STUDIO2U

SECURITY & ACCEPTABLE USE POLICY

Version: 1.0 Effective Date: September 3, 2026

This Security & Acceptable Use Policy ("Policy") supplements the Studio2U Terms of Service and describes the security expectations, prohibited technical conduct, and platform-integrity rules that apply to everyone who accesses Studio2U ("Studio2U," "Company," "we," "us," or "our"), including clients, artists, engineers, producers, and other independent service providers (collectively, "users," "you").

This Policy does not replace the Terms of Service. Where this Policy and the Terms of Service conflict, the Terms of Service control unless this Policy is more specific to security or acceptable-use matters.

1. PURPOSE

Studio2U operates a technology platform connecting artists, clients, engineers, producers, and other independent service providers. Because the platform handles accounts, bookings, payments, messages, and uploaded media, we require every user to follow baseline security and conduct practices that protect the platform, its users, and the broader public.

2. ACCOUNT SECURITY OBLIGATIONS

You are responsible for:

1. Maintaining the confidentiality of your account credentials;
2. Using a unique, reasonably strong password for your Studio2U account;
3. Not sharing your login credentials with any other person;
4. Notifying Studio2U promptly if you suspect unauthorized access to your account;
5. Logging out of shared or public devices after use;
6. Keeping your contact information current so security notices reach you.

Studio2U is not responsible for losses resulting from a compromised account caused by your failure to safeguard your credentials.

3. PROHIBITED TECHNICAL CONDUCT

You may not, and may not attempt to, or assist another person to:

1. Access, tamper with, or use non-public areas of the platform without authorization;
2. Probe, scan, or test the vulnerability of the platform or any related system or network without Studio2U's prior written authorization;
3. Breach or circumvent any security or authentication measure;
4. Access another user's account, data, or content without authorization;
5. Introduce viruses, malware, worms, Trojan horses, or other harmful code;
6. Interfere with or disrupt the integrity, performance, or availability of the platform, including through denial-of-service attacks, excessive automated requests, or resource exhaustion;
7. Use bots, scrapers, crawlers, or other automated means to access, extract, or index platform data without authorization;
8. Reverse engineer, decompile, or disassemble any portion of the platform except where expressly permitted by applicable law;
9. Circumvent rate limits, CAPTCHAs, bot-detection, or other technical access controls;
10. Forge headers, spoof identities, or misrepresent the origin of any communication sent to or through the platform;
11. Upload content designed to exploit a vulnerability in the platform or another user's device;
12. Use the platform to stage, host, or distribute malicious code targeting third parties;
13. Attempt to gain unauthorized access to Studio2U's internal systems, infrastructure, source code, or proprietary technology; or
14. Engage in any conduct that a reasonable person would understand to compromise the confidentiality, integrity, or availability of the platform.

4. ACCEPTABLE USE — GENERAL CONDUCT

In addition to the technical restrictions above, and consistent with the Terms of Service, you may not use Studio2U to:

1. Violate any applicable law or regulation;
2. Harass, threaten, stalk, defraud, or abuse another person;
3. Upload content that infringes another person's intellectual-property, privacy, or publicity rights;
4. Facilitate unlawful or unauthorized recording of another person;
5. Impersonate another individual or entity;
6. Post or transmit content that is unlawful, defamatory, obscene, or that promotes violence or discrimination; or
7. Use the platform for any purpose other than its intended marketplace function of connecting artists, clients, and service providers.

5. RESPONSIBLE VULNERABILITY DISCLOSURE

Studio2U welcomes good-faith security research conducted responsibly.

1. If you discover a potential security vulnerability, please report it to us before taking any further action, disclosing it publicly, or attempting to exploit it further.
2. Do not access, modify, delete, or exfiltrate data belonging to other users while investigating a vulnerability.
3. Do not use a vulnerability to disrupt platform availability or degrade service for other users.
4. Studio2U will not pursue legal action against a researcher who makes a good-faith report in compliance with this section and does not otherwise violate this Policy or applicable law.

Security researchers must obtain Studio2U's prior written authorization before conducting active penetration testing against Studio2U's production systems.

6. REPORTING SECURITY OR SAFETY CONCERNS

If you believe your account has been compromised, discover a security vulnerability, or observe conduct that may violate this Policy, contact Studio2U promptly through the platform's support channel or the contact information published on the site.

Studio2U will investigate credible reports and may take action including, without limitation, requiring a password reset, suspending or terminating an account, removing content, or notifying affected users, law enforcement, or regulators where appropriate.

7. MONITORING AND ENFORCEMENT

Studio2U may, but is not obligated to, monitor platform activity for compliance with this Policy. Studio2U may investigate suspected violations and take any action it deems appropriate, including:

1. Removing or disabling access to content;
2. Issuing a warning;
3. Suspending or terminating an account;
4. Reporting conduct to law enforcement or other authorities; and
5. Pursuing civil remedies where warranted.

Studio2U's decision not to act on a particular occasion does not waive its right to act on a future occasion.

8. THIRD-PARTY SYSTEMS

Portions of the platform rely on third-party infrastructure and service providers (including hosting, payment processing, and storage providers). Studio2U requires those providers to maintain reasonable security practices but does not control, and is not responsible for, vulnerabilities or incidents originating solely within a third-party provider's own systems.

9. NO GUARANTEE OF ABSOLUTE SECURITY

No platform can guarantee complete security. Studio2U implements reasonable administrative, technical, and organizational safeguards, but cannot and does not warrant that the platform will be free from unauthorized access, error, or interruption. See the Terms of Service and Privacy Policy for related disclaimers.

10. RELATIONSHIP TO OTHER POLICIES

This Policy works together with, and does not limit, Studio2U's Terms of Service, Privacy Policy, and Recording Consent, Authorization & User Responsibility Agreement. A violation of this Policy may also constitute a violation of the Terms of Service and may result in the consequences described there, including account suspension or termination.

11. CHANGES TO THIS POLICY

Studio2U may update this Policy from time to time to reflect new risks, technologies, or operational needs. Material changes may be communicated through reasonable means. Continued use of the platform after an updated version becomes effective constitutes acceptance to the extent permitted by law.

12. CONTACT

Questions about this Policy, or reports of a suspected security issue, may be directed to:

Company Legal Name: Studio2U LLC Business Address: Wilmington, Delaware, United States Security Contact: security@studio2u.com

IMPORTANT: This Policy is a strong operational/business draft describing the security and acceptable-use expectations Studio2U intends to enforce, but it has not been reviewed by counsel. A Delaware-licensed attorney should review this Policy — particularly the vulnerability-disclosure safe-harbor language and its interaction with the Terms of Service's dispute-resolution and indemnification provisions — before it is relied upon in an enforcement action or public bug-bounty program. The business address above reflects the Company's state of formation and headquarters city only; a specific street address/suite and zip code should be added once available.