Australia Privacy Addendum

This Australia Privacy Addendum supplements the Fraw Privacy Policy and applies to users located in Australia. This Addendum explains additional information about how Untitled Labs Limited (“Fraw,” “we,” “us,” or “our”) collects, uses, discloses, stores, transfers, retains, protects, and handles personal information in connection with the Fraw mobile application, website, software, official functions, extensions, creator tools, and related services.

This Addendum should be read together with the Fraw Privacy Policy. If there is any conflict between this Addendum and the Fraw Privacy Policy, this Addendum will apply to users located in Australia to the extent required by applicable Australian privacy laws.

1. Personal Information Covered by This Addendum

The personal information we may collect and handle is described in the Fraw Privacy Policy. This may include:

• account information, such as your name, username, display name, profile information, email address, phone number where applicable, login credentials, authentication information, and account identifiers;
• third-party login information received from supported authentication providers, such as Apple ID or Google login;
• device, technical, diagnostic, usage, and activity information, such as device type, operating system, app version, IP address, approximate location derived from IP, app identifiers, crash logs, usage events, timestamps, and transaction activity;
• transaction, subscription, top-up, purchase, refund, chargeback, and billing-related information;
• prompts, uploaded images, generated images, image transformations, extension configurations, creator publication data, moderation records, and other user content;
• Face-Containing Images, meaning photographs, images, or visual content containing a human face that you voluntarily upload, capture, select, or otherwise submit to the Service, together with related non-identifying image-processing information as described in the Fraw Privacy Policy;
• extension-related information, including extension names, descriptions, prompts, configurations, reference images, thumbnails, before-and-after images, generated examples, publication status, archive status, and usage records;
• creator-program and withdrawal-related information, such as creator account status, withdrawal eligibility, withdrawal requests, payout status, payout amount, transaction reference, payout provider identifier, fraud-prevention signals, and related creator-program communications;
• referral, rewards, fraud-prevention, support, complaint, moderation, security, legal, and compliance records.

2. Why We Collect, Use, and Disclose Personal Information

We collect, use, and disclose personal information for the purposes described in the Fraw Privacy Policy, including to:

• create, authenticate, secure, and manage accounts;
• provide subscriptions, credits, top-ups, official functions, Rebuild / Blend, extensions, creator tools, and generated outputs;
• process user-requested image transformations and transmit uploaded images to third-party AI image-generation or image-processing providers where necessary to generate the requested output;
• operate, store, display, archive, moderate, and manage private and published extensions;
• process purchases, subscriptions, refunds, chargebacks, billing records, and related transaction information;
• administer creator rewards, Diamonds, withdrawal requests, payout-status records, fraud-prevention records, and creator-program records;
• operate referral, reward, and promotional programs;
• provide customer support and respond to inquiries, complaints, or requests;
• analyze performance, debug issues, maintain reliability, improve safety controls, and protect the Service;
• detect, investigate, prevent, and respond to fraud, abuse, spam, prohibited content, policy violations, security incidents, and misuse of the Service;
• comply with applicable laws, legal process, regulatory obligations, tax, accounting, audit, and recordkeeping requirements;
• enforce our Terms, policies, creator rules, and other agreements;
• protect the rights, safety, property, and security of Fraw, our users, and others.

3. Face-Containing Images and Sensitive Information

Some Fraw features allow you to upload, capture, edit, transform, rebuild, blend, or otherwise process images that may contain a human face. We refer to these as “Face-Containing Images” in the Fraw Privacy Policy.

Fraw does not use Face-Containing Images for biometric identification, facial recognition, identity verification, identity matching, account authentication, or creation of biometric templates, faceprints, face-geometry scans, or other biometric identifiers.

However, face-containing images may be treated as sensitive information under some laws. Where required by applicable law, we rely on your consent and process such information only to provide the image-processing feature you request and for related safety, security, abuse-prevention, service-reliability, legal-compliance, dispute-resolution, and enforcement purposes.

By choosing to upload, capture, select, or submit an image that contains a human face for image generation or transformation, you direct Fraw to process that image for the requested feature and related purposes described in the Fraw Privacy Policy and this Addendum.

4. Third-Party AI Providers and Service Providers

To generate requested outputs and operate the Service, we may disclose or make available personal information to service providers that perform services for us. These may include:

• cloud hosting and storage providers;
• AI image-generation or image-processing providers;
• analytics, crash-reporting, and diagnostic providers;
• app stores, payment platforms, and payment processors;
• payout providers where creator withdrawal or payout features are available;
• customer support and communications providers;
• security, fraud-prevention, abuse-prevention, and moderation providers;
• infrastructure, database, monitoring, and operational service providers;
• professional advisers, auditors, legal advisers, or compliance service providers where necessary.

When you initiate an image transformation, your uploaded image, which may contain a human face, may be transmitted to one or more third-party AI image-generation or image-processing providers where necessary to generate the requested output, perform related safety or abuse-prevention checks, maintain service reliability, or support the requested feature.

We do not authorize third-party AI providers to use Face-Containing Images for unrelated advertising, resale, independent profiling, facial recognition, biometric identification, unrelated model training, or any purpose not described in the Fraw Privacy Policy.

Where supported by the applicable provider terms or service configuration, we require or configure providers to delete or de-identify input images and related Face-Containing Images after processing or after any limited technical, safety, security, abuse-prevention, service-reliability, or legal retention period.

5. Overseas Disclosure and International Processing

Fraw is operated by Untitled Labs Limited, a company based in Hong Kong. We use service providers, infrastructure, and technical systems that may be located outside Australia. As a result, personal information of users located in Australia may be processed, stored, accessed, disclosed, or transferred outside Australia.

The countries or regions where personal information may be processed, stored, accessed, disclosed, or transferred may include Hong Kong, the United States, Japan, Singapore, Canada, the United Kingdom, member states of the European Economic Area, and other countries or regions where our service providers or their infrastructure operate.

The categories of personal information that may be disclosed overseas include:

• account information;
• device, technical, diagnostic, usage, and activity information;
• transaction, subscription, top-up, purchase, refund, chargeback, and billing-related information;
• support, complaint, moderation, security, and fraud-prevention records;
• user content, uploaded images, generated content, prompts, and extension assets;
• Face-Containing Images where processed as part of a requested image-generation or image-processing feature;
• creator-program, withdrawal, payout-status, transaction-reference, fraud-prevention, accounting, audit, and compliance records.

We may disclose personal information overseas to:

• cloud hosting and storage providers;
• AI image-generation or image-processing providers;
• analytics, crash-reporting, and diagnostic providers;
• app stores, payment platforms, and payment processors;
• payout providers;
• customer support and communications providers;
• security, fraud-prevention, abuse-prevention, and moderation providers;
• infrastructure, database, monitoring, and operational service providers;
• professional advisers, auditors, legal advisers, or compliance service providers where necessary.

We take reasonable steps designed to protect personal information disclosed overseas. These steps may include contractual safeguards, provider due diligence, access controls, encryption in transit, encryption at rest where supported by the applicable storage system, technical and organizational security measures, service-provider review, and other reasonable safeguards.

You acknowledge that overseas recipients may be subject to foreign laws, and that those laws may not provide the same level of protection as Australian privacy laws.

6. Creator Payout and Withdrawal Records

For the global version of the Service, Fraw does not directly collect government identification documents, tax identification numbers, tax forms, or other formal identity-verification or tax records from users as part of the standard account signup, login, creator participation, or withdrawal flow.

Creator payouts may be processed through third-party payout providers, such as PayPal, where available. When you use a third-party payout provider, you may be required to provide payout account information, identity information, tax information, or other compliance-related information directly to that provider. That provider’s collection, use, retention, disclosure, and protection of such information are governed by its own terms, privacy policy, and legal obligations.

Fraw may receive or retain limited information from or about the payout process, such as your Fraw account identifier, creator account status, withdrawal eligibility, withdrawal requests, payout status, payout amount, transaction reference, payout provider identifier, fraud-prevention signals, and related creator-program records.

7. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in the Fraw Privacy Policy and this Addendum, unless a longer retention period is required or permitted by applicable law.

Retention periods may vary depending on the type of information, the purpose of processing, account status, user choices, legal requirements, security needs, fraud-prevention needs, creator-program administration, dispute-resolution needs, payout processing, tax, accounting, audit, backup-retention practices, and operational requirements.

In particular:

• temporary processing images that are not saved to your account gallery, associated with a saved extension, or otherwise retained as part of an account feature are deleted from active systems within the period described in the Fraw Privacy Policy, unless a longer period is necessary for security, abuse prevention, legal compliance, dispute resolution, technical troubleshooting, enforcement of our Terms, or protection of legal rights;
• saved gallery images and generated content are retained while your account is active, or until you delete them through available in-app controls, subject to applicable exceptions;
• original input images are retained only where saved to your account, gallery, extension, project, history, or other account feature at your request or as part of a feature you use;
• saved private extensions, published extensions, archived extensions, archived public extension assets, unpublished public extension assets, and related extension records may be retained as described in the Fraw Privacy Policy;
• archiving an extension does not delete the extension or its associated assets;
• creator-program, withdrawal, payout-status, transaction, fraud-prevention, accounting, audit, and compliance records may be retained for the period required or permitted for creator-program administration, withdrawal processing, payout tracking, fraud prevention, accounting, audit, legal compliance, and dispute resolution;
• deleted information may remain in encrypted backups for a limited period until those backups are overwritten or deleted according to our backup retention schedule.

When the purpose of collection or processing has been fulfilled, the applicable retention period has expired, or deletion is required by applicable law, we will delete, de-identify, anonymize, or otherwise securely dispose of personal information, unless retention is required or permitted for legal, tax, accounting, audit, security, fraud-prevention, dispute-resolution, enforcement, creator-program, payout, backup, or other legitimate purposes described in the Fraw Privacy Policy or this Addendum.

8. Access, Correction, and Deletion Requests

Subject to applicable law, users located in Australia may request access to personal information we hold about them and may request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading personal information.

You may also request deletion of certain personal information where available under the Fraw Privacy Policy, applicable law, or available in-app controls.

You may manage certain information directly through account settings or available in-app controls. Account deletion is available in the app. You may delete individual saved images, generated content, and gallery items through available in-app controls. For saved extensions in your extension library or similar account area, individual deletion may not be available; saved extensions may instead be archived through available in-app controls.

You may also request account deletion or data deletion by contacting us at hi@fraw.ai.

To make an access, correction, deletion, or privacy request, contact us using the details in the Privacy Contact section below. We may need to verify your identity before responding to your request.

We will respond to requests within a reasonable period after receiving the request. We may decline, limit, or delay a request where permitted by applicable law, including where we cannot verify your identity, where fulfilling the request would conflict with legal obligations, security requirements, fraud-prevention needs, creator-program administration, payment or payout processing requirements, dispute-resolution needs, or the rights and freedoms of others.

9. Privacy Complaints

If you have a concern or complaint about how we handle your personal information, please contact us using the details in the Privacy Contact section below.

Please include enough information for us to understand and investigate your complaint. We may need to verify your identity or request additional information.

We will review and respond to privacy complaints within a reasonable period. If you are not satisfied with our response, or if you believe your privacy rights have been violated, you may contact the Office of the Australian Information Commissioner or another competent authority.

10. Security Measures

We use reasonable technical, administrative, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, interference, alteration, or disclosure.

These measures may include:

• encryption in transit using TLS;
• encryption at rest where supported by the applicable storage system;
• access controls and permission management;
• internal access limitations based on need to know;
• logging and monitoring of systems where appropriate;
• technical safeguards designed to protect against unauthorized access, alteration, loss, interference, misuse, or disclosure;
• service-provider review and management;
• procedures for responding to security incidents;
• confidentiality obligations for personnel and contractors where applicable.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Direct Marketing

We may send marketing or promotional communications where permitted by law. You may opt out of marketing communications by using the unsubscribe link in the message or by contacting us.

Even if you opt out of marketing communications, we may still send service-related, account-related, billing, security, transactional, and legal communications.

12. Children’s Personal Information

The Service is not intended for children below the age permitted under applicable law to use the Service without parental consent. We do not knowingly collect personal information from children in violation of applicable law.

If you believe a child has provided us with personal information unlawfully, please contact us so we can investigate and take appropriate action.

13. Privacy Contact

If you have questions, concerns, complaints, or requests regarding this Australia Privacy Addendum or our handling of personal information, you may contact us using the details below:

• Untitled Labs Limited
• Address: 20/F, Harbourside HQ, 8 Lam Chak Street, Kowloon Bay, Kowloon
• Support Email: hi@fraw.ai
• Company Registration: 71095371

Depending on the nature of your request, we may need to verify your identity before responding or taking action.

14. Changes to This Australia Privacy Addendum

We may update this Australia Privacy Addendum from time to time.

If we make material changes, we may provide notice through the Service, by email, on our website, or by other reasonable means, as required by applicable law.

Your continued use of the Service after the updated Australia Privacy Addendum becomes effective means you acknowledge the revised Addendum.