Legal
Last updated: 23 July 2026
N3XA Ltd ("N3XA", "we", "us", "our") builds an AI-powered operating system for the music industry. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it. It applies to n3xa.ai, the N3XA web and mobile applications, our APIs, and any related services (together, the "Services").
We are the data controller of the personal data we process about visitors, waitlist subscribers, account holders, invited collaborators and, where relevant, fans interacting with artist spaces on the platform. For customer-uploaded catalogue and fan data processed on behalf of an artist or label, N3XA acts as a data processor and processes such data in accordance with the customer's instructions and a Data Processing Agreement.
We collect information in three ways.
We process personal data to:
Where UK or EU data protection law applies, we rely on the following bases:
N3XA uses AI models to power features such as audience intelligence, campaign recommendations, catalogue insights, creative drafting and predictive analytics. These features process account and connected-platform data as inputs, excluding Google user data, which is used only to provide the calendar feature and is never used to train models. We do not use content you upload to train foundation models for other customers, and we contractually restrict our model providers from doing the same.
Google user data is used solely to provide and improve the Google Calendar integration for the user who connected it. It is never used for advertising, never sold, never transferred except as necessary to provide that feature, and never used to train or improve any AI or machine learning model.
Where an automated decision would produce legal or similarly significant effects, we offer human review on request. AI outputs are decision-support and should be reviewed by a human before acting on them.
N3XA offers an optional Google Calendar integration. Users who choose to connect their Google account allow N3XA to read and write calendar events so that meetings, studio sessions, travel, promo commitments and release dates appear alongside the rest of their work in N3XA, and so that events created in N3XA appear in their own Google Calendar.
We request access to Google Calendar data only. We use it solely to display and manage the user's own schedule inside N3XA. We do not sell this data, we do not use it for advertising, and we do not transfer it to third parties except as necessary to provide the integration or where required by law.
N3XA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Where we use artificial intelligence to provide features, any Google user data processed by our AI subprocessor (Anthropic) is used solely to deliver the requested functionality under commercial terms that prohibit its use for training or improving AI models. Google user data is never used to create, train, or improve any machine learning model.
Calendar data is stored securely and is visible only to the user whose Google account it came from. It is not shared with other users, other workspaces, or any third party, and it is not used for any purpose other than providing the calendar feature to that user.
Users can disconnect their Google account at any time from within N3XA settings, or revoke access directly at https://myaccount.google.com/permissions. On disconnection, N3XA stops accessing their Google Calendar data and deletes any cached calendar data held for that user.
We do not sell personal data. We share it only with:
Google user data is excluded from all of the above sharing categories except sub-processors strictly necessary to deliver the Google Calendar integration.
We are headquartered in the United Kingdom and use sub-processors in the UK, European Economic Area and United States. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, adequacy decisions, or another lawful transfer mechanism, together with appropriate technical and organisational safeguards.
We retain personal data for as long as needed to provide the Services and for the purposes described in this Policy. Typical retention periods:
After the retention period we delete or anonymise personal data. Backups are purged on a rolling cycle.
We use strictly necessary cookies to run the Services and, with your consent, analytics and preference cookies to understand usage and remember settings. You can manage your choices at any time through the cookie banner or your browser settings. Blocking essential cookies may break parts of the platform.
N3XA uses encryption in transit (TLS 1.2 or higher) and at rest, role-based access controls, secrets management, audit logging, code review, dependency scanning and least-privilege infrastructure. Access to production data is limited to authorised personnel who need it to operate the Services and is reviewed regularly. No system is perfectly secure, and we cannot guarantee absolute security, but we work continuously to protect the data you trust us with.
Depending on where you live, you may have the right to:
California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and limit use of sensitive personal information, and to not be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined by the CPRA.
To exercise any right, contact us via the address in Section 13. We will respond within the timeframes required by applicable law.
The Services are not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, please contact us and we will delete it.
We may update this Privacy Policy from time to time. If we make material changes we will notify you by email or in-product notice and update the "Last updated" date above. Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.
Data controller: N3XA Ltd, registered in England and Wales. For privacy questions, data subject requests or to reach our privacy team, please use our contact page or email privacy@n3xa.ai.
© 2026 N3XA Ltd