Privacy Policy

This Privacy Policy explains how Birch Sound Inc. ("Birch Sound", "we", "us", or "our") collects, uses, discloses, and protects personal data in connection with the mobile application Nobel Heroes (the "App"). It applies to the App and does not cover any third-party service you may access through it.

1.Who We Are

Birch Sound Inc. is the controller responsible for personal data processed through the App. Our contact details are set out in section 12.

2.Information We Collect

We aim to collect only what is necessary to operate the App.

Category	What it includes	Why we process it
Camera input	Live camera images used to render augmented reality content	To display AR content aligned with your surroundings. Camera images are processed on your device in real time and are not transmitted to or stored on our servers unless you choose to save or share a capture.
Voice recordings	Audio of a question you speak to the AI character, captured only while you hold the speak button and for no more than 30 seconds at a time. This feature is available only to visitors aged 18 or over.	To understand your question and generate the character's spoken reply. The recording is sent to our AI provider for processing and is not stored on your device or on our servers.
Age information	Birth month and year, only if you choose to give them on the registration form. They are optional, and needed only to leave an email address.	To determine whether you meet the minimum age of 18 for the AI conversation, and — for visitors aged 18 or over who provide an email address — for the exhibition organiser's visitor list. Where the form indicates you are under 18, nothing is transmitted to us: your entries remain on your own device.
Device information	Device model, operating system version, language and region settings, and a non-permanent app instance identifier	To deliver content compatible with your device and to diagnose problems
Usage data	Features opened, exhibits viewed, session duration, and interaction events	To understand how the App is used and to improve the experience
Diagnostic data	Crash reports, error logs, and performance measurements	To identify and fix faults
Location	Approximate or precise location, where you grant permission	To provide location-based exhibition content. The App requests this only where such features are offered, and you may decline or withdraw permission at any time.
Photos and media	Images or video you capture and choose to save or share	To save captures to your device or to share them where you request it
Contact details	Name and email address, where you contact us or register for an optional service	To respond to your enquiry or provide the service you requested

We do not knowingly collect special categories of personal data, and we do not use the App's camera for facial recognition or biometric identification.

3.Device Permissions

The App requests device permissions only when the relevant feature is used. You may refuse or withdraw any permission at any time through your device settings, although some features may then be unavailable.

• Camera — required for augmented reality features.
• Microphone — requested only if you choose to speak to the AI character, and active only while you hold the speak button. Declining it leaves every other part of the App working.
• Motion and orientation sensors — used to position AR content correctly as you move.
• Location — used only where location-based content is offered.
• Photo library or storage — used only when you choose to save a capture.

4.Legal Bases for Processing

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract — to provide the App and its features to you.
• Legitimate interests — to maintain security, diagnose faults, and improve the App, balanced against your rights.
• Consent — for optional permissions such as location and the microphone, and for any analytics that require consent. You may withdraw consent at any time.
• Legal obligation — where we are required to retain or disclose data by law.

Where the Personal Information Protection Act of the Republic of Korea or the Personal Data Protection Act of Singapore applies, we process personal data on the basis of your consent or as otherwise permitted under those Acts.

5.How We Share Information

We do not sell personal data. We share personal data only in the following circumstances:

• Service providers — providers who process data on our instructions and under contract:
  • Google LLC (Gemini API) — receives the audio of a question you speak to the AI character, and its transcript, in order to generate a reply. Available only to visitors aged 18 or over.
  • ElevenLabs Inc. — receives the text of the reply in order to synthesise speech. It does not receive your voice recording.
  • Exit Games GmbH (Photon) — carries live audio between visitors taking part in the same on-site question-and-answer session. Audio passes through their servers and is not recorded by us.
  • Marvy Analytics — receives usage events only: counts, durations and feature identifiers. It does not receive your name, email address, voice, or the content of your questions.
  • Content delivery and hosting providers — deliver exhibition content to the App. They receive no personal data.
• Visual positioning runs entirely on your device. The App recognises where you are standing from the camera image using on-device processing. Camera images are never uploaded to us or to any third party for this purpose.
• Exhibition and venue partners — in aggregated or anonymised form, to report on exhibition engagement.
• Legal requirements — where disclosure is required by law, regulation, or valid legal process.
• Corporate transactions — in connection with a merger, acquisition, or transfer of assets, subject to the protections of this Policy.

6.International Transfers

We operate across the Republic of Korea, Singapore, and Hong Kong, and our service providers may process data in other countries. Where personal data is transferred outside your jurisdiction, we take steps to ensure an appropriate level of protection, including the use of standard contractual clauses or equivalent safeguards where required.

7.Retention

We retain personal data only for as long as necessary for the purposes described in this Policy.

• Camera input used for AR rendering is processed on your device and is not retained by us.
• Voice recordings are not retained by us in any form. Audio is transmitted to our AI provider for processing and is not written to your device or to our servers. Retention by that provider is governed by our agreement with them.
• Registration details — the name, email address and birth month and year a visitor chooses to give — are held for the exhibition organiser's visitor list and deleted on request using the contact details in section 12. Nothing is transmitted to us where no email address is given, or where the registration form indicates the visitor is under 18.
• Usage and diagnostic data is retained in identifiable form for no longer than is necessary for the purpose, and thereafter is anonymised or deleted.
• Enquiry correspondence is retained for as long as needed to handle the enquiry and to meet any applicable record-keeping obligation.

8.Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls, and restriction of access to personnel who require it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9.Your Rights

Subject to applicable law, you may:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data;
• object to or request restriction of certain processing;
• request a copy of your data in a portable format;
• withdraw consent where processing is based on consent.

To exercise any of these rights, contact us using the details in section 12. We will respond within the period required by applicable law. You also have the right to lodge a complaint with your local data protection authority — in the Republic of Korea, the Personal Information Protection Commission.

10.Children's Privacy

The App is rated as suitable for visitors aged 9 and over, and is designed to be used by children at the exhibition. We have built it so that this is possible without collecting personal data from them.

Nothing is transmitted to us about a visitor under 18. The name and the birth month and year on the registration form are optional, and are needed only by a visitor who chooses to leave an email address. Where the birth month and year indicate the visitor is under 18, the email field is closed, and the form's contents — including any name entered — remain on that visitor's own device and are never sent to us or to the exhibition organiser.

The AI conversation is restricted to visitors aged 18 or over. It is the only feature that records voice. It opens only after the visitor confirms they are 18 or over, and a registration form indicating a visitor under 18 closes it on that device. Every other part of the App — the augmented reality, the narration, the subtitles and the capture features — is available to all ages.

The minimum age is self-declared and we do not verify it. We say so plainly rather than imply a check that does not exist. Where a child uses the App at the venue we expect a parent, guardian, or supervising adult to be involved.

If you believe a child has provided personal data to us, please contact us using the details in section 12 and we will delete it.

11.Changes to This Policy

We may update this Policy from time to time. Where changes are material, we will provide notice through the App or on this page before they take effect. The date at the top of this page indicates when this Policy was last revised.

12.Contact

For any question about this Policy or about how your personal data is handled, please contact us.