1. Data Controller
This Privacy Policy applies to the ARSK Bluetooth mobile application (the "App"). For the purposes of Regulation (EU) 2016/679 (the "GDPR"), the data controller of the App is:
- Company / Operating Entity:
ARSK Ltd - Registered Address:
Room 402A, TCL Industrial Centre, 8 Tai Chong Road, Tsuen Wan, Hong Kong, China - Contact: see Section 13 "Contact Us"
Basis: Art. 13(1)(a) GDPR — identity and contact details of the controller.
2. Information We Collect (Categories of Personal Data)
When you use the App, we collect the following categories of personal information:
2.1 Account Information
- Registration and sign-in credentials: e-mail address and a one-way encrypted password digest;
- Profile data: profile picture (if you choose to upload one), nickname and preferences;
- Third-party sign-in data: when you use Google Sign-In, we receive your Google account identifier, e-mail address and basic public profile (name, profile picture) from Google.
2.2 AI Conversation Data
- The content of your conversations with the App's AI assistant (text messages);
- Voice input: when you use the voice conversation feature, your speech is recorded and transcribed (speech-to-text); audio data is processed temporarily during transcription;
- Conversation history: stored to sync your session state across devices and to improve service quality;
- Any information you voluntarily provide to the AI assistant (please do not enter unnecessary sensitive personal data — e.g. data on health, religion or political opinions — in conversations).
2.3 Tuning & Device-Use Preferences
- Equalizer (EQ) settings and presets, volume and playback preferences;
- App language and other interface preferences;
- Playback queue and metadata of local audio files (e.g. title, artist, album) used to display playlists inside the App.
2.4 Connected Device Information
- Information about connected/paired Bluetooth devices: device name, model, device type, firmware/software version, connection status and device-control commands;
- Device operating-state data (e.g. battery level, working mode) used to display and control your device.
2.5 Technical & Log Information
- Device platform (Android / Windows / iOS, etc.) and app version;
- Diagnostic logs, error reports and request timestamps necessary for operating the service.
The App does not collect: precise geolocation, contacts, SMS or call logs, and it does not continuously scan for Bluetooth devices in the background (scanning and connecting occur only while device-interaction features are active).
Basis: Art. 13(1)(c) and Art. 14 GDPR — categories of personal data concerned.
3. Purposes & Legal Bases
We process your personal data only on the lawful bases set out in Art. 6 GDPR:
| Purpose | Data Categories | Legal Basis (GDPR) |
|---|---|---|
| Creating and maintaining your account, verifying your identity, providing sign-in | Account information | Performance of a contract (Art. 6(1)(b)) — necessary to provide the App's services |
| Providing the AI conversation and speech-to-text features | AI conversation data, voice data | Performance of a contract (Art. 6(1)(b)); temporary recording of voice additionally based on your explicit consent (Art. 6(1)(a)), which you may withdraw at any time in the conversation interface |
| Syncing conversation history and account state across devices | AI conversation data, account information | Performance of a contract (Art. 6(1)(b)) |
| Storing and syncing your tuning preferences and device settings | Tuning preferences, device information | Performance of a contract (Art. 6(1)(b)) |
| Discovering, connecting to and controlling your Bluetooth devices | Connected device information | Performance of a contract (Art. 6(1)(b)); use of the Bluetooth permission based on your consent (Art. 6(1)(a)) |
| Safeguarding the service, preventing abuse, troubleshooting | Technical & log information | Legitimate interests (Art. 6(1)(f)) — maintaining the security of our information systems |
| Improving products and services, analysing aggregated usage statistics | Technical & log information | Legitimate interests (Art. 6(1)(f)); where non-essential tracking is involved, based on consent (Art. 6(1)(a)) |
| Complying with legal obligations (e.g. responding to regulatory requests) | As required | Legal obligation (Art. 6(1)(c)) |
Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Basis: Art. 13(1)(c) GDPR — purposes and legal bases.
4. Data Sharing & Recipients
We do not sell your personal information. Your personal data is shared only in the following situations:
4.1 Service Providers (Processors)
- App back-end and AI gateway providers: cloud hosting providers operating account services, AI conversation and speech recognition, processing data under a data processing agreement (DPA, Art. 28 GDPR);
- AI large-model providers: to generate AI replies, your conversation content is processed by AI model services (e.g. DeepSeek or other model providers); we require them not to use your conversation data for commercial purposes other than model operation (as set out in their terms of service);
- Cloud infrastructure providers: for data storage and backup.
4.2 Independent Controllers
- Google: when you use Google Sign-In, Google processes the relevant data under its own privacy policy (https://policies.google.com/privacy);
4.3 Other Situations
- Legal requirements: where compelled by law, court order or a competent authority;
- Corporate transactions: in a merger, acquisition or asset transfer, your data may be transferred as part of the transaction; we will notify you in advance.
Basis: Art. 13(1)(e) GDPR — recipients or categories of recipients.
5. International Data Transfers
The App's servers and some service providers may be located outside the European Economic Area (EEA), including mainland China and other regions. Where your personal data is transferred outside the EEA, we apply one of the following safeguards:
- confirmation that the country/region has received an adequacy decision from the European Commission (Art. 45);
- standard contractual clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914) with the recipient (Art. 46);
- binding corporate rules or other approved safeguard mechanisms, where available.
You may request a copy of these safeguards or further details via the contact channels in Section 13.
Basis: Chapter V and Art. 13(1)(f) GDPR.
6. Retention Periods
| Data Category | Retention Period |
|---|---|
| Account information | For the life of the account; deleted or anonymised within 30 days of account closure (unless retention is required by law) |
| AI conversation history | For the life of the account, for syncing and display; deleted with the account upon closure |
| Voice audio | Temporarily, only during speech-to-text processing (usually no longer than 24 hours); the original audio is deleted once transcription is complete |
| Tuning preferences / device information | For the life of the account; deleted upon account closure |
| Technical & log information | Up to 12 months, for security and troubleshooting |
Once the retention period expires or the processing purpose is achieved, we delete or anonymise your personal data.
Basis: Art. 5(1)(e) GDPR (storage limitation) and Art. 13(2)(a).
7. Data Security
We apply technical and organisational measures to protect your personal data, including:
- Passwords are stored as one-way encrypted digests; no one (including us) can view the plaintext;
- Sensitive client–server operations are authenticated with access tokens;
- Least-privilege principles and access controls on server access;
- Periodic review of the security posture of our services.
Basis: Art. 32 GDPR — security of processing.
8. Your Rights
Under Art. 15–22 GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): obtain a copy of the personal data we process about you and information on that processing;
- Right to rectification (Art. 16): have inaccurate or incomplete personal data corrected;
- Right to erasure / to be forgotten (Art. 17): have your personal data erased in the circumstances provided by law; you may also use the "Delete Account" function directly in the App;
- Right to restriction of processing (Art. 18): restrict the processing of your personal data in certain situations;
- Right to data portability (Art. 20): receive the data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller;
- Right to object (Art. 21): object, on grounds relating to your particular situation, to processing based on legitimate interests;
- Right to withdraw consent: withdraw consent previously given (e.g. voice processing, Bluetooth permission) at any time, via system settings or by contacting us;
- Rights related to automated decision-making (Art. 22): we do not carry out fully automated decisions with legal effect or similarly significant impact.
To exercise your rights: muse@musebtapp.com. We will respond within one month of receiving your request (extendable by up to three months for complex cases, with notice to you). Requests are generally free of charge; we may charge a reasonable fee or refuse manifestly unfounded or excessive repeated requests, as permitted by law.
Right to lodge a complaint: if you believe that our processing of personal data infringes your rights, you have the right to lodge a complaint with a data protection supervisory authority in your EU member state (or at your place of residence or work). Contact details of EU supervisory authorities are available on the European Data Protection Board (EDPB) website.
Basis: Art. 13(2)(b), 13(2)(c) and 13(2)(d) GDPR.
9. Automated Decision-Making & Profiling
The App does not carry out any fully automated decision-making with legal effect or similarly significant impact. The AI conversation feature merely generates replies based on your input and does not evaluate or profile you as a person.
Basis: Art. 13(2)(f) GDPR.
10. Children
The App is intended for the general public and is not directed at children under 16 (or the lower age set by your member state). We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us via Section 13 and we will promptly delete such data.
11. Third-Party Sign-In & Device Permissions
11.1 Google Sign-In
When you choose Google Sign-In, Google's terms of service and privacy policy apply. We only receive the information necessary to complete sign-in (account ID, e-mail, basic profile).
11.2 Device Permissions
- Bluetooth: to discover, connect to and control your ARSK speaker devices;
- Microphone: only to record and transcribe your voice while the voice conversation feature is in use;
- Storage / file access: only to access the local audio files you select for the playback queue.
All of these permissions can be enabled or disabled at any time in system settings; turning them off may make the corresponding features unavailable.
12. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you via in-app notices or other reasonable means and update the "Effective Date" at the top of this page. We encourage you to review this policy periodically. Where a change introduces new processing purposes or requires a new legal basis, we will seek your consent again before processing, where required by law.
13. Contact Us
If you have any questions, comments or requests regarding this Privacy Policy or the processing of your personal data (including exercising the rights described in Section 8), please e-mail muse@musebtapp.com. This address handles both privacy matters and general customer support.
We are committed to taking every privacy-related message seriously and to replying within a reasonable period.