CULTURE VAULT PRIVACY POLICY

This is the Privacy Policy for Culture Vault Pty Ltd ACN 651 247 031 (Culture Vault).

References in this Privacy Policy to "Culture Vault", "we", "us" and "our" are a reference to Culture Vault.

WHO WE ARE

Culture Vault is an artist-first platform for publishing, collecting and protecting digital art. We work with emerging and established artists from both the digital and traditional art world to publish, sell and display their work, and with collectors who discover, collect and hold it.

The platform has three surfaces: the Culture Vault Gallery, individual artist galleries, and the Studio in which artists and galleries publish.

OUR COMMITMENT TO PROTECT YOUR PRIVACY

We understand how important it is to protect your personal information. This document sets out our Privacy Policy commitment in respect of personal information that you may provide to us.

We recognise that any personal information we collect about you will only be used for the purposes indicated in this policy, where we have your consent to do so, or as otherwise required or authorised by law. It is important to us that you are confident that any personal information we collect from you, or that is received by us, will be treated with appropriate respect.

Our commitment in respect of personal information is to abide by the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and any other relevant law.

PERSONAL INFORMATION

When we refer to personal information we mean information or an opinion about an individual, from which that individual is, or may reasonably be, identified.

This personal information may include an individual's name, date of birth, phone number, email address, postal address, nationality, and the information you choose to publish on your profile.

It also includes information particular to this platform:

your wallet address and the transactions associated with it;
your collection, being the works you hold, love, curate and follow;
your published works, where you are an artist, including the titles, descriptions and media you

publish; and

your payout details where you receive proceeds, a royalty, a workspace share or a referral

reward.

Sensitive information

Sensitive information includes information about an individual's health, race or ethnic background, religion, trade union membership, political opinion, sexual preference or criminal record. It also includes biometric information and biometric templates.

Generally we will not collect sensitive information about an individual unless it is required in order to provide a service you have asked for. We will only collect sensitive information with that person's consent.

The one place we collect biometric information is age verification. See the section "AGE VERIFICATION AND BIOMETRIC INFORMATION" below, which explains exactly what happens, what we receive, and what we do not receive.

INFORMATION ABOUT NON-INDIVIDUAL CUSTOMERS

If our customer is an entity other than an individual, for example a company, a gallery or a trust, we may collect information about that entity. This information may include that entity's name and address, registration details, details of individuals involved with that entity, and financial information about that entity.

In this policy, a reference to Information includes personal information (including sensitive information) about individuals as well as information about non-individual customers.

WHY WE COLLECT YOUR INFORMATION

We collect and receive Information about you in order to operate the platform and provide our services. This includes:

creating and maintaining your account;
enabling you to collect, hold, publish and sell works;
processing payments, payouts, royalties and referral rewards;
verifying your age where you seek access to age-restricted works;
meeting our legal obligations, including anti-money laundering and counter-terrorism financing

obligations and tax reporting;

keeping the platform safe, which includes moderating content and detecting misuse; and
telling you about the platform, new works and artists, where you have asked us to.

If you apply for employment with us we may also collect personal information about you.

HOW DO WE COLLECT YOUR INFORMATION?

Information may be collected by us in a number of circumstances, including when you:

register for an account, or apply to publish on the platform;
connect a wallet;
buy, sell, publish, love, curate or share a work;
verify your age;
subscribe to a membership or to our mailing list;
contact us for support;
attend an event hosted by us; or
apply for employment with us.

Where reasonable and practical we will collect Information about you directly from you or one of your representatives, or from publicly available information. However, we may also collect Information about you from third parties, such as our contractors who supply services to us, a gallery or workspace that hosts you as an artist, an identity or age verification provider, a payment provider, and from advisers such as accountants or lawyers or other organisations authorised by you.

We also receive information from public blockchains. Transactions involving your wallet address are recorded on a public ledger that anyone can read, and we read it to show provenance, ownership and price history. See "BLOCKCHAIN AND PERMANENT STORAGE" below.

If you do not provide the Information requested by us, we may not be able to provide you with our services.

If you provide Information to us about another individual or about an entity with which you are associated, you must ensure that you are entitled to disclose that Information to us, and that we may collect, use and disclose such Information for the purposes described in this Privacy Policy.

AGE VERIFICATION AND BIOMETRIC INFORMATION

Some works on the platform are rated Mature or Explicit and are age-restricted. Before an age-restricted work is first revealed to you, we will ask you to verify that you are over 18.

How it works. We use Agemin, a facial age estimation provider. You are asked to take a selfie. Agemin assesses the image to estimate your age and performs a liveness check to confirm a real person is present.

What we receive. Culture Vault receives the outcome (verified or not verified) and a session reference. That is all.

What we do not receive. Culture Vault does not receive, store or have access to your image, your biometric template, or your date of birth from this process.

Your consent. Age verification is optional. You may use the platform without it, and you will simply not see age-restricted works. If you choose to verify, you are consenting to Agemin collecting and processing your facial image as biometric information for that purpose. Agemin handles that image under its own privacy policy and its own retention rules, which we ask you to read before you begin.

Automated decision-making. Age estimation is an automated process and no person at Culture Vault reviews the result. If you believe the outcome is wrong, contact us using the details below and we will tell you how to seek a manual review.

Verification is optional and there is no alternative method. You are not required to complete age verification. If you choose not to, you may continue to use the platform normally, but works rated Mature or Explicit will not be shown to you. We do not offer a non-biometric way to verify your age.

CONTENT MODERATION

Every work published on the platform is assessed and assigned a content rating. We use Amazon Rekognition, an automated image and video analysis service, supported by human review.

This means that a work you upload is processed by an automated system before it is published. If that work contains an image of a person, including you, that image is processed as part of the assessment.

Where a work is withheld or removed, a person at Culture Vault may review it.

We report suspected child sexual abuse material to the relevant authority and cooperate fully with any resulting investigation.

HOW DO WE USE YOUR INFORMATION?

We use Information provided to us for the purpose for which it has been provided, for reasonably related secondary purposes, any other purpose you have consented to, and any other purpose permitted under the Privacy Act. This may include using your Information for the following purposes:

to provide you with the services you requested;
to verify your identity, and your age where you ask for access to age-restricted works;
to process a purchase, a sale, a payout, a royalty or a referral reward;
to assess, process and manage an application to publish on the platform;
to display provenance, ownership and price history;
to moderate content and keep the platform safe;
to assess, process and manage your application for employment; or
for complaints handling or analytics purposes.

TO WHOM WILL WE DISCLOSE YOUR INFORMATION?

To enable us to operate the platform and maintain a relationship with you, we may disclose Information about you to:

payment and settlement providers, currently Transak for card and fiat conversion and

Stripe for memberships, who perform their own identity checks and handle your payment details directly;

identity and age verification providers, currently Agemin;
content classification providers, currently Amazon Web Services (Rekognition);
infrastructure, storage and analytics providers, including hosting, permanent storage networks,

email delivery and website analytics;

a gallery or workspace that hosts you as an artist, in relation to your works and the proceeds

of their sale;

companies and contractors we retain to provide services to us, such as IT contractors, lawyers,

accountants and auditors, who need access to Information to provide those services;

people considering acquiring an interest in our business or assets; and
other individuals or companies authorised by you.

By providing us with your Information, you consent to us disclosing your Information to such entities without obtaining your consent on a case by case basis.

Sometimes we are required or authorised by Australian law to disclose your personal information. Circumstances in which we may do so include disclosure to a court, tribunal or law enforcement agency in response to a request or subpoena, or to the Australian Taxation Office. From time to time we may also be required to provide Information about you to a foreign law enforcement agency or foreign regulator.

Overseas disclosure

Some of our third party service providers are located outside Australia. Based on our current providers, your Information may be disclosed to recipients in the United States, the European Union and the United Kingdom.

Although our contracts with third parties generally include an obligation for them to comply with Australian privacy law and this Privacy Policy, some of those providers are located in countries that do not have laws providing the same level of protection as the laws of Australia. We may also use cloud storage and servers located offshore.

BLOCKCHAIN AND PERMANENT STORAGE

This section describes something you should understand before you transact, because it cannot be undone.

Public and permanent. When you buy, sell, publish or transfer a work, that transaction is recorded on a public blockchain. Culture Vault currently uses Ethereum, Polygon and Base. Anyone can read a public blockchain. The record includes your wallet address and the details of the transaction.

We cannot delete it. A blockchain record is permanent and is not controlled by Culture Vault. We cannot edit, delete or reverse it, and neither can anyone else. If you ask us to delete your personal information, we can delete what we hold in our own systems, but we cannot remove anything already written to a blockchain.

Artwork storage. Works published on the platform are stored on permanent and distributed storage networks, currently Arweave and IPFS. Content stored on those networks is designed to persist and may be replicated by parties we do not control. We cannot guarantee deletion of anything stored there.

Pseudonymous, not anonymous. A wallet address does not name you, but it can often be linked to a person by analysing activity across the ledger. You should treat your wallet address as information that may identify you.

DIRECT MARKETING

From time to time we may use your Information to provide you with information about the platform, artists and works, special offers you may find of interest, changes to our organisation, or new services. By providing us with your Information, you consent to us contacting you for this purpose, including by email and, where you have provided them, other channels.

Every marketing message we send carries a one-click unsubscribe. If you do not wish to receive marketing information, you may at any time decline by using that link or by contacting our Privacy Officer on the details below. We will not charge you for giving effect to your request and will take all reasonable steps to meet it at the earliest possible opportunity.

Transactional messages, such as a receipt, a security notice or a notification about a work you hold, are not marketing and will continue.

COOKIES AND ANALYTICS

We use cookies and similar technologies on the website to keep you signed in, to remember your preferences, and to understand how the platform is used. We use website analytics provided by a third party for that last purpose.

You can control cookies through your browser settings. Disabling some cookies may prevent parts of the platform from working.

ARTIFICIAL INTELLIGENCE

We do not licence artists' works for the training of artificial intelligence models, and we do not permit crawlers to collect work images, video or media files for that purpose.

We do permit automated systems, including search engines and answer engines, to access the text, descriptive copy and statistical information associated with a work, so that artists and their works can be found and cited.

You should understand that the technical measures available for this are a request rather than an enforcement mechanism, and we cannot guarantee that every third party will honour them.

RETENTION

We keep Information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law. Australian tax and corporations law generally require transaction records to be kept for seven years.

When Information is no longer needed for any purpose for which it may be used or disclosed, and we are not required to retain it, it will be destroyed or permanently de-identified. This does not apply to anything recorded on a blockchain or on a permanent storage network, which we cannot delete.

CHILDREN

You must be at least 16 to create an account. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact us and we will delete what we hold.

Users aged 16 and 17. A user under 18 may hold a free account, browse the galleries, follow creators, view works rated Safe and save them, but cannot publish, buy, sell or otherwise transact, and cannot view or acquire age-restricted works. We ask that a parent or guardian read this policy and consent to their use of the platform.

We treat information about a user under 18 with additional care. We do not use it for direct marketing, and we do not collect biometric information from anyone under 18 because age verification is not available to them.

UPDATING YOUR INFORMATION

It is important to our relationship that the Information we hold about you is accurate and up to date. During the course of our relationship with you we will ask you to inform us if any of your Information has changed.

If you wish to make changes to the Information we hold about you, or if you think any of it is incorrect, you should contact us to have it updated. We will generally rely on you to assist us by telling us if the Information we hold is inaccurate or incomplete.

ACCESS TO YOUR INFORMATION

*(This section applies only to 'personal information' about individuals.)*

We will provide you with access to the personal information we hold about you, subject to limited exceptions in the Privacy Act as outlined below. You may request access to any of the personal information we hold about you at any time.

To access personal information that we hold about you, use the contact details specified below. We may charge a fee for our reasonable costs in retrieving and supplying the information to you.

DENIED ACCESS TO PERSONAL INFORMATION

*(This section applies only to 'personal information' about individuals.)*

There may be situations where we are not required to provide you with access to your personal information. For example, information relating to an existing or anticipated legal proceeding with you, or where your request is vexatious.

An explanation will be provided to you if we deny you access to personal information we hold.

BUSINESS WITHOUT IDENTIFYING YOU

In most circumstances it will be necessary for us to identify you in order to do business with you. However, where it is lawful and practicable to do so, we will offer you the opportunity of dealing with us without providing Information. Such a situation would be where you browse the platform without an account, or make a general enquiry.

HOW SAFE AND SECURE IS YOUR INFORMATION THAT WE HOLD?

We will take reasonable steps to protect your Information by storing it in a secure environment, and when the Information is no longer needed for any purpose for which it may be used or disclosed, it will be destroyed or permanently de-identified.

We will also take reasonable steps to protect any Information we hold about you from misuse, loss and unauthorised access, modification or disclosure.

Your wallet is your responsibility. Culture Vault will never ask you for your private keys, your seed phrase or your password. If you lose your private keys, the works held in that wallet cannot be recovered by us or by anyone else.

DATA BREACH NOTIFICATION

Culture Vault is subject to the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

If we become aware of a data breach that is likely to result in serious harm to an individual whose personal information is involved, and we are unable to prevent that harm through remedial action, we will notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable.

FURTHER INFORMATION AND COMPLAINTS

You may request further information about the way we manage your personal information, or lodge a complaint, by contacting our Privacy Officer on the contact details below.

We will deal with a complaint by investigating it and providing a response within 15 business days, provided we have all necessary information and have completed any investigation required. Where further information, assessment or investigation is required, we will seek to agree alternative time frames with you.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

CONTACT DETAILS

You can contact our Privacy Officer by emailing info@culturevault.com.

ALTERNATIVE FORMS OF OUR PRIVACY POLICY

If you would prefer to receive a copy of our Privacy Policy in an alternative form, such as hard copy or email, please contact us on the details provided under "Contact details" above. We will be pleased to comply with your request.

CHANGE IN OUR PRIVACY POLICY

We are constantly reviewing our policies and attempt to keep up to date with market expectations. Technology is constantly changing, as is the law and marketplace practice.

As a consequence we may change this Privacy Policy from time to time or as the need arises. Where a change materially affects how we handle your personal information, we will tell you.

This Privacy Policy was last updated in September 2026.