Privacy Policy

This Privacy Policy (this “Policy”) describes how Museum of Phones, Inc., a corporation with its principal place of business at 254 E 3rd St, New York, NY 10009 (“Company,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal information in connection with the website located at themophonyc.com and all related subdomains (the “Site”), and in connection with the email and text-message communications we send (together with the Site, the “Services”). The Services promote and relate to “The MoPho,” a pop-up event in New York City.

By accessing or using the Services, or by submitting personal information through the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, do not use the Services. Use of the Services is also governed by our Terms of Service.

1. Information We Collect

1.1 Information You Provide

• Contact information. Your email address, when you submit it through a signup form on the Site.
• Mobile telephone number. Your mobile telephone number, only if you elect to provide it and affirmatively check the box consenting to receive text messages.
• Source information. If you arrive at the Site through a link containing campaign tags (such as “utm_source=instagram”), or from another website, we record that tag and the referring website’s domain name with your signup so that we can understand which channels bring people to the Services.
• Communications. The content of any message you send to us, including by email to info@themophonyc.com, and any information contained in that message.

1.2 Consent Records

When you consent to receive text messages, we create and retain a record of that consent, which includes the exact consent language presented to you, the date and time of your consent, the form through which you consented, and the mobile number and email address you submitted. We retain this record to document and defend your consent, as permitted or required by applicable law and carrier requirements.

1.3 Information Collected Automatically

When you access the Site, our hosting and infrastructure providers may automatically collect and log technical information, including your Internet Protocol (IP) address, browser type and version, device type, operating system, referring URLs, pages and files requested, and the date and time of each request. We use this information to operate, secure, and troubleshoot the Services.

1.4 Information We Do Not Collect

We do not currently collect payment card information through the Site. We do not knowingly collect “sensitive personal information” (as defined by applicable law), precise geolocation, or biometric information through the Services. If we offer ticket sales in the future, payment information will be collected and processed by a third-party ticketing or payment provider under that provider’s own terms and privacy policy.

2. How We Use Personal Information

We use personal information for the following purposes:

1. to send you email communications regarding The MoPho, including notice of ticket availability, event dates, and related announcements;
2. to send you text messages, if and only to the extent you have consented, as described in Section 5 of our Terms of Service and Section 8 below;
3. to respond to your inquiries and requests, including requests to exercise your privacy rights;
4. to operate, maintain, secure, and improve the Services, and to detect, prevent, and respond to fraud, abuse, spam, security incidents, and other harmful or unlawful activity;
5. to create and maintain records of consent and opt-out requests, and to otherwise comply with applicable law, regulation, legal process, and mobile carrier and industry requirements;
6. to enforce our Terms of Service and protect our rights, property, and safety and those of others; and
7. for any other purpose disclosed to you at the time of collection or to which you consent.

3. How We Disclose Personal Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, in each case as those terms are defined under applicable law. We disclose personal information only as follows:

1. Service providers. To vendors that process personal information on our behalf and under written obligations to use it only to provide services to us, including (i) our email marketing and list-management provider (currently Kit), (ii) our website hosting, content delivery, and serverless computing provider (currently Cloudflare, Inc.), (iii) our web analytics provider (Cloudflare Web Analytics, a service of Cloudflare, Inc.), and (iv) our text messaging provider, which delivers text messages to mobile numbers that have opted in.
2. Legal and safety. To government authorities, courts, or other third parties where we believe disclosure is required by applicable law, regulation, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of the Company, our users, or others, or to detect, prevent, or investigate fraud or security issues.
3. Business transfers. In connection with, or during negotiation of, any merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of company assets, or similar transaction, in which case personal information may be transferred to the successor or acquirer, subject to this Policy or a policy no less protective.
4. With your consent or at your direction. To any other person where you have consented or directed us to do so.
5. Aggregated or de-identified information. We may disclose information that has been aggregated or de-identified so that it cannot reasonably be used to identify you.

4. Cookies and Similar Technologies

As of the Effective Date, the Site does not set or read cookies, and does not use advertising cookies, cross-site tracking technologies, or third-party advertising pixels. We use Cloudflare Web Analytics, a privacy-focused analytics service provided by Cloudflare, Inc., to measure aggregate Site traffic, such as page views, visits, approximate country, device and browser type, referring sites, and page performance. Cloudflare Web Analytics does not use cookies or local storage, and does not track individual users across websites or build profiles of them for advertising. Our infrastructure providers may also use strictly necessary technologies, such as server logs and security tokens, to deliver and protect the Site. Because we do not track users across third-party websites over time, we do not respond to “Do Not Track” browser signals; however, we treat a valid Global Privacy Control signal as a request to opt out of any sale or sharing of personal information, which we do not engage in. If we adopt cookies, advertising pixels, or additional analytics tools in the future, we will update this Policy and, where required by law, obtain your consent before doing so.

5. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, including for as long as you remain on our mailing list, and thereafter for such period as is necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and document consent and opt-out requests. Records of opt-out requests, and of the consent that preceded them, may be retained after you unsubscribe so that we can honor your request and demonstrate compliance. When personal information is no longer needed, we will delete it or de-identify it, subject to technical limitations such as backup retention cycles.

6. Security

We maintain administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, and alteration, including encrypted (HTTPS) transmission and restricted access to credentials. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You transmit personal information to us at your own risk. Where required by applicable law, we will notify affected individuals and regulators of a security breach.

7. Your Choices

• Email. You may opt out of marketing emails at any time by clicking the “unsubscribe” link in any email we send, or by emailing info@themophonyc.com. We will process your request within ten (10) business days. Please note that we may continue to send transactional or legally required messages.
• Text messages. You may opt out of text messages at any time by replying STOP to any text message from us. See Section 8 below and the Text Messaging Program Terms in our Terms of Service.
• Access, correction, and deletion. You may request access to, correction of, or deletion of your personal information by following the procedures in Section 9 below.

8. Email and Text Message Communications

Our email communications are sent in accordance with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.) and identify Museum of Phones, Inc., 254 E 3rd St, New York, NY 10009, as the sender. Our text message communications are sent only to individuals who have given prior express consent in accordance with the Telephone Consumer Protection Act (47 U.S.C. § 227) and its implementing regulations, and in accordance with applicable mobile carrier and industry guidelines. Consent to receive text messages is not a condition of purchasing any goods or services or of attending any event. The text message consent language presented at signup is: “Yes, text me when tickets drop. Msg & data rates may apply. Msg frequency varies. Reply STOP to cancel. See our Terms and Privacy Policy.” Further terms governing our text message program appear in Section 5 of our Terms of Service, which is incorporated into this Policy by reference.

9. State Privacy Rights

Depending on your state of residence, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and others, you may have some or all of the following rights, subject to verification and to exceptions under applicable law:

1. the right to know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes of collection, and the categories of third parties to whom we disclose it;
2. the right to request deletion of personal information we have collected from you;
3. the right to request correction of inaccurate personal information;
4. the right to obtain a portable copy of your personal information;
5. the right to opt out of the sale or sharing of personal information, and of targeted advertising and profiling in furtherance of decisions with legal or similarly significant effects (we do not engage in any of these activities); and
6. the right not to receive discriminatory treatment for exercising these rights.

9.1 Categories of Personal Information (Preceding Twelve Months)

In the preceding twelve (12) months, we have collected the following categories of personal information, as those categories are described in the California Consumer Privacy Act, as amended (“CCPA”): (i) identifiers, such as email address, mobile telephone number, and IP address; (ii) customer records information, such as the contact details you submit; and (iii) internet or other electronic network activity information, such as server log data, campaign tags, referring-site domain names, and aggregate analytics data. We collect this information from you directly and automatically from your device. We disclose these categories to the service providers described in Section 3 for the business purposes described in Section 2. We have not sold or shared, and do not sell or share, personal information, and we have no actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age.

9.2 How to Submit a Request

To exercise any of these rights, email info@themophonyc.com with the subject line “Privacy Request,” or write to us at the address in Section 14, identifying the right you wish to exercise and the email address or mobile number associated with your information. We will verify your request by matching information you provide to information we hold, and we may request additional information where reasonably necessary. We will confirm receipt within ten (10) business days and respond within forty-five (45) days, which we may extend once by an additional forty-five (45) days where reasonably necessary and with notice to you. We will not charge a fee except where permitted by law for manifestly unfounded or excessive requests.

9.3 Authorized Agents

You may designate an authorized agent to submit a request on your behalf. We may require proof of the agent’s authority and may require you to verify your identity directly with us.

9.4 Appeals

If we decline to act on your request, you may appeal by replying to our decision or emailing info@themophonyc.com with the subject line “Privacy Appeal” within a reasonable time after receiving our decision. We will respond in writing within the period required by applicable law, and, if the appeal is denied, we will explain the reasons and, where applicable, how you may contact your state attorney general.

9.5 California “Shine the Light”

California Civil Code § 1798.83 permits California residents to request certain information regarding disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

10. Children’s Privacy

The Services are not directed to, and we do not knowingly collect personal information from, children under the age of thirteen (13), and the Services’ signup forms are intended for individuals eighteen (18) years of age or older. If we learn that we have collected personal information from a child under thirteen (13) without verifiable parental consent, we will delete that information. If you believe a child has provided us with personal information, please contact us using the information in Section 14.

11. Third-Party Websites and Services

The Services may contain links to third-party websites, platforms, and services, including social media platforms and ticketing providers. This Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third party before providing information to it.

12. Transfers and Use Outside the United States

The Services are operated from, and intended for users located in, the United States. If you access the Services from outside the United States, you acknowledge that your information will be transferred to, stored, and processed in the United States and other jurisdictions, whose data protection laws may differ from those of your jurisdiction. The Services are not offered to individuals in the European Economic Area, the United Kingdom, or Switzerland.

13. Changes to This Policy

We may modify this Policy from time to time. The “Last Updated” date above indicates when it was most recently revised. Changes take effect upon posting. If we make material changes, we will provide notice as required by applicable law, which may include notice by email or by prominent posting on the Site. Your continued use of the Services after the effective date of any revised Policy constitutes acceptance of the revised Policy, except where applicable law requires your consent.

14. Contact Us

If you have questions about this Policy or our privacy practices, or wish to exercise your rights, contact us at: