4Muses
Draft for the private test. To be completed and reviewed by a lawyer before 4Muses opens to the public. Highlighted parts are placeholders.
Privacy policy
Last updated: 30 September 2026.
This policy explains what personal data 4Muses processes, why, with whom it is shared, and your rights under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The controller is Califa.ai LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA, represented by William Graham. Email: william.graham@califa.ai. See also the imprint.
Representative in the EU under Art. 27 GDPR: William Graham, resident in the EU. Email: william.graham@califa.ai. You can contact him about any question on how 4Muses handles your data.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Game name, email address, password (stored only as a secure hash), invite code, date you joined | Your account, sign-in on any device, password reset | Contract, Art. 6(1)(b) GDPR |
| Your entries: photos, texts, captions; your votes | Running the game: judging, results, the "whose taste" scoreboard | Contract, Art. 6(1)(b) GDPR |
| A pseudonymized form of your IP address, for up to a day | Preventing abuse through request limits | Legitimate interest in security, Art. 6(1)(f) GDPR |
| Technical logs (errors, request times) | Keeping the service running and fixing faults | Legitimate interest, Art. 6(1)(f) GDPR |
Photos are shrunk in your browser before upload. This also removes location and camera data from the file. We do not use your data for advertising, and we do not sell it.
3. Who processes data for us
- Microsoft (Azure) hosts the app, stores all game data and photos, sends password emails and keeps logs. Storage and processing are in the EU (West Europe region; email data location Europe).
- Anthropic (Claude), OpenAI (ChatGPT) and Google (Gemini) receive the day's challenge and the entries being judged, meaning photos, texts and captions, so that the AIs can set challenges and judge. They never receive your name, email or IP address. These providers are in the USA. Transfers rely on the EU-US Data Privacy Framework or standard contractual clauses. [Confirm each provider's basis before launch.] We use the paid business services of all three, which do not use this content to train their models.
We have data processing agreements with these providers where required. [Confirm before launch.]
4. What stays on your device
4Muses stores a sign-in token in your browser's local storage so that you stay signed in. This is strictly necessary for the service you asked for, so no consent is needed. There are no tracking or advertising cookies. Fonts are served from 4muses.com itself.
5. How long we keep data
- Account data: until you ask us to delete your account.
- Entries, results and votes: for as long as your account exists, so that results stay visible. Hidden entries can be deleted on request at any time.
- Pseudonymized request counters: deleted within a day.
- Technical logs: up to 90 days.
- Password reset links: valid for 30 minutes and single use.
6. Your rights
You can ask for access to your data, correction, deletion, restriction of processing, and a copy of your data in a portable format. You can object to processing based on legitimate interest. Write to william.graham@califa.ai. You also have the right to complain to a data protection authority, in particular the one in the EU country where you live or work.
7. Age
4Muses is for people aged 16 and over.
8. Changes
If this policy changes, we will show the new version here and tell players in the app when the change matters.