-essential tracking and any communications requiring consent need a separate, informed choice. This notice itself is not consent.

Public and private work

Drafts are not displayed to other visitors. Private does not mean inaccessible to the operator: authorised administrators can access member content for administration, and service providers process stored data to run the service.

Publishing to your profile and acceptance into the museum are separate actions. An accepted museum submission is a public version of the work. Editing a draft copy does not automatically change or remove the accepted version.

Public work and associated author information may be viewed, copied or indexed by others. Contact the museum to request removal of personal information from a published submission; deletion rights and any lawful exceptions must be assessed for the particular request.

Service providers and transfers

The current service uses Framer for the homepage, Netlify for application hosting, and Supabase for authentication, database and file storage. Authorised museum staff also access information according to their role. Information may need to be disclosed where required by law or to address a valid legal claim.

External purchase links take you to another website. Its operator’s privacy notice applies to information you provide there.

Before publication: verify the full provider list, including email, analytics and imported-content services; contractual entities; processing regions; and data processing agreements. Confirm any transfers outside the EEA/UK, their actual safeguards, and how a person can obtain a copy. Do not assume a chosen database region covers every provider or subprocessor.

Cookies and browser storage

The museum application uses authentication cookies to maintain sign-in sessions. Blocking them can prevent login and account features from working.

Artefact drafts can have a backup saved in browser storage as well as an account copy. In the current implementation, artefact comments are stored in that browser rather than shared with other visitors. Clearing browser storage removes these local copies, but does not delete account data or published work. Other people using the same browser profile may be able to access locally stored material.

Before publication: audit the live Framer homepage and application, including embeds, for actual cookies and tracking. Record names, providers, purposes and expiry periods, and implement consent controls where required. A source-code review alone cannot confirm hosting or dashboard tracking settings.

How long we keep information

A retention schedule must be approved and implemented before this notice is final: specify account and draft deletion timing, published-submission handling, support and moderation retention, security-log expiry and backup expiry. No automatic deletion schedule has been verified.

The schedule should retain information only as long as needed for the stated purpose or an applicable legal requirement, then delete or anonymise it. Where a specific legal obligation or dispute requires longer retention, access should be limited to that purpose. Browser-only copies persist until cleared locally and need separate attention on shared devices.

Your rights and requests

Where the GDPR applies, you may request access to your personal data, correction, erasure, restriction, and portability where its conditions apply. You may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. These rights have conditions and exceptions.

Signed-in members can use Account help to request a data copy or account deletion. Submitting a request does not automatically delete the account. The current content export is not necessarily a complete response to a personal-data access request.

We may need proportionate information to verify a request. Do not send passwords or authenticator codes. GDPR requests generally require a response within one month; a permitted extension must be explained within that first month.

You may complain to a supervisory authority, including in the EU country where you live or work or where an alleged infringement occurred. You do not need to contact us first.

You can also send a request directly to legal@mhe.com without signing in. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens.

Sensitive information and children

The museum’s accounts and contribution features are intended for adults aged 18 and over. If you believe someone under 18 has registered or supplied personal information, contact legal@mhe.com so we can assess the situation and take appropriate action.

Creative work can reveal health, beliefs, sexuality or other sensitive information, even unintentionally. Avoid including unnecessary sensitive information about yourself or personal information about others without a lawful basis.

Before publication: decide how sensitive submissions are handled and identify any applicable GDPR Article 9 condition. Public submission alone must not be treated as blanket consent. Implement the adults-only registration policy; no age-verification implementation has been confirmed.

Security

The application uses account authentication, ownership and role checks, and two-factor checks for privileged staff functions. These measures reduce risk but cannot guarantee absolute security.

Report suspected account misuse through Account help. If you cannot sign in, email legal@mhe.com. Never include your password or recovery secrets.

Decisions about your work

Museum selection includes curator review. The application also applies automated eligibility rules for direct artefact publishing, based on previous approvals and publishing suspension status. Contact the museum if you believe an eligibility or moderation decision is incorrect.

Before publication: confirm whether any processing constitutes solely automated decision-making with legal or similarly significant effects and, if so, provide the required explanation and safeguards.

Changes to this policy

The final notice should show its effective date and explain material changes through an appropriate notification. A new use of information may require a new legal basis or consent; updating this page alone does not provide either.

This is a working draft. Set an effective date only after the outstanding facts, practices and legal review are complete.