Privacy Policy

1. Information We Collect

1.1 Account and Profile Data

When you create an account, we collect: name, email address, country, profile picture, and bio. For Artists, we also collect payment and banking details necessary for processing payouts.

1.2 Transaction and Purchase Data

When Fans make purchases, subscribe, or tip, we collect: items purchased, transaction amounts, payment method details (processed and stored by Stripe — we do not store full card numbers), billing address, purchase history, and subscription status.

1.3 Content and Activity Data

For Artists: music files, artwork, metadata, release page content, merchandise listings, email campaign content, and fan communications sent through the Platform.

For Fans: download history, email interactions (opens, clicks), listening behavior (tracks played, duration, timestamps), release page visits, and engagement with Artist content.

1.4 Fan Intelligence Data

We process Fan activity data to generate automated scores across three dimensions — Value (purchase behavior), Engagement (interaction frequency), and Recency (how recently the Fan interacted) — which produce fan grades (e.g., superfan, active, lapsed) and action signals. This profiling is performed by automated processing to help Artists understand and engage with their fan base. See Section 7 for more information about your rights regarding this profiling.

1.5 Device and Technical Data

We collect: IP address, browser type and version, device type, operating system, referring URL, pages visited, time spent on pages, and access timestamps.

1.6 Cookies and Tracking Technologies

We use cookies and similar technologies for authentication, preferences, analytics, and performance. See our Cookie Policy for details.

We use the following categories of third-party tools:

• Analytics: PostHog (usage analytics and event tracking)
• Payment Processing: Stripe
• Email Delivery: Resend (transactional and marketing emails)
• Advertising: Google Ads (conversion tracking on our marketing site)

2. How We Use Your Information

We use your information for the following purposes, with the corresponding legal bases under GDPR:

• Platform Operation — providing the Services, processing transactions, managing accounts, delivering Digital Content, facilitating Artist-Fan communications, and providing customer support. Legal basis: Contract (Art. 6(1)(b)).
• Payment Processing — processing purchases, subscriptions, tips, and Artist payouts through Stripe; complying with financial reporting and anti-fraud obligations. Legal basis: Contract (Art. 6(1)(b)) and Legal Obligation (Art. 6(1)(c)).
• Fan Intelligence and Analytics — generating V/E/R fan scores, producing analytics dashboards for Artists, and analyzing platform performance. Legal basis: Legitimate Interest (Art. 6(1)(f)) — helping Artists understand and serve their fans. You have the right to object (see Section 7).
• Email Communications — sending transactional emails (purchase confirmations, download links, account notifications) and, where you have consented or where permitted by applicable law, marketing emails. Legal basis: Contract (Art. 6(1)(b)) for transactional emails; Consent (Art. 6(1)(a)) or Legitimate Interest (Art. 6(1)(f)) for marketing emails.
• Content Scanning and Fraud Prevention — scanning uploaded content for copyright infringement and fraud using automated tools; verifying identities; preventing abuse. Legal basis: Legitimate Interest (Art. 6(1)(f)).
• Product Improvement — analyzing usage patterns to improve Platform features, fix bugs, and develop new functionality. Legal basis: Legitimate Interest (Art. 6(1)(f)).
• Legal Compliance — complying with applicable laws, regulations, legal processes, and government requests; enforcing our Terms of Service. Legal basis: Legal Obligation (Art. 6(1)(c)).

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

• With Artists (Fan data). When a Fan makes a purchase, subscribes, provides their email, or tips an Artist, we share the Fan's name, email address, purchase details, subscription status, and fan scores with that Artist through the Platform's CRM tools. Artists are contractually prohibited from selling or sharing Fan data with third parties (see our Terms of Service, Section 7.3).
• With Fans (Artist data). Artist profiles, Smart Bio pages, Release Pages, and related public content are visible to Fans and the general public.
• Service Providers. We share data with third-party service providers who process data on our behalf, including: Stripe (payment processing), Resend (email delivery), PostHog (analytics), Cloudflare (content delivery and storage), and Railway/Render (hosting). These providers are contractually bound to use your data only for the services they provide to us.
• Legal Compliance. We may disclose information if required by law, legal process, government request, or to protect the rights, property, or safety of ALERA, our users, or the public.
• Business Transfers. In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.
• With Your Consent. We may share information for purposes not described here with your explicit consent.

4. Data Controller and Processor Roles

Under GDPR and similar data protection laws, ALERA acts in different roles depending on the data type:

ALERA as Data Controller

We are the data controller for Artist account data, platform analytics, platform-level Fan data (account information, aggregated usage data), V/E/R fan scoring (we designed the scoring algorithm and determine its purpose), cookie and tracking data, and payment processing coordination.

ALERA as Data Processor

We act as a data processor on behalf of Artists for: Fan purchase data specific to each Artist, Fan email addresses provided to specific Artists through release pages, and email campaign delivery on behalf of Artists.

Artists as Data Controllers

When Artists access Fan data through the CRM, send email campaigns, or otherwise use Fan data for their own purposes, they act as independent data controllers for that data and are responsible for their own compliance with applicable data protection laws.

5. International Data Transfers

ALERA is a Delaware (US) corporation with operations in Australia. Your data may be stored and processed in the United States.

EU/UK to US Transfers

We rely on the EU-US Data Privacy Framework (and its UK extension) for transfers of personal data from the EU/UK to the US. We also maintain Standard Contractual Clauses (SCCs) as a supplementary transfer mechanism. You can obtain a copy of the SCCs by contacting us at contact@alera.fm.

Australia to US Transfers

Under Australian Privacy Principle 8.1, we take reasonable steps to ensure that overseas recipients of personal data comply with the Australian Privacy Principles. We do this through contractual protections with our service providers.

Countries Where Data Is Sent

Your data may be transferred to and processed in: the United States (hosting, payment processing, analytics), and any other country where our service providers operate. You can contact us for a current list of sub-processors and their locations.

6. Data Retention

We retain your data for as long as necessary to provide the Services and fulfill the purposes described in this Policy, subject to the following schedules:

• Account and Profile Data. Retained for as long as your account is active. After account deletion, we retain a minimal set of data (email, account ID) for up to 12 months to prevent fraud, resolve disputes, and comply with legal obligations.
• Transaction and Purchase Records. Retained for up to 7 years after the transaction to comply with tax, accounting, and financial reporting requirements.
• Fan Activity and Engagement Data. Retained for up to 3 years after your last interaction with the Platform. V/E/R scores are recomputed daily and historical scores are not retained beyond 12 months.
• Content and Activity Logs. Retained for up to 3 years after account deletion.
• Technical and Device Data. Retained for up to 12 months.
• Email Marketing Data. Consent records and unsubscribe requests are retained indefinitely for compliance purposes. Email content and delivery logs are retained for up to 2 years.

7. Your Privacy Rights

Depending on your location, you may have some or all of the following rights:

7.1 Rights Under GDPR (EU/EEA and UK)

• Access. Request a copy of the personal data we hold about you.
• Rectification. Request correction of inaccurate personal data.
• Erasure ("Right to Be Forgotten"). Request deletion of your personal data, subject to legal retention requirements.
• Restriction. Request that we restrict processing of your data in certain circumstances.
• Portability. Request your data in a structured, commonly used, machine-readable format.
• Object. Object to processing based on legitimate interest, including profiling. You have an absolute right to object to profiling for direct marketing purposes — we will stop immediately upon receiving your objection.
• Withdraw Consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Automated Decision-Making. The V/E/R fan scoring system uses automated processing to categorize fans. These scores are used to provide Artists with engagement insights and do not produce legal effects or similarly significant effects on Fans. You have the right to object to this profiling.

To exercise these rights, contact us at contact@alera.fm or use the controls available in your account settings. We will respond within 30 days (extendable by two further months for complex requests).

EU Representative. Under GDPR Article 27, if required, our EU representative can be contacted at contact@alera.fm.

7.2 Rights Under CCPA/CPRA (California)

California residents have the right to: know what personal information is collected, used, and shared; delete personal information (subject to exceptions); correct inaccurate personal information; opt out of the sale or sharing of personal information; and limit the use of sensitive personal information.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

To exercise your rights, contact us at contact@alera.fm. We will not discriminate against you for exercising your privacy rights.

7.3 Rights Under Other US State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out. Contact us at contact@alera.fm to exercise these rights.

7.4 Rights Under Australian Privacy Act

Under the Australian Privacy Principles, you have the right to: access the personal information we hold about you (APP 12); request correction of inaccurate information (APP 13); and complain about a breach of the APPs. Contact us at contact@alera.fm. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Automated Decision-Making Disclosure (APP 1.7). ALERA uses automated processing (V/E/R fan scoring) to categorize fans based on purchase behavior, engagement frequency, and recency of interaction. The scores are used to: assign fan grades (superfan, top fan, loyal listener, subscriber, active, new fan, lapsed, passive), generate action signals for Artists, and power analytics dashboards. The personal information used includes purchase history, email interaction data, release page visit frequency, and timestamps of last activity. If you wish to request a review of how automated scoring has been applied to your account, contact contact@alera.fm.

8. Children's Privacy

The Platform is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected data from a child under 16 without parental consent, we will delete that information promptly. If you believe we have collected information from a child under 16, please contact us at contact@alera.fm.

For users in the United States, we comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under 13.

9. Security

We implement reasonable administrative, technical, and physical safeguards to protect your information, including: encryption of data in transit (TLS) and at rest, access controls and authentication, regular security assessments, and secure data storage with Cloudflare and Railway. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Do Not Track and Global Privacy Control

We honor Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request for the sale or sharing of personal information under applicable state laws. We do not currently respond to browser-level "Do Not Track" signals, as there is no universally accepted standard for how to respond to such signals.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and/or through a prominent notice on the Platform at least 30 days before they take effect. We recommend reviewing this page regularly. The effective date at the top of this page indicates when this Policy was last updated.

12. Contact Us

For privacy inquiries, data subject requests, or complaints, contact us at:

Alera Technologies, Inc.
Email: contact@alera.fm

For Australian users, you may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

For EU/UK users, you have the right to lodge a complaint with your local data protection supervisory authority.