Privacy

What the guide sends

When a museum backend is configured, the browser may send your current question, selected language, current exhibit and route state, a pseudonymous session identifier, guide ID and version, referenced exhibit IDs, and up to six recent conversation messages. This context helps Anna understand follow-up questions.

Short-lived conversation context

By default, the museum backend may hold up to four raw question-and-answer turns in process memory for about 20 minutes. This context is bounded, expires automatically, and is not written to the museum analytics transcript. A production operator can disable or reconfigure it.

Analytics and feedback

Museum analytics use a shortened hash and length of the question, answer outcome, exhibit, latency range, and technical status instead of saving the raw question. Helpful or Not quite feedback sends the answer ID, rating, an optional reason code, and a hashed session identifier; it does not accept free-text feedback. Recent conversation messages remain only in this tab's memory. The temporary session identifier and any unsent feedback queue remain in session storage until End Visit, a kiosk reset, or the tab is closed.

Shared kiosk sessions

When the venue enables kiosk mode, the page warns before an inactivity timeout and then clears the visible conversation, queued feedback, current answer identifiers, language, route, camera, and guide position. It also creates a fresh pseudonymous session ID for the next visitor. Selecting Continue Visit dismisses the warning without changing the current session.

Voice

If voice input or generated speech is enabled, audio must be processed to produce a transcript or response. The museum analytics path does not store the raw transcript; it records a hash and length. The production museum must identify its speech provider, processing location, retention, and deletion process before launch.

Your choices

• Use the Mute Anna control to stop spoken output.
• Avoid entering names, contact details, health information, or other sensitive personal data.
• Use End Visit on a shared display, or close the tab, to clear in-memory conversation context, rotate the session identifier, and remove queued feedback.
• Ask the museum operator for access, deletion, or privacy support once a client-specific contact is published.