Vesonus Privacy Policy

1. Who we are

This Privacy Policy explains how Vesonus AS ("Vesonus", "we", "us" or "our") processes personal data when you use vesonus.com, vesonus.app, related creator services, support channels and other Vesonus services.

Vesonus AS Kjellergata 17A 2003 Lillestrøm Norway Org. no. 935 677 335

Primary privacy contact: support@vesonus.com Platform-specific support: support@vesonus.app

Vesonus is established in Norway and is subject to applicable Norwegian data-protection law and the GDPR where applicable.

2. Scope

This Policy applies to personal data processed in connection with the Vesonus website, platform, accounts, subscriptions, creator workflows, creator websites, licensing and distribution-related services, support, communications, analytics, advertising measurement and related business operations.

Service-specific agreements may contain additional privacy information where a particular workflow requires it. If a service-specific notice conflicts with this Policy for that workflow, the more specific notice applies to the extent required by law.

3. Our privacy principles

We aim to process only data that is reasonably necessary for a defined purpose; keep personal data only as long as necessary or legally required; use appropriate security controls; respect creator ownership and confidentiality; and give users meaningful control over optional analytics and advertising tracking.

4. Personal data we may collect

Depending on how you use Vesonus, we may process the following categories of personal data:

4.1 Account and identity data Name, creator or stage name, email address, login and authentication information, account role, age/eligibility confirmations, account status, profile settings and similar account information.

4.2 Creator and professional data Artist or producer profile information, biographies, links, social profiles, public display names, portfolio information, release data, music metadata, credits, collaborator information, rights information, licensing selections, release history and creator website content.

4.3 Uploaded content and files Music, audio files, artwork, images, documents, metadata and other content you upload or submit. Private source files and restricted assets are handled separately from public-ready versions where the product architecture supports that distinction.

4.4 Subscription, billing and transaction data Plan, subscription status, trial status, transaction history, invoices, payment status, refunds, creator earnings allocations, cash-out records and related billing information. Payment-card details are generally processed by our payment provider rather than stored directly by Vesonus, except to the extent a provider returns limited payment identifiers or status information.

4.5 Licensing and distribution data Production-licence terms, hold or exclusivity status, collaborator splits, release instructions, rights confirmations, distribution metadata, takedown status, royalty reports and similar operational records.

4.6 Support and communications data Messages sent to support, contact forms, inquiries, complaint records, copyright notices, fraud reports, account communications and related correspondence.

4.7 Technical and usage data IP address, browser/device information, operating system, timestamps, pages or screens viewed, referral source, session and event data, consent state, error/debug information and similar technical information.

4.8 Marketing and attribution data UTM parameters, advertising click identifiers, campaign/referral information, marketing preferences, email engagement and similar attribution information, subject to applicable consent requirements.

4.9 Fraud, security and compliance data Information reasonably necessary to detect abuse, verify rights, investigate fraud, respond to chargebacks, protect accounts, comply with sanctions or legal obligations, and resolve ownership or infringement disputes.

We do not intentionally request special-category personal data unless it is genuinely necessary for a lawful purpose. Users should avoid submitting sensitive personal data through ordinary profile, support or creator-content fields unless requested by Vesonus for a specific legitimate reason.

5. How we collect personal data

We collect data directly from you when you create an account, subscribe, upload content, licence or distribute music, contact support, configure a creator website, submit forms or otherwise use Vesonus.

We may also receive data from service providers and partners, such as payment providers, hosting and infrastructure providers, distribution partners, analytics/advertising providers, email providers, fraud/security providers, and digital music services where relevant to the service.

We may derive operational information from your use of Vesonus, for example account activity, product events, entitlement status, attribution and security signals.

6. Why we process personal data and our legal bases

Depending on the context and applicable law, Vesonus may process personal data for the following purposes:

6.1 To provide and administer the service Including account creation, authentication, subscriptions, entitlements, uploads, creator websites, licensing, distribution workflows, support and creator earnings administration. Legal basis: performance of a contract, steps requested before entering a contract, and legitimate interests where appropriate.

6.2 To process payments, refunds, earnings and accounting Including subscription billing, transaction records, creator allocations, cash-out records and required financial documentation. Legal basis: performance of a contract, legal obligations and legitimate interests.

6.3 To protect Vesonus, creators and rights holders Including account security, fraud prevention, infringement investigations, rights disputes, chargebacks, abuse prevention and enforcement of our Terms and policies. Legal basis: legitimate interests, legal obligations and, where applicable, establishment, exercise or defence of legal claims.

6.4 To comply with legal obligations Including accounting, tax, sanctions, regulatory requests, court orders and other binding legal requirements. Legal basis: legal obligation.

6.5 To operate analytics and improve Vesonus Including understanding product usage, performance, reliability and user journeys. Legal basis: consent where required for non-essential analytics/tracking; otherwise legitimate interests only where lawful.

6.6 To measure advertising and campaign performance Including campaign attribution, conversion measurement and supported cross-domain attribution from vesonus.com to vesonus.app. Legal basis: consent where required.

6.7 To send service communications Including account notices, security alerts, billing notices, product-service messages, legal notices and support responses. Legal basis: contract, legal obligation or legitimate interests.

6.8 To send marketing communications Where permitted, Vesonus may send promotional or marketing communications based on consent or another lawful basis. You can opt out of direct marketing at any time.

7. Cookies, tracking and consent

Vesonus may use cookies, local storage, pixels, SDKs or similar technologies for essential operation, analytics and advertising measurement.

Non-essential analytics and advertising technologies are intended to load only where the required consent has been obtained. Users should be able to reject optional tracking without losing access to the core service, except where a particular optional feature genuinely requires the relevant technology.

Our Cookie & Tracking Policy explains the categories of technologies we use, the providers involved, retention, consent controls and how to change your preferences.

8. Analytics and advertising providers

At launch, Vesonus may use or integrate providers including Google Analytics, Meta, TikTok and OpenAI/ChatGPT advertising measurement, subject to consent and actual production configuration.

We may preserve limited campaign attribution information across the vesonus.com to vesonus.app handoff where permitted by your consent choices. Advertising identifiers are not intended to be retained or transferred where the required advertising consent is absent.

Provider-specific features, identifiers and retention settings may change. The public policy and cookie disclosure must reflect the verified production configuration before launch.

9. Payment and financial providers

Vesonus uses third-party payment and financial-service providers, including Stripe, to process payment-related activity. These providers may process personal data under their own terms and privacy policies and may act as independent controllers for some processing.

Vesonus generally receives transaction identifiers, payment status, limited billing information and similar operational data rather than complete card details.

10. Infrastructure, database and communications providers

Vesonus may use providers including Supabase, Vercel, Resend and Brevo for hosting, databases, application infrastructure, transactional email, marketing communications or related functions. The exact provider list and roles must match the verified launch configuration.

11. Distribution and music-industry partners

Where you use distribution or related music-industry services, Vesonus may share relevant release, rights, creator and metadata information with third-party distribution partners, digital service providers, royalty/reporting partners and other downstream service providers as needed to perform the requested service.

The external distribution provider is not yet fixed and should remain provider-neutral until selected.

12. Who we share personal data with

We may share personal data with:

• service providers acting on our behalf; • payment providers and financial institutions; • distribution partners and digital music services where required to deliver releases; • analytics and advertising providers where consent and law permit; • professional advisers such as lawyers, accountants and auditors; • public authorities or regulators where legally required; • counterparties involved in an ownership, licensing, copyright, fraud or payment dispute where reasonably necessary; and • a buyer, investor or successor in connection with a legitimate corporate transaction, subject to appropriate protections.

We do not sell personal data as a standalone data-broker business model.

13. International transfers

Some of our service providers may process personal data outside Norway or the European Economic Area.

Where required, Vesonus will rely on an appropriate transfer mechanism, such as an adequacy decision, standard contractual clauses, or another lawful safeguard, together with supplementary measures where necessary.

The exact transfer framework depends on the provider and processing activity and should be validated before final publication.

14. Data retention

We retain personal data only for as long as reasonably necessary for the relevant purpose, to meet legal obligations, or to establish, exercise or defend legal claims.

Working retention rules for launch are:

• inactive account data: up to 12 months to allow account reactivation, unless a longer retention period is required for a separate legal or contractual reason; • eligible account data following a deletion request: targeted for deletion or anonymisation within 30 days; • secured backups: deleted data may remain in backup systems for up to 90 days before normal overwrite, provided it is not routinely restored for ordinary use; • first-party attribution data: up to 13 months; • analytics event/user data: up to 14 months where the configured provider supports that period; • marketing contact data: while the relationship or consent remains active and for a reasonable period thereafter, with suppression records retained where necessary to respect opt-outs; • accounting, transaction and legally required financial records: retained for the statutory period required under Norwegian law; • fraud, dispute, copyright, chargeback and legal-claim records: retained for as long as reasonably necessary for the relevant investigation, limitation period, legal obligation or defence of claims.

These periods may be shortened or extended where necessary to comply with law or reflect verified provider limitations. Final public wording must match the actual production settings.

15. Account inactivity and deletion

If an account is inactive after a trial or subscription ends, Vesonus may preserve the account and eligible creator data for up to 12 months to allow the user to return without rebuilding their profile. Paid entitlements do not continue merely because account data remains stored.

You may request account deletion through available account controls or by contacting support. We will delete or anonymise eligible data, subject to legal, accounting, fraud, rights-management, security and dispute-retention requirements.

16. Your rights

Subject to applicable law, you may have rights to:

• access your personal data; • correct inaccurate data; • request deletion; • restrict processing; • object to certain processing; • receive certain data in a portable format; • withdraw consent at any time where processing is based on consent; and • lodge a complaint with a data-protection authority.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

For privacy requests, contact support@vesonus.com.

17. Marketing choices

You may unsubscribe from marketing emails using the unsubscribe mechanism in the message or by contacting us.

We may retain a limited suppression record after opt-out so that we can remember not to send future marketing to that address.

Service, security, billing, legal and account-operational communications are not marketing and may still be sent where necessary.

18. Children and young users

Vesonus is intended for users aged 13 or older.

Users under 18 must involve a parent or legal guardian where required and may not independently enter paid subscriptions, distribution agreements, production licences or other binding commercial arrangements unless valid guardian consent has been obtained.

Where parental consent is legally required for personal-data processing, Vesonus may request appropriate confirmation before enabling the relevant service.

19. Creator websites and public information

Where a creator chooses to publish a Vesonus-hosted creator website or public profile, the information intentionally selected for publication may become publicly accessible.

Vesonus should only expose public-safe data and approved public assets through the public website contract. Private originals, restricted download packages, private storage paths and other non-public creator data must not be exposed merely because a public creator website exists.

20. Creator audience and inquiry data

Where creator-specific audience or inquiry features are offered, those records are private account data and are distinct from Vesonus corporate marketing data.

If creator mailing-list functionality is launched, consent, suppression, unsubscribe and controller/processor roles must be clearly defined in the relevant feature notice before activation. Creator-site email capture is currently deferred from launch V1.

21. Security

Vesonus uses technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, misuse or disclosure.

No online service can guarantee absolute security. Users are responsible for protecting account credentials and should notify Vesonus promptly of suspected compromise.

22. Automated systems and AI-related services

Vesonus may use automated systems to support technical analysis, moderation, security, fraud prevention, support or operational workflows. Where a system makes or materially supports a decision with significant legal or similarly significant effects, Vesonus will apply applicable legal requirements concerning transparency and human review.

Simon Says is intended to evaluate technical release readiness and not artistic quality or commercial potential.

23. Legal requests and disputes

We may preserve or disclose personal data where reasonably necessary to comply with law, respond to valid legal process, investigate infringement, resolve ownership disputes, prevent fraud or protect users, Vesonus or third parties.

24. Changes to this Policy

We may update this Privacy Policy to reflect changes in law, products, providers or processing practices.

Where a change materially affects your rights or how we use personal data, we will provide appropriate notice where required.

25. Complaints and supervisory authority

You may contact Vesonus first at support@vesonus.com so we can try to resolve the issue.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or another competent supervisory authority where applicable.

26. Contact

Vesonus AS Kjellergata 17A 2003 Lillestrøm Norway Org. no. 935 677 335

Privacy and general legal contact: support@vesonus.com Platform support: support@vesonus.app

---