Privacy notice

1. Who runs Vitrine

Vitrine is run by Prumo Works Ltd, "we" in this notice, the controller of the personal data Vitrine handles. Prumo Works Ltd is registered in England and Wales under company number 17384166, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For questions about your data or requests, use the Prumo Works contact form.

Each museum belongs to a family. Its members and curators add what is in it, about themselves and their relatives; its administrators invite people and decide who sees which branch of the family. We run the service that stores the museum and shows it to them.

2. What we keep

• Your account: your email address and name and, if you set them, a password and passkeys. Accounts, passwords (kept only as a hash) and sessions are held by our platform's sign-in service, not by the museum's database. Vitrine keeps a copy of your name, email and profile picture for member lists and notices.
• Your membership: the museums you belong to, your role in each (owner, administrator, curator, contributor, viewer…), the person you are in the tree, the level you have in each family branch, the sensitive subjects you may see, your AI limits, and when you were welcomed. Invitations keep the name and address of the person invited, who invited them and when it was sent and accepted.
• The family tree: people, living and dead, with names, dates and places of birth, marriage and death, where living people live now, relationships, biographies, notes and the sources behind each fact. Members and curators enter it about themselves and their relatives, or import it from a family tree file. Every change is kept with who made it and when.
• Documents and photos that members upload, with their transcriptions and the text read from them, the people tagged in them, and what a photo's file says about it: when it was taken, the camera, and its GPS position when the file has one.
• What you do in the museum: notes, suggested changes, documents you contest, requests to see a branch, and the agents (AI assistants) you connect to a museum.
• Your conversations with the guide (the museum's AI assistant): your questions, its answers, and the actions it offered you. Answers to questions asked from a person's page are kept on that page for the next visitors.
• AI use: what each use of the guide or a transcription cost, with the model and the feature, and your requests for access to the guide.
• Feedback you send, with the page you sent it from.
• The audit log: a tamper-evident record of important actions (invitations, role and access changes, merges, accepting this notice and the terms of use), with who did them and when.
• IP addresses: the address you connect from is passed to the sign-in service, which uses it to limit sign-in attempts, and is used in the server's memory to limit how often one visitor may send the home page's form. Vitrine's database does not store it. Cloudflare and Fly.io, which carry the site, see it too.
• Asking for a museum: if you ask for a family museum from the home page, your name, email, family names and note are emailed to the site's administrators.

3. Why we use it

We use this data to run the museums you belong to: to sign you in, show each member what the museum lets them see, keep the family's record and its sources, answer your questions through the guide, read and transcribe what members upload, send invitations and notices, and keep the service secure and recoverable. We do not sell personal data, show advertising or build profiles of you.

We rely on performing our agreement with you (the Terms of use), on our legitimate interests in running, securing and recovering the service and in keeping the family's record its members build together, on legal obligations, and on your consent where we ask for it.

4. Where it is kept and processed

Your data is kept and processed by these providers, mostly in the United States:

• Fly.io runs the website, our platform's sign-in service, its AI agents and its background jobs (reading uploads, transcriptions), in Ashburn, Virginia, United States.
• Neon hosts the database, on Amazon Web Services in us-east-1 (United States). Every night a copy of the whole database is saved to Cloudflare R2 in the eastern United States.
• Cloudflare R2 stores uploaded documents and photos, in its European Union jurisdiction.
• Cloudflare sits in front of the site and carries every request to it.
• Resend sends Vitrine's emails: sign-in links and codes, invitations and notices.
• Anthropic (Claude) answers the guide, reads and transcribes documents and photos, and writes pages; OpenAI turns the museum's text into the index the guide searches. To do so they receive your questions and the museum records needed to answer them. Both are used under zero data retention: they do not keep what they are sent.
• Exa searches the web for what life was like in a place and time. Only places and years are sent, never a person.
• OpenStreetMap (Nominatim) is asked which neighbourhood a photo was taken in, with its GPS position rounded to about a kilometre.
• Telegram carries the feedback you send to us, through our platform's contact inbox.
• Maps load their tiles and fonts in your browser from OpenFreeMap, OpenHistoricalMap, jsDelivr and Amazon Web Services; no family data is sent with them. Portraits in the public royal-families collection are loaded from Wikimedia Commons.

Data is transferred to the United States. If you are in Brazil, the European Union or elsewhere, your data leaves your country to be stored and processed there.

The museum's collection (people, facts, sources, documents and media; not accounts, conversations or suggestions) is also copied between our production, development and local environments, for development and backups.

5. Who sees what

• A family museum is private: only its signed-in members see it, and search engines are asked not to index it. These rules are enforced by the database itself, not only by the pages.
• Each member sees each branch of the family at one of three levels. Family: everything their role allows. Visitor: people who have died and their facts, living people by name only, and documents shared with everyone. Locked: nothing; the branch is absent from the tree, search, the guide and agents. By default a member is family in their own family (their blood relatives and those relatives' partners), a visitor in their partners' families and locked out of the rest; an administrator, or a curator of the branch, can change this.
• Living people: apart from the person themself and the museum's administrators, others see only a living person's name, sex, dates, the country they live in and their family links. A document about or showing a living person is private by default.
• Facts marked sensitive (such as paternity, adoption, health, enslavement or legal cases) are shown only to members granted that subject. Children see only what a curator approved.
• Notes are private to their author, shared with the family, or with everyone who sees the person, as the author chooses.
• Your conversations with the guide are private to you. A museum administrator who previews the museum as you sees none of them, nor your private notes or drafts. The site's own administrators (superadmins), who run the service and are owners of every museum, see exactly what you see when they look at a museum as you, conversations included.
• Owners and administrators of a museum see all of it and manage its members. When you accept an invitation, the person who invited you is told.
• Our operator console shows us each museum's size and member count, requests for access to the guide (with the name and email of who asked), and counts of activity and AI spending; never a conversation's text or a document.
• An agent you connect to a museum sees at most what you see there; you choose whether it sees sensitive subjects, and you can disconnect it.

6. Cookies and storage in your browser

Vitrine sets only the cookies it needs to work:

• the sign-in session, which lasts seven days from your last visit;
• the language you chose (one year);
• an invitation you opened (14 days);
• a random identifier for this browser (two years), set once you sign in or open an invitation. We keep only a scrambled form of it with sign-in and invitation records, so the museum's administrators can tell when an invitation was accepted on the same browser that sent it;
• the person a museum's tree is centred on (one year);
• for administrators, the member they are previewing the museum as (one hour).

Your browser also remembers a few preferences on your device: light or dark theme, how the tree and document viewer are shown, the guide's panel, and the guide conversation open in a tab. There are no analytics, advertising or tracking cookies or scripts.

7. How long we keep it, and deleting it

• Your account and membership are kept while the account exists.
• Deleting your account: "Delete my account", in the account menu, deletes it once you confirm with your password. The sign-in service deletes the account itself (email, name, password, passkeys and sessions). Vitrine then deletes, in every museum, your memberships and access, your guide conversations and their messages, the guide's cards, your notes, your suggestions still waiting for a decision, your saved questions, upload links, agent connections, feedback and your profile. What you added to the family's record (people, facts, documents and photos) stays with the museum, and suggestions already decided stay as its history. If you also choose to be taken out of the tree, your own person is removed with every fact and link about them and the notes and suggestions about them; documents and photos stay, without you. The history of facts keeps the last version of each removed fact, and the records of AI costs and the audit log keep your account's identifier (the audit log's record of accepting this notice keeps your email address too). If a museum's tree starts from you, you stay in it, and the site's own administrators (superadmins) cannot delete their accounts this way.
• You can delete your conversations with the guide; deleting removes the conversation and all its messages.
• Notes can be deleted.
• A document or photo can be deleted by its curators, by the member who uploaded it and, for a photo, by a member it shows; its files are deleted from storage too.
• A museum's curators can take a person out of the tree with every fact and link about them (documents and photos stay, without them); members can remove the people they added.
• Changes to facts keep their history, and a retracted fact is hidden but kept. The audit log cannot be changed or deleted by the application.
• Nightly copies: what is deleted stays in the nightly copies of the database until they expire. Each copy is kept for 14 days, copies made on a Sunday for 8 weeks and copies made on the 1st of a month for a year. The database provider also keeps the changes of the last 7 days, so the museum can be put back as it was at a moment within them. Both are used only to recover the museum after a failure or a mistake.
• Sessions end seven days after your last visit. Invitations expire after 14 days. The codes for joining through an invitation are not stored, and Vitrine's counters that limit attempts are kept only in the server's memory.
• For anything about you that you cannot delete yourself, ask your museum's administrator or write to us through the Prumo Works contact form.

8. Your rights

Under Brazil's General Data Protection Law (LGPD) and, in the United Kingdom and the European Union, the GDPR, you may ask us to confirm whether we hold data about you and to give you access to it; to correct it; to delete it, anonymise or block it; to receive a copy to take elsewhere; to know with whom it is shared; to object to its use or restrict it; and to withdraw consent you gave. You may also complain to Brazil's data protection authority (ANPD), to the United Kingdom's Information Commissioner's Office (ICO) or to your country's supervisory authority in the EU.

You can correct what the museum says about yourself and delete your guide conversations from the museum's pages, and delete your account from the account menu. For anything else, write to us through the Prumo Works contact form.

9. Changes to this notice

This notice has a version, the date it was last updated, shown above. When it changes, you are asked to read and accept the new version the next time you visit. Using Vitrine is also subject to the Terms of use.