Nexera (“Nexera”, “we”, “us” or “our”) is operated by Moore Universe Pty Ltd (ABN 70 700 739 180), doing business as Nexera Music, and connects independent artists directly with their fans through nexera.music and the Backstage artist dashboard, together with any related applications, features, and services we offer (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect Personal Data when you use the Service, whether you're a fan, an independent artist (a “Licensor”), or a visitor.

“Personal Data” means any information that identifies, or could reasonably identify, an individual. It does not include information that has been aggregated or de-identified such that an individual can no longer reasonably be identified.

This Policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and with the Privacy Act 2020 (NZ). If you are located outside Australia or New Zealand, by using the Service you understand that your Personal Data will be handled in accordance with this Policy and Australian law.

Quick Summary

This summary is provided for convenience only and is not a substitute for the full Policy below.

If you're a fan

• When you buy a release, join an artist's community, or sign up for Fan Connect, we collect information like your name, email, purchase history, and (if you provide it) your phone number and shipping address.

• Artists can export your contact details. If you buy a release, join Fan Connect, or otherwise interact with an artist, that artist can export your Fan Data - including your name, email address, and any other details you've entered on the platform - as a CSV file from Backstage. This only goes to the specific artist you've engaged with, never to other artists or third parties, and once they've exported it, they're responsible for handling it securely and lawfully.

• If you opt in to Fan Connect, an artist can send you email updates through our system and can export your email address as above. You can opt out of communications at any time.

• Messages you post in Fan Chat, Fan Chat Groups, or the Community Broadcast Feed are visible to other participants - treat them as semi-public.

• We use Stripe to process payments. We never see or store your full card number.

• We do not currently report your purchases to any chart-tracking or industry data body. See Section 5 for the limited, non-identifying circumstances in which that could change in future.

• Your data is primarily hosted on servers located in Sydney, Australia.

If you're an artist

• You get aggregated Artist Insights about your fans (purchases, engagement, achievement tiers), and you can export your Fan Data - name, email address, and other details fans have entered - as a CSV file for your own use.

• We collect your Stripe Connect identity-verification and payout information through Stripe, and we receive transaction and payout records from Stripe. We don't store your bank details or ID documents ourselves.

• We don't sell or rent your data, and we don't report your sales to any chart data service.

The full Policy follows below.

1. What Personal Data Does Nexera Collect?

The Personal Data we collect depends on how you use the Service and whether you're a fan, an artist, or simply a visitor.

From Everyone

The Service is not directed at, and we do not knowingly collect Personal Data from, children under 16. See Section 11 for more detail.

• Account information: your name, username, email address, password (stored as a salted hash, never in plain text), profile photo, date of birth, and anything else you add to your profile.

• Payment information: processed directly by Stripe (either Stripe as our payment processor, or Stripe Connect Express if you're an artist receiving payouts). We do not receive or store your full card number, bank account number, or Stripe identity-verification documents - Stripe provides us with transaction outcomes, payout records, and account status only.

• Website and device activity: IP address, browser and device type, referring pages, and general usage metrics generated by normal use of the Service.

• Cookies and similar technologies: see Section 10 (Cookies) for details and your options.

From Fans

• Profile data: name, email address, country/region, postcode, profile picture, and anything else you choose to add.

• Purchase and transaction data: records of releases, bundles, and exclusive-access tiers you've purchased, gifted, or been gifted, and your spending history on the Service.

• Fan Achievements: your Supporter / Superfan / Legend status with a given artist. These tiers are calculated from your purchase and engagement history..

• Fan Connect data: if you opt in to hear from an artist, we record your email address, opt-in/opt-out status, and engagement data (opens, clicks) for messages sent through our Fan Connect campaign tool.

• Fan Chat and Community data: the text messages you send in Fan Chat, Fan Chat Groups, or the Community Broadcast Feed, along with timestamps and your visible display name. Artists posting in these spaces can share richer content - voice notes, video notes, files, images, and product links - which you'll see as a participant; see “From Artists” below.

• Gift data: if someone gifts you a release, we receive your email address from the purchaser in order to deliver the gift. If you send a gift, we collect the recipient's email address from you.

• Exclusive content access data: logs of purchase-gated or NFC-gated content you've accessed, used to enforce access rights and respond to rights-holder inquiries.

From Artists

• Artist profile and content: your artist bio, location, genre, social links, and everything you upload to Backstage - recordings, artwork, metadata, video, pricing, and release configuration.

• Fan Chat and Community Broadcast content: voice notes, video notes, files, images, and product links you post in Fan Chat, Fan Chat Groups, or the Community Broadcast Feed. Fans, by contrast, can only post text in these spaces.

• Stripe Connect Express data: Stripe collects your identity-verification documents, tax details, and bank account information directly, as required by Australian/NZ law and Stripe's own terms. Nexera receives transaction records, payout history, revenue-split configuration, and Stripe account status - we do not directly collect or store your ID documents or bank details.

• Artist Insights data: aggregated analytics about your releases and audience (sales, engagement, achievement-tier distribution), generated from platform activity.

2. How We Use Your Personal Data

For All Users

• To create and administer your account and let you use the Service.

• To process transactions and deliver the content, access, or physical goods you've purchased.

• To operate, secure, and improve the Service, including fraud prevention and abuse detection.

• To respond to support inquiries and enforce our Terms of Service.

• To comply with our legal obligations, including tax, consumer-law, and financial record-keeping requirements.

For Fans

• To process your purchases, gifts, and access to exclusive content.

• To deliver Fan Connect messages from artists you've opted in to hear from.

• To calculate your Fan Achievement tier and community standing with an artist, generated at the time it's displayed.

• To operate Fan Chat, Fan Chat Groups, and the Community Broadcast Feed, including displaying your messages and display name to other participants.

• To detect and prevent unauthorised access to purchase-gated or exclusive content.

For Artists

• To provide Artist Insights and Fan Data (including CSV export) through Backstage, so you can engage with and analyse your audience.

• To process payouts to you through Stripe Connect Express and administer revenue-split configurations.

• To report usage data to relevant collecting societies (for example, APRA AMCOS and/or PPCA) where required under a licence Nexera Music or you hold - see Section 5.

We don't use your Personal Data for purposes beyond what's described in this Policy without telling you first. If you give us Personal Data about someone else (for example, a gift recipient), you confirm you're authorised to do so and have made them aware of this Policy.

3. Who Can See Your Data

Fans: what artists can see. When you buy a release, join Fan Connect, or otherwise interact with an artist, that artist can see and export your Fan Data through Backstage. “Fan Data” means your name, email address, phone number (if you've provided one), and any other details you've entered on the platform, together with your purchase history and spending with that specific artist.

• Backstage access: artists can view the Fan Data described above for fans who've bought their releases, joined their community, or opted in to their Fan Connect list.

• CSV export: artists can export this Fan Data as a CSV file. Once it's exported, the artist is solely responsible for storing and handling it securely and lawfully - Nexera can't retrieve or delete data that's already left our systems this way.

• Scope: an artist only ever sees Fan Data for fans who've engaged with them specifically - never fans of other artists on the platform.

• Aggregated Artist Insights: sales totals, engagement trends, and the distribution of Supporter/Superfan/Legend tiers across their audience, alongside the identifiable Fan Data above.

• Fan Chat / community visibility: your display name and any avatar you've set, if you participate in that artist's Fan Chat, Fan Chat Groups, or Community Broadcast Feed - the same way any community member would see it.

• Physical order fulfilment: the shipping name and delivery address needed to fulfil a physical order, only for orders they are responsible for shipping, and only for that specific order.

Artists cannot sell or rent your Fan Data to third parties. If an artist's account is terminated or suspended, we revoke their ongoing access to Fan Data in Backstage - but we can't retrieve or delete data they exported before that point. If you believe a former artist is still holding your data unlawfully, contact us and we'll do what we reasonably can to help, including passing on your deletion request.

Nexera's own team. Authorised Nexera staff and contractors can access Personal Data as needed to operate the Service, provide support, investigate abuse or fraud, and comply with legal obligations - for example, through the admin panel used for account approvals, suspensions, and platform-wide settings. Access is limited to what's needed for the relevant task.

Service providers. Certain infrastructure and processing partners necessarily handle Personal Data on our behalf in order to run the Service - see Section 5 (How We Share Your Data) and Section 6 (Where Your Data Is Held).

4. Our Basis for Using Your Personal Data

Depending on the circumstances, we collect and use Personal Data because:

• You've asked us to provide a service that requires it - for example, processing a purchase, delivering exclusive content, or paying out an artist.

• You've given us consent - for example, opting in to Fan Connect communications, or consenting to non-essential cookies.

• We need to meet a legal or regulatory obligation - for example, tax and financial record-keeping, or responding to a lawful request.

• We (or a third party) have a legitimate interest in the processing that isn't outweighed by your privacy interests - for example, keeping the Service secure, preventing fraud, and improving our products.

5. How We Share Personal Data

We don't sell or rent your Personal Data. We share it only as described here.

Artists (Licensors)

As described in Section 3 (Who Can See Your Data), artists can view and export the Fan Data of fans who've engaged with them specifically - name, email address, phone number (if provided), platform details, and purchase history. Artists cannot sell or rent this data, and once they've exported it, they're solely responsible for handling it securely and lawfully. If you'd like to exercise a privacy right (such as deletion) over Fan Data held by a specific artist, contact us and we'll notify the artist and request they act on it.

Service Providers

We engage third parties to help us run the Service. They process Personal Data on our behalf, under contractual confidentiality and security obligations, and only for the purposes we direct. These include:

• Payment processing: Stripe, for payment processing and artist payouts (Stripe Connect Express).

• Cloud infrastructure: providers of database, authentication, hosting, content delivery, video, and audio-processing services that run the Service - see Section 6 for where this data is held.

• Email delivery: our email service provider, for transactional email and Fan Connect campaign delivery.

This describes the categories of service providers we use; it isn't an exhaustive list, and it may change as our infrastructure evolves.

Legal Compliance and Safety

We may access, preserve, or disclose Personal Data if we reasonably believe it's necessary to comply with a legal process (such as a court order or subpoena), enforce our Terms of Service, or protect the rights, property, or safety of Nexera, our users, or the public.

Business Transfers

If Nexera is involved in a merger, acquisition, financing, or sale of assets, Personal Data may be transferred as part of that transaction. We'll require the receiving party to honour the commitments made in this Policy, and we'll notify you of any material change in control or use of your Personal Data.

With Your Consent

Outside of what's described above, we'll ask for your consent before sharing your Personal Data with a third party.

6. Where Your Data Is Held & Cross-Border Transfers

Our infrastructure, including our primary database, is hosted in Sydney, Australia. Some of our service providers process Personal Data on infrastructure located outside Australia and New Zealand as part of running the Service, including in the United States.

Where we or our service providers transfer Personal Data outside Australia, we take reasonable steps consistent with Australian Privacy Principle 8 (cross-border disclosure) to ensure it receives comparable protection - including choosing providers with their own strong security and privacy commitments, and using contractual protections where appropriate. New Zealand users' data is similarly protected consistent with Information Privacy Principle 12 of the Privacy Act 2020 (NZ).

7. How Long We Keep Your Data

We keep Personal Data only as long as necessary for the purpose it was collected, or as required by law.

• Account deletion: if you delete your account, we'll delete your Personal Data within 30 days, except where we need to retain it for legal compliance (including tax and transaction records), to resolve a dispute, to complete a pending transaction or payout, or to enforce our Terms of Service.

• Financial and tax records: retained for the period required by Australian and/or New Zealand law.

• Derived data: Fan Achievement tiers, campaign status, and sales-window status are calculated fresh each time they're needed and are not separately stored, consistent with our data-minimisation approach.

• Exchange rate data: where a purchase involves currency conversion, we record the exchange rate applied at the time of the transaction on the order record, as a point-in-time transactional fact.

• Fan Connect opt-out records: retained for as long as needed to honour your opt-out and demonstrate compliance with anti-spam law.

8. Data Security

We use reasonable technical and organisational measures to protect Personal Data against loss, misuse, and unauthorised access, including encryption in transit, access controls, and restricting internal access to what's needed for a given task. However, no method of transmission or storage is completely secure, and we can't guarantee absolute security. You're responsible for keeping your account password confidential.

9. Marketing & Fan Connect Communications

If you opt in to hear from an artist, they may send you email updates through our Fan Connect tool, delivered via our email provider, Resend. You can unsubscribe at any time using the link in any Fan Connect email. Opting out of one artist's communications doesn't opt you out of others, and doesn't affect transactional emails (such as order confirmations) which we'll continue to send you.

Consent to receive marketing communications is never a condition of purchase. We don't currently send marketing SMS/text messages; if that changes, we'll update this Policy and seek separate consent.

10. Cookies & Similar Technologies

We use cookies and similar technologies to run and improve the Service:

• Strictly necessary: required for authentication, security, and core functionality (for example, keeping you signed in). These can't be switched off.

• Performance and analytics: help us understand how the Service is used so we can improve it. Where these aren't strictly necessary, we'll ask for your consent.

• Local/session storage: used similarly to cookies, to remember preferences and maintain your session.

You can control cookies through your browser settings, though blocking some cookies may affect how the Service works.

11. Children & Young People

The Service is not intended for children under 16, and we do not knowingly collect Personal Data from anyone under that age. If you believe a child has provided us with Personal Data without appropriate consent, contact us at privacy@nexera.music and we'll delete it.

If you are under 18, you should have a parent or guardian's permission to use the Service and to make any purchases.

12. Your Privacy Rights

If you request deletion of your Personal Data and an artist holds your Fan Data - through their ongoing Backstage access or a CSV export - we'll notify that artist and require them to delete it from their own systems, except where they need to retain it for legal compliance. As noted in Section 3, we can't force deletion of data an artist has already exported and stored outside our systems, but we will pass on your request and expect them to comply.

Australia

If you're in Australia, you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including the right to:

• Know what Personal Data we hold about you and how it's used.

• Request access to your Personal Data.

• Request correction of inaccurate or out-of-date Personal Data.

• Withdraw consent, where we're relying on your consent.

• Complain about how we've handled your Personal Data.

To exercise these rights, contact us at privacy@nexera.music. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

New Zealand

If you're in New Zealand, you have rights under the Privacy Act 2020, including the right to access and request correction of your Personal Data, and to complain about how it's handled.

To exercise these rights, contact us at privacy@nexera.music. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Elsewhere

If you're located outside Australia or New Zealand, we'll still try to honour reasonable requests regarding your Personal Data in line with this Policy, even though those specific regulatory frameworks may not directly apply to us.

13. Data Breach Notification

If we experience a data breach that's likely to result in serious harm to you, we'll notify you and the relevant regulator without undue delay, consistent with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) and the equivalent requirements under the Privacy Act 2020 (NZ).

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or the law. We'll post any changes on this page and update the “Last Updated” date above. If a change is material, we'll notify you by email or through the Service. Continuing to use the Service after a change takes effect means you accept the updated Policy.

15. Contact Us

If you have questions about this Policy or want to exercise your privacy rights, contact us:

• General privacy inquiries: privacy@nexera.music

• Support: support@nexera.music

• Postal address: Suite 1186, 189 Queen Street, Melbourne CBD, Victoria 3000

We'll do our best to resolve any concerns promptly.

Nexera is operated by Moore Universe Pty Ltd, doing business as Nexera Music.