Bangladesh Privacy Addendum

This Bangladesh Privacy Addendum (the “Bangladesh Addendum”) supplements the Fraw Privacy Policy and applies to individuals located in Bangladesh who access or use the Fraw mobile application, website, software, official functions, extensions, creator tools, and related services collectively referred to as the “Service.”

The Service is operated by Untitled Labs Limited (“Fraw,” “we,” “us,” or “our”), a company incorporated in Hong Kong.

This Bangladesh Addendum should be read together with the Privacy Policy, the Fraw Terms & Conditions, the Creator & Diamonds Policy, and any other notices presented through the Service.

Capitalized terms not defined in this Bangladesh Addendum have the meanings given in the Privacy Policy or Terms & Conditions.

If this Bangladesh Addendum conflicts with the Privacy Policy, this Bangladesh Addendum will apply to individuals in Bangladesh to the extent required by applicable Bangladesh law.

Nothing in this Bangladesh Addendum limits any right or protection that cannot lawfully be limited, excluded, or waived.

1. Scope and Applicable Bangladesh Law

This Bangladesh Addendum provides additional information concerning Fraw’s collection, use, disclosure, storage, transfer, retention, deletion, security, and other processing of personal data in connection with offering the Service to individuals in Bangladesh.

Where applicable, Fraw’s processing of personal data may be subject to:

• the Personal Data Protection Act, 2026;
• the Cyber Security Act, 2026;
• the National Data Management Act, 2026;
• laws concerning electronic transactions, telecommunications, digital commerce, consumer protection, intellectual property, child protection, cybersecurity, taxation, payment services, and criminal conduct;
• regulations, rules, orders, directions, standards, and codes issued under applicable laws; and
• other applicable Bangladesh laws and regulatory requirements, as amended, replaced, or supplemented from time to time.

The application of a particular law, registration, approval, localization requirement, transfer requirement, representative requirement, or regulatory obligation may depend on:

• the nature of the Service;
• the categories of personal data involved;
• the location of processing;
• the location of users;
• the purposes and effects of processing;
• Fraw’s establishment and operations;
• the activities of service providers;
• regulatory interpretation; and
• the provisions in force at the relevant time.

For purposes of applicable Bangladesh personal-data law:

• Fraw may act as a Data Fiduciary, Data Controller, Data Custodian, or equivalent responsible party where it determines the purposes and means of processing personal data;
• you may be referred to as a Data Subject, Data Holder, or equivalent person to whom personal data relates; and
• service providers processing personal data for Fraw may act as Data Processors or in an equivalent service-provider capacity.

The terminology used in this Bangladesh Addendum is intended to reflect applicable legal concepts without limiting the meaning assigned to those concepts under Bangladesh law.

2. Application Outside Bangladesh

Fraw is established outside Bangladesh.

Applicable Bangladesh personal-data law may apply to processing carried out outside Bangladesh where the processing:

• relates to an individual located in Bangladesh;
• concerns goods or services made available to individuals in Bangladesh;
• monitors, analyzes, profiles, or affects activity occurring in Bangladesh;
• produces effects within Bangladesh;
• involves personal data collected from Bangladesh; or
• otherwise falls within the territorial or extraterritorial scope of applicable law.

Nothing in this Bangladesh Addendum means that Fraw:

• is incorporated in Bangladesh;
• has a permanent establishment in Bangladesh;
• maintains an office in Bangladesh;
• has appointed a local representative for every legal purpose;
• stores all Bangladesh user data in Bangladesh; or
• has completed every registration, approval, filing, or appointment that may become applicable.

Where Fraw determines that a registration, representative, responsible officer, local contact, filing, approval, or other regulatory step is required, Fraw may take the steps it considers necessary to comply.

Fraw may restrict, delay, suspend, or discontinue the Service or particular functions in Bangladesh while assessing or implementing a legal or regulatory requirement.

3. Personal Data We Process

We may process the categories of personal data described in the Privacy Policy, including the categories below.

3.1 Account and Profile Information

This may include:

• name;
• username;
• display name;
• creator name;
• profile information;
• email address;
• phone number where supported;
• account identifier;
• authentication information;
• Apple or Google login information;
• subscription tier;
• account preferences;
• account status;
• age or eligibility information where required; and
• other information connected with your account.

3.2 Device and Technical Information

This may include:

• device type;
• operating system;
• application version;
• browser type;
• language setting;
• time zone;
• IP address;
• approximate location derived from IP address;
• device, app-installation, or app-instance identifiers;
• network information;
• session information;
• timestamps;
• crash logs;
• performance data;
• diagnostic information;
• error reports;
• security logs; and
• fraud-prevention signals.

3.3 Usage and Activity Information

This may include information about:

• screens or pages viewed;
• functions used;
• buttons selected;
• generation requests;
• session duration;
• subscription activity;
• credit use;
• top-up activity;
• official-function use;
• extension creation and use;
• publication activity;
• creator activity;
• Diamond activity;
• referral activity;
• reports and complaints;
• moderation activity;
• account deletion activity; and
• other interactions with the Service.

3.4 Transaction and Subscription Information

This may include:

• subscription status;
• plan type;
• purchase date;
• top-up purchase;
• renewal status;
• cancellation status;
• transaction identifier;
• payment-provider identifier;
• refund status;
• chargeback status;
• currency;
• entitlement information;
• limited billing information received from an app store or payment provider; and
• records required for accounting, fraud prevention, dispute handling, or legal compliance.

Where a transaction is processed by Apple, Google, or another payment provider, Fraw generally does not directly receive complete payment-card information.

3.5 User Content and Generated Content

This may include:

• prompts;
• text;
• instructions;
• images;
• photographs;
• files;
• reference materials;
• original input images;
• generated images;
• transformed images;
• generated Output;
• gallery content;
• extension assets;
• extension titles and descriptions;
• thumbnails;
• before-and-after images;
• generated examples;
• configurations;
• publication data;
• moderation information; and
• other content submitted to or generated through the Service.

3.6 Creator and Reward Information

This may include:

• creator eligibility;
• creator profile information;
• extension-publication status;
• extension activity;
• Diamond records;
• qualifying and non-qualifying usage;
• withdrawal requests;
• payout status;
• payout amount;
• payout-provider identifier;
• transaction reference;
• verification status;
• fraud-prevention signals;
• tax or compliance status received from a provider where applicable; and
• communications relating to creator or payout functions.

3.7 Support, Complaint, and Enforcement Information

This may include:

• customer-support requests;
• privacy requests;
• content complaints;
• intellectual-property complaints;
• image-rights complaints;
• child-safety reports;
• security reports;
• user reports;
• grievance records;
• investigation information;
• enforcement actions;
• correspondence;
• evidence provided by users; and
• records concerning legal or regulatory requests.

3.8 Face-Containing Images

We may process Face-Containing Images and related non-identifying image-processing information as described in Section 3 of the Privacy Policy.

Fraw does not create or store:

• biometric templates;
• faceprints;
• face-geometry scans;
• facial-recognition profiles; or
• biometric identifiers

from Face-Containing Images.

Fraw does not use Face-Containing Images to:

• identify you as a real-world person;
• verify your identity;
• authenticate your account;
• perform facial recognition;
• match your identity against another database;
• determine sensitive personal characteristics; or
• create a biometric identification profile.

An ordinary photograph containing a face is not necessarily processed by Fraw as biometric data.

Where an image, its contents, or the way it is processed qualifies as sensitive, restricted, biometric, or otherwise specially protected personal data under applicable Bangladesh law, Fraw will process it subject to applicable legal requirements.

4. Sources of Personal Data

We may collect personal data:

• directly from you;
• automatically when you access or use the Service;
• from Apple, Google, or another authentication provider;
• from Apple App Store, Google Play, or another app store;
• from payment processors;
• from payout providers;
• from cloud-hosting and storage providers;
• from AI image-generation and image-processing providers;
• from analytics, diagnostics, and performance providers;
• from security, fraud-prevention, and moderation providers;
• from customer-support and communication providers;
• from another user who submits content, a complaint, or a report concerning you;
• from public authorities;
• from professional advisers; and
• from other sources described in the Privacy Policy or disclosed to you.

If you provide personal data relating to another person, including an image containing another person’s face, you are responsible for ensuring that you have the consent, permission, authority, release, or other lawful basis required to:

• provide that information to Fraw;
• request the relevant AI or image processing;
• store the information;
• include it in an extension;
• publish it where applicable; and
• allow other users to process it through an extension where applicable.

5. Purposes of Processing

We may process personal data for the purposes described in the Privacy Policy and this Bangladesh Addendum.

5.1 Providing and Operating the Service

We may process personal data to:

• create and manage accounts;
• authenticate users;
• secure accounts;
• provide subscriptions;
• manage credits and top-ups;
• process generation requests;
• return generated Output;
• save gallery content;
• provide Rebuild, Blend, and official functions;
• enable private extensions;
• enable Published Extensions where available;
• operate creator and Diamond functionality;
• provide account and transaction history;
• provide customer support; and
• maintain the availability and functionality of the Service.

5.2 AI and Image Processing

We may process personal data to:

• receive prompts, images, files, and instructions;
• transmit submitted content to relevant AI service providers;
• generate or transform content;
• return the requested Output;
• maintain technical reliability;
• troubleshoot failed generation;
• perform safety and moderation checks;
• prevent fraud and abuse;
• enforce applicable policies; and
• comply with legal requirements.

5.3 Transactions and Billing

We may process personal data to:

• verify subscriptions and purchases;
• provide purchased entitlements;
• process renewals;
• administer cancellations;
• investigate transaction problems;
• process or track refunds;
• respond to chargebacks;
• maintain accounting records;
• prevent payment fraud; and
• comply with consumer, tax, accounting, or payment requirements.

5.4 Creator and Reward Administration

We may process personal data to:

• assess creator eligibility;
• administer extension publication;
• review creator content;
• calculate Diamonds;
• identify eligible or ineligible activity;
• detect self-dealing and manipulation;
• process withdrawal requests;
• track payout status;
• maintain creator and accounting records;
• handle creator disputes; and
• comply with tax, payment, regulatory, and legal requirements.

5.5 Safety, Security, and Fraud Prevention

We may process personal data to:

• protect accounts and systems;
• detect unauthorized access;
• investigate suspicious behavior;
• detect fraud, spam, bots, abuse, or manipulation;
• moderate prohibited content;
• protect children;
• enforce country restrictions;
• prevent misuse of credits, rewards, or referrals;
• investigate related accounts or devices;
• maintain system logs;
• respond to security incidents; and
• protect Fraw, users, service providers, and third parties.

5.6 Service Improvement

We may process personal data to:

• monitor service reliability;
• diagnose errors;
• measure performance;
• understand feature use;
• improve user experience;
• develop and test functions;
• improve safety and moderation;
• improve fraud-prevention systems; and
• maintain service quality.

Where appropriate, we may use aggregated, anonymized, de-identified, or non-face operational information for these purposes.

Fraw does not use Face-Containing Images to train general-purpose artificial-intelligence or machine-learning models, including general-purpose image-generation, facial-recognition, identity-matching, or biometric-identification models, unless Fraw obtains separate consent or another lawful authorization where required by applicable law.

5.7 Communications

We may process personal data to:

• send account notices;
• send transaction confirmations;
• provide subscription or billing information;
• respond to support requests;
• send security alerts;
• provide policy notices;
• communicate regional restrictions;
• respond to complaints;
• provide creator or payout information; and
• send marketing communications where permitted.

5.8 Legal and Regulatory Compliance

We may process personal data to:

• comply with Bangladesh or other applicable laws;
• complete or maintain regulatory registrations;
• respond to court orders;
• respond to lawful governmental requests;
• respond to regulators or law-enforcement bodies;
• comply with cybersecurity obligations;
• process content-removal requests;
• preserve information;
• establish, exercise, or defend legal claims;
• maintain accounting, tax, and audit records; and
• protect legal rights and public safety.

6. Legal Grounds for Processing

Where applicable law requires a legal basis, we may process personal data based on one or more of the following:

• your consent;
• performance of an agreement with you;
• steps taken at your request before entering into an agreement;
• provision of a product, service, or function requested by you;
• compliance with a legal obligation;
• protection of your vital interests or those of another person;
• protection of public safety, cybersecurity, or system integrity;
• prevention, detection, investigation, or enforcement relating to fraud, abuse, security incidents, or unlawful conduct;
• Fraw’s legitimate, permitted, or lawful interests or those of another party, where recognized by law and appropriately balanced against your rights;
• processing of information voluntarily provided by you for a specified purpose;
• establishment, exercise, or defense of legal claims;
• compliance with a lawful request from a competent authority; and
• another lawful ground permitted under applicable Bangladesh law.

Fraw does not necessarily rely on every listed ground for every processing activity.

Where processing is necessary to create or operate your account, complete a transaction, perform a generation you request, maintain security, prevent fraud, comply with law, or enforce the Service, Fraw may rely on a lawful ground other than consent where permitted by applicable law.

7. Notice and Consent

Where Fraw relies on consent, Fraw may request consent through:

• an in-app notice;
• an account screen;
• a website notice;
• a setting;
• a checkbox;
• a button;
• an upload or submission action;
• a cookie or analytics preference tool; or
• another appropriate affirmative action.

A consent request may identify:

• the personal data or categories of personal data involved;
• the purposes of processing;
• the consequences of giving or refusing consent;
• how consent may be withdrawn;
• how to contact Fraw; and
• other information required by applicable law.

Consent to one purpose does not automatically constitute consent to a materially different purpose.

Silence, inactivity, or continued use will not replace express consent where express consent is legally required.

7.1 User-Initiated AI Processing

By voluntarily submitting a prompt, image, file, instruction, or other content and initiating an AI-generation, transformation, Rebuild, Blend, or extension-based request, you instruct Fraw to:

• receive and process that content;
• transmit the content to Fraw’s systems;
• transmit the content to relevant service providers;
• perform the requested generation or transformation;
• conduct related technical, safety, security, moderation, debugging, fraud-prevention, or reliability checks; and
• return the requested Output.

This instruction does not authorize Fraw or its providers to use your Face-Containing Images for:

• unrelated advertising;
• resale;
• independent profiling;
• facial recognition;
• biometric identification;
• identity matching; or
• unrelated model training.

8. Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent using an available:

• account control;
• privacy setting;
• cookie preference control;
• device setting;
• unsubscribe link;
• website control;
• in-app control; or
• support channel.

You may also email hi@fraw.ai with the subject line “Bangladesh Privacy Request.”

Withdrawal of consent:

• does not affect processing lawfully carried out before withdrawal;
• does not require deletion where retention is required or permitted by law;
• does not affect processing based on another lawful ground;
• may prevent Fraw from continuing to provide a feature; and
• may result in restriction or termination of a function where the relevant personal data is necessary to provide it.

Where required by applicable law, Fraw will take reasonable steps to make withdrawal of consent reasonably accessible.

9. Sensitive or Specially Protected Personal Data

Certain personal data may be considered sensitive, restricted, special-category, or otherwise specially protected under applicable law.

Depending on the information and circumstances, this may include information concerning:

• health;
• disability;
• genetics;
• biometrics;
• children;
• financial accounts;
• government identifiers;
• ethnicity;
• religion;
• political views;
• sexual life or orientation;
• criminal allegations or records;
• precise location;
• authentication credentials; or
• other legally protected matters.

Fraw does not request that you include sensitive personal data in prompts, images, support messages, profiles, or extensions unless that information is reasonably necessary for an available function and Fraw has provided an appropriate method for submitting it.

You should not submit:

• government identity documents;
• complete payment-card information;
• medical records;
• tax records;
• passwords;
• financial-account credentials; or
• other highly sensitive information

unless Fraw specifically requests it through an approved secure process.

Where Fraw processes sensitive or specially protected personal data, Fraw may apply additional consent, access, retention, security, transfer, review, or deletion safeguards where required by applicable law.

10. Face-Containing Images and AI Processing

The Service may allow you to upload, capture, edit, transform, rebuild, blend, save, publish, or otherwise process images containing human faces.

The collection, purposes, sharing, storage, security, retention, and deletion of Face-Containing Images are described in Section 3 of the Privacy Policy.

When you initiate an image-generation or transformation request:

• Fraw may transmit the submitted image and related prompt or instruction to one or more AI image-generation or image-processing providers;
• processing may occur outside Bangladesh;
• providers may process the information to provide the requested Output;
• providers may process limited information for technical, safety, security, debugging, abuse-prevention, reliability, or legal purposes permitted under their applicable terms and service configuration;
• provider retention may vary according to provider terms and technical settings;
• Fraw does not authorize providers to use the information for unrelated advertising, resale, facial recognition, biometric identification, identity matching, independent profiling, or unrelated model training; and
• Fraw may use more than one provider or route requests between providers for reliability, availability, quality, safety, or operational reasons.

You must not submit an image or personal data relating to another person unless you have the rights, permissions, consent, authority, release, or other lawful basis necessary to do so.

11. Personal Data Relating to Other People

If you submit, save, or publish personal data relating to another person, you represent that you are authorized to provide the data and request the relevant processing.

This may include:

• a photograph;
• a group photograph;
• a reference image;
• a likeness;
• a name;
• a creator asset;
• an extension example;
• a before-and-after image; or
• other information relating to another person.

You must not submit or publish personal data in violation of:

• privacy rights;
• publicity or personality rights;
• confidentiality obligations;
• intellectual-property rights;
• child-protection law;
• personal-data law;
• contractual restrictions; or
• other applicable rights.

Fraw may remove, restrict, preserve, or disclose content where reasonably necessary to investigate a complaint, enforce applicable policies, protect another person, or comply with law.

12. Service Providers and Other Recipients

We may disclose or make personal data available to the following categories of recipients.

12.1 Cloud Hosting and Storage Providers

These providers may store or process:

• account information;
• uploaded content;
• generated content;
• gallery content;
• extension assets;
• transaction information;
• logs;
• backups; and
• other Service data.

12.2 AI Providers

AI image-generation and image-processing providers may process:

• prompts;
• uploaded images;
• reference images;
• instructions;
• related technical information; and
• generated Output.

12.3 Authentication Providers

Apple, Google, or another authentication provider may process information necessary to authenticate your account.

12.4 App Stores and Payment Providers

Apple App Store, Google Play, payment processors, and other billing providers may process information relating to:

• subscriptions;
• purchases;
• renewals;
• cancellations;
• refunds;
• chargebacks;
• entitlements; and
• payment compliance.

12.5 Payout Providers

Where creator payout functionality is available, a payout provider may process:

• identity information;
• tax information;
• payment-account information;
• bank or financial information;
• compliance information;
• sanctions information;
• withdrawal requests; and
• payout transactions.

A payout provider may collect this information directly under its own terms and privacy policy.

12.6 Analytics and Performance Providers

These providers may process:

• device information;
• app activity;
• usage information;
• event information;
• performance information;
• crash reports;
• diagnostic data; and
• app-instance identifiers.

Fraw does not intend to provide analytics providers with uploaded Face-Containing Images, generated images, complete prompts, extension reference images, complete payment information, or private support-message content unless separately disclosed and lawfully authorized.

12.7 Safety, Security, and Moderation Providers

These providers may process limited information to:

• detect prohibited content;
• investigate fraud;
• prevent abuse;
• secure accounts;
• respond to security incidents;
• identify spam or bots; and
• support policy enforcement.

12.8 Support and Communication Providers

These providers may process:

• contact information;
• support communications;
• complaint records;
• notification information; and
• account-related messages.

12.9 Professional Advisers

We may disclose information to:

• lawyers;
• accountants;
• auditors;
• insurers;
• consultants;
• compliance advisers; and
• other professional advisers.

12.10 Corporate Transactions

We may disclose information in connection with:

• a merger;
• acquisition;
• financing;
• restructuring;
• asset sale;
• insolvency;
• investment transaction; or
• similar corporate event.

12.11 Public Authorities

We may disclose information to:

• courts;
• regulators;
• law-enforcement agencies;
• cybersecurity authorities;
• consumer-protection bodies;
• personal-data protection authorities;
• telecommunications authorities;
• tax authorities;
• ministries; and
• other competent authorities,

where required or permitted by law.

Fraw does not sell your personal data.

Fraw does not authorize personal data to be used for unrelated cross-context behavioral advertising unless Fraw provides any notice, consent mechanism, opt-out, or other choice required by applicable law.

13. Personal Data Processors

Where a provider processes personal data on Fraw’s behalf, Fraw may require the provider to be subject to appropriate:

• contractual obligations;
• confidentiality duties;
• data-processing instructions;
• security requirements;
• retention restrictions;
• access controls;
• platform terms;
• technical safeguards;
• audit or review rights; or
• legal obligations.

The precise safeguards may vary depending on:

• the provider;
• service;
• information involved;
• processing location;
• available provider terms;
• technical configuration; and
• applicable law.

Fraw may replace, add, or remove service providers from time to time.

14. International Transfers and Processing Outside Bangladesh

Fraw is established in Hong Kong and uses service providers, infrastructure, and technical systems that may operate outside Bangladesh.

Personal data relating to users in Bangladesh may be transferred to, stored in, accessed from, or otherwise processed in:

• Hong Kong;
• Singapore;
• the United States;
• Japan;
• Korea;
• countries in which Fraw’s providers operate; and
• other countries or regions reasonably necessary to provide or support the Service.

The information transferred may include:

• account and authentication information;
• device and technical information;
• usage and diagnostic information;
• transaction and subscription information;
• support and complaint records;
• prompts;
• uploaded images;
• Face-Containing Images;
• generated content;
• extension assets;
• creator and Diamond records;
• payout-status information;
• fraud and security records; and
• other information described in the Privacy Policy.

We may transfer personal data outside Bangladesh where reasonably necessary to:

• provide the Service;
• process generation requests;
• maintain accounts;
• store content;
• process transactions;
• provide support;
• secure the Service;
• moderate content;
• prevent fraud;
• operate creator functions;
• maintain regulatory compliance;
• comply with law; and
• protect legal rights.

Where required by applicable Bangladesh law, Fraw may take measures such as:

• assessing the destination or recipient;
• entering into data-processing or transfer terms;
• applying contractual safeguards;
• obtaining consent;
• conducting provider due diligence;
• implementing access controls;
• using encryption in transit;
• using encryption at rest where supported;
• maintaining transfer records;
• limiting provider instructions;
• notifying, consulting, or obtaining approval from an authority;
• maintaining a copy or specified record in Bangladesh;
• localizing a category of data; or
• using another legally recognized transfer mechanism.

No statement in this Bangladesh Addendum guarantees that personal data will be stored exclusively in Bangladesh.

15. Data Classification, Localization, and Regulatory Records

Applicable Bangladesh law may classify particular data according to its nature, sensitivity, importance, ownership, source, use, or effect.

Fraw may apply different storage, access, transfer, security, or retention measures to different categories of data where required by law.

Fraw does not generally promise that all personal data relating to Bangladesh users will be stored in Bangladesh.

However, Fraw may:

• maintain selected records in Bangladesh;
• maintain a local or replicated copy of specified information;
• use a Bangladesh hosting or service provider;
• maintain local compliance documentation;
• maintain regulatory registration information;
• maintain complaint or content-removal records;
• maintain local contact information;
• restrict the transfer of specified data; or
• apply another localization measure,

where required by law, a competent authority, or Fraw’s compliance arrangements.

Information maintained for regulatory purposes may include:

• corporate and registration information;
• service descriptions;
• domain and application information;
• system categories;
• responsible-contact information;
• complaint records;
• content-removal records;
• transfer records;
• security records;
• access-request records;
• audit records; and
• other required information.

16. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in the Privacy Policy and this Bangladesh Addendum, unless a longer period is required or permitted by law.

Retention periods may depend on:

• whether your account remains active;
• whether content is saved;
• whether an extension remains active, archived, published, unpublished, or previously used;
• whether a subscription remains active;
• whether a transaction, refund, or chargeback remains unresolved;
• whether creator or payout activity remains under review;
• whether a complaint, dispute, investigation, or legal matter remains open;
• fraud-prevention requirements;
• cybersecurity requirements;
• moderation requirements;
• tax, accounting, or audit obligations;
• regulatory requirements;
• legal claims;
• governmental requests;
• preservation obligations; and
• backup-retention schedules.

General retention periods and practices are described in Sections 3.6 and 9 of the Privacy Policy.

These include retention concerning:

• temporary processing images;
• gallery images;
• original input images;
• draft extensions;
• private extensions;
• Published Extensions;
• archived extensions;
• unpublished extensions;
• account deletion;
• transaction records;
• creator and payout records;
• fraud records;
• support records;
• security logs; and
• backups.

17. Deletion, Destruction, Anonymization, and De-Identification

When personal data is no longer reasonably necessary and retention is not required or permitted, Fraw may:

• delete it;
• remove it;
• destroy it;
• anonymize it;
• de-identify it;
• aggregate it; or
• otherwise securely dispose of it.

Deletion from active systems may not result in immediate deletion from:

• encrypted backups;
• disaster-recovery systems;
• legal-preservation systems;
• security records;
• audit records;
• transaction records;
• fraud records; or
• regulatory records.

Backup copies are not ordinarily used for active processing and may remain until overwritten or deleted under the applicable backup-retention process.

18. Your Rights in Bangladesh

Subject to applicable law, identity verification, exceptions, technical feasibility, and the relevant legal provisions being in force, you may have the rights described below.

18.1 Right to Information

You may request information concerning:

• Fraw’s identity;
• the categories of personal data processed;
• the purposes of processing;
• the legal basis for processing;
• intended recipients or categories of recipients;
• retention practices;
• international transfers;
• available rights;
• complaint methods; and
• other information required by law.

18.2 Right of Access

You may request access to personal data concerning you that Fraw processes, subject to applicable exceptions.

18.3 Right to Obtain a Copy

Where required by law, you may request a copy of personal data concerning you in an available or legally required format.

18.4 Right to Correction or Updating

You may request that Fraw:

• correct inaccurate personal data;
• complete incomplete personal data;
• update outdated personal data; or
• otherwise rectify information concerning you.

18.5 Right to Deletion, Erasure, or Destruction

You may request deletion, erasure, or destruction of personal data where available under applicable law, subject to lawful retention grounds.

18.6 Right to Withdraw Consent

You may withdraw consent where processing is based on consent.

18.7 Right to Restrict or Object to Processing

Where provided by applicable law, you may request that Fraw restrict, suspend, end, or reconsider particular processing.

18.8 Right to Data Portability

Where required by law and technically feasible, you may request that personal data you provided be made available in a structured, commonly used, machine-readable, or interoperable format.

18.9 Rights Concerning Automated Decisions

Where applicable law grants a right concerning a decision made solely through automated processing that produces a legal or similarly significant effect, you may request available information, reconsideration, or human review, subject to lawful exceptions.

18.10 Right to Complain

You may submit a privacy complaint or grievance to Fraw.

You may also contact a competent Bangladesh authority where you are legally entitled to do so.

18.11 Right to Compensation or Other Remedy

You may have a right to seek compensation, review, appeal, or another remedy where provided by applicable law.

18.12 Other Rights

You may exercise additional rights available under applicable Bangladesh law.

19. Limits and Exceptions to Rights

Privacy rights are not absolute.

Fraw may decline, limit, defer, or request clarification of a request where permitted by law, including where:

• Fraw cannot reasonably verify your identity;
• Fraw cannot verify your authority to act for another person;
• the request concerns another person’s information;
• fulfillment would adversely affect another person’s rights;
• retention is required or permitted by law;
• information is required for a transaction;
• information is required for tax, accounting, or audit purposes;
• information is required for fraud prevention;
• information is required for security;
• information is required for moderation;
• information is required for creator-program administration;
• information is required for payment or payout processing;
• information is subject to a legal hold;
• information is required to establish or defend a legal claim;
• the request is fraudulent, abusive, excessive, repetitive, or manifestly unfounded;
• disclosure would compromise security, moderation, or fraud-detection systems;
• compliance would violate another legal obligation; or
• another lawful exception applies.

20. How to Exercise Your Rights

You may exercise available rights by:

• using relevant account controls;
• using gallery deletion controls;
• using account-deletion controls;
• using privacy or cookie preference controls;
• contacting Fraw support; or
• emailing hi@fraw.ai with the subject line “Bangladesh Privacy Request.”

Your request should include sufficient information for us to:

• identify the relevant account;
• understand the right you wish to exercise;
• identify the information concerned;
• verify your identity or authority; and
• communicate with you.

We may request additional information where reasonably necessary to:

• verify your identity;
• prevent unauthorized disclosure;
• prevent unauthorized deletion;
• locate relevant information;
• determine whether an exception applies; or
• complete the request.

Do not send passwords, complete payment-card information, government identity documents, tax records, biometric information, or other highly sensitive information unless Fraw specifically requests it through an approved secure method.

Where required by applicable law, Fraw will respond within the applicable period.

The response or completion period may depend on:

• identity verification;
• complexity;
• scope;
• the number of systems involved;
• applicable exceptions;
• third-party processing;
• archived information;
• backup systems; and
• technical circumstances.

21. Bangladesh Privacy Contact and Complaints

Users in Bangladesh may submit privacy-related questions, complaints, requests, or grievances to:

• Bangladesh Privacy Contact
• Untitled Labs Limited
• 20/F, Harbourside HQ
• 8 Lam Chak Street
• Kowloon Bay, Kowloon
• Hong Kong

Email: hi@fraw.ai

Suggested subject line: Bangladesh Privacy Request

Please provide:

• the email address or account identifier connected with your account;
• a description of the request or complaint;
• the relevant date or approximate period;
• any previous support reference;
• the content or extension concerned where applicable; and
• the resolution you are seeking.

Fraw may:

• acknowledge the complaint;
• verify your identity;
• investigate the issue;
• request additional information;
• provide an explanation;
• correct information;
• remove or restrict content;
• take corrective action;
• preserve relevant records;
• decline a request where permitted; or
• refer the matter to another responsible team or provider.

Nothing in this section prevents you from contacting a competent Bangladesh authority where you are legally entitled to do so.

22. Data Protection Officer, Representative, or Responsible Contact

Where applicable Bangladesh law requires Fraw to appoint a:

• data-protection officer;
• data-compliance officer;
• local representative;
• responsible person;
• grievance contact;
• cybersecurity contact; or
• other designated official,

Fraw may appoint the relevant role and publish the details through:

• this Bangladesh Addendum;
• the Privacy Policy;
• the Service;
• Fraw’s website;
• a regulatory registration;
• an app-store listing; or
• another reasonable method.

Until a separate contact is published, privacy questions may be sent to hi@fraw.ai.

23. Security Safeguards

We use reasonable technical, administrative, and organizational measures designed to protect personal data against:

• unauthorized access;
• unauthorized disclosure;
• unlawful use;
• alteration;
• misuse;
• loss;
• destruction;
• interference; and
• other security risks.

These measures may include, where appropriate:

• encryption in transit;
• encryption at rest where supported;
• authentication controls;
• authorization controls;
• role-based access;
• system logging;
• monitoring;
• vulnerability management;
• security testing;
• incident response;
• backup and recovery;
• access restrictions;
• service-provider safeguards;
• fraud-detection systems;
• abuse-prevention controls;
• content-safety controls; and
• confidentiality obligations.

No security method, system, transmission, or storage process is completely secure.

Fraw cannot guarantee absolute security.

You are responsible for:

• maintaining the confidentiality of your login credentials;
• securing devices used to access Fraw;
• avoiding unauthorized account sharing;
• reviewing suspicious account activity; and
• notifying Fraw promptly if you suspect unauthorized access.

24. Personal Data Breaches

If Fraw becomes aware of a personal-data breach affecting personal data within its control, Fraw may:

• investigate the incident;
• contain the incident;
• take remediation measures;
• preserve relevant records;
• assess affected data and risks;
• notify affected individuals;
• notify a competent Bangladesh authority;
• notify law enforcement or a cybersecurity authority;
• coordinate with providers; and
• provide protective recommendations.

Where required by applicable law, notification may include information concerning:

• the personal data affected;
• when and how the incident occurred;
• the likely or potential impact;
• remediation steps;
• protective steps users may take; and
• contact information.

The timing, form, content, and recipients of a notification may depend on:

• applicable law;
• the nature of the incident;
• the information involved;
• the number of people affected;
• risk of harm;
• technical investigation;
• law-enforcement requests;
• security considerations; and
• legal restrictions.

Not every security event constitutes a legally reportable personal-data breach.

25. Cybersecurity and Electronic-System Security

Fraw may process and preserve information in connection with:

• unauthorized system access;
• malware;
• account compromise;
• service disruption;
• fraud;
• scraping;
• automated attacks;
• content abuse;
• manipulation;
• suspicious traffic;
• security vulnerabilities;
• regulatory investigations; and
• other cybersecurity events.

Fraw may disclose information to:

• cybersecurity authorities;
• law-enforcement agencies;
• infrastructure providers;
• app stores;
• payment providers;
• affected users;
• professional advisers; and
• other relevant parties,

where required or permitted by law.

Fraw may retain security logs and related records for the period reasonably necessary to:

• investigate incidents;
• protect the Service;
• comply with law;
• respond to authorities;
• prevent repeat incidents; and
• establish or defend legal claims.

26. Lawful Requests and Regulatory Access

Fraw may receive requests, orders, notices, or inquiries from:

• Bangladesh courts;
• law-enforcement agencies;
• ministries;
• regulators;
• cybersecurity authorities;
• consumer-protection bodies;
• personal-data protection authorities;
• telecommunications authorities;
• tax authorities; and
• other competent bodies.

Subject to applicable law, Fraw may:

• verify a request;
• seek clarification;
• preserve relevant information;
• disclose personal data;
• provide electronic records;
• provide technical or registration information;
• restrict or remove content;
• restrict an account;
• restrict a feature;
• cooperate with an investigation;
• challenge an invalid or excessive request; or
• take another legally permitted action.

Fraw will seek to limit disclosures to information reasonably relevant to a valid request, taking into account:

• the authority relied upon;
• the scope of the request;
• privacy and confidentiality obligations;
• technical feasibility;
• user rights;
• public safety; and
• lawful grounds for objection or challenge.

Fraw may be legally prohibited from notifying you about a request, investigation, preservation instruction, disclosure, or enforcement action.

27. Content Reports and User-Generated Content

The Service may contain Published Extensions and other user-generated content.

Fraw may process personal data to:

• receive user reports;
• investigate unlawful content;
• investigate intellectual-property complaints;
• investigate unauthorized use of images;
• investigate privacy complaints;
• address child-safety concerns;
• address impersonation;
• address fraud or deceptive content;
• enforce platform rules; and
• respond to lawful content-removal or access-blocking requests.

Information processed may include:

• reporter contact information;
• reported-user information;
• content identifiers;
• extension information;
• account records;
• evidence;
• device information;
• IP addresses;
• transaction information;
• moderation decisions; and
• communications.

Fraw may preserve relevant records after content is removed where reasonably necessary for:

• legal compliance;
• fraud prevention;
• repeat-offender enforcement;
• dispute resolution;
• audit;
• security;
• regulatory reporting; and
• protection of legal rights.

28. Children’s Personal Data

Bangladesh law may impose additional requirements concerning children’s use of digital services and the processing of children’s personal data.

The Service is not intended to be used by a child in Bangladesh where applicable law requires:

• parental or guardian consent;
• verification of parental or guardian authority;
• age assurance;
• age verification;
• child-specific notices;
• age-appropriate design;
• restricted profiling;
• restricted advertising;
• restricted publication;
• restricted creator participation;
• child-specific safety controls; or
• another safeguard

that Fraw has not made available.

A parent or legal guardian must not permit a child to use the Service where doing so would violate applicable law or Fraw’s eligibility requirements.

Where Fraw becomes aware that it has unlawfully processed a child’s personal data, Fraw may:

• suspend or restrict the account;
• request information concerning age;
• request information concerning parental authority;
• disable publication;
• disable creator or reward functions;
• disable transactions;
• remove content;
• delete or de-identify personal data;
• preserve information required by law; and
• take other legally permitted action.

Fraw does not knowingly use children’s personal data for:

• targeted advertising;
• unlawful profiling;
• prohibited behavioral monitoring; or
• other prohibited processing.

If you believe that a child has provided personal data to Fraw unlawfully, contact hi@fraw.ai with the subject line “Bangladesh Child Privacy.”

29. Automated Systems and Moderation

Fraw may use automated, manual, or hybrid systems to:

• process generation requests;
• detect unsafe or prohibited content;
• identify fraud or manipulation;
• identify spam or automated activity;
• assess creator eligibility;
• calculate Diamonds;
• prioritize moderation;
• protect accounts;
• enforce country restrictions; and
• support cybersecurity.

These systems may:

• flag content;
• reject a generation;
• restrict an extension;
• delay a transaction;
• refer activity for review;
• restrict a creator reward;
• suspend an account; or
• take another automated action.

Where applicable law grants a right relating to a decision based solely on automated processing that produces a legal consequence or similarly significant effect, you may contact Fraw to request available information or review.

Any such right remains subject to:

• identity verification;
• security needs;
• fraud-prevention requirements;
• intellectual-property rights;
• confidential business information;
• applicable exceptions; and
• technical feasibility.

30. Marketing Communications

Fraw may send marketing or promotional communications where permitted by law.

You may opt out of marketing email by:

• using the unsubscribe link; or
• contacting hi@fraw.ai.

Opting out of marketing does not prevent Fraw from sending:

• account notices;
• billing information;
• purchase confirmations;
• security alerts;
• support communications;
• policy updates;
• legal notices;
• service notices;
• regulatory notices; or
• creator and payout communications.

31. Cookies, SDKs, Analytics, and Similar Technologies

Fraw may use:

• cookies;
• local storage;
• mobile SDKs;
• app-instance identifiers;
• device identifiers;
• authentication technologies;
• analytics technologies;
• crash-reporting technologies;
• fraud-prevention technologies;
• security technologies; and
• similar tools.

These technologies may be used for:

• authentication;
• account security;
• user preferences;
• service operation;
• analytics;
• diagnostics;
• performance monitoring;
• fraud prevention;
• abuse prevention; and
• service improvement.

Additional information is available in the Fraw Cookie Policy or any replacement Cookies and Similar Technologies Policy.

Where consent is required for optional analytics, advertising, or similar technologies, Fraw will seek consent through an appropriate notice or preference control.

Where available, you may withdraw or modify analytics consent through the relevant cookie, app, account, browser, or device control.

32. Creator, Diamond, Withdrawal, and Payout Data

If you participate in creator, extension-publication, Diamond, withdrawal, or payout functionality, Fraw may process personal data to:

• assess eligibility;
• administer creator activity;
• review extensions;
• calculate Diamonds;
• determine qualifying activity;
• investigate fraud or self-dealing;
• process withdrawal requests;
• track payout status;
• resolve payout disputes;
• comply with tax requirements;
• comply with accounting and audit obligations;
• maintain regulatory records; and
• enforce the Terms and Creator Policy.

Creator payout and withdrawal functionality may not be available in Bangladesh.

The display or accumulation of Diamonds does not guarantee that:

• withdrawal is available in Bangladesh;
• a payout provider supports Bangladesh;
• a provider will approve your account;
• you satisfy legal or tax requirements;
• you satisfy identity or payment verification;
• a registration or regulatory approval has been completed;
• foreign-exchange or remittance requirements can be satisfied; or
• Diamonds create an immediate or unconditional entitlement to cash.

Where a third-party payout provider is used, that provider may independently collect:

• identity information;
• tax information;
• payout-account information;
• banking information;
• sanctions information;
• source-of-funds information; and
• other compliance information.

That information is governed by the payout provider’s own terms, privacy policy, and legal obligations.

33. Consumer Transactions

Personal data relating to subscriptions, credits, top-ups, refunds, renewals, cancellations, and app-store transactions may be processed to:

• perform the transaction;
• provide purchased entitlements;
• verify payment status;
• prevent fraud;
• address complaints;
• respond to chargebacks;
• comply with consumer-protection obligations;
• maintain records; and
• establish or defend legal claims.

Where a transaction is processed by Apple, Google, or another provider, that provider acts under its own terms and privacy policy.

34. Regulatory Registration Information

Where Fraw completes or maintains a Bangladesh regulatory registration, filing, appointment, or notification, Fraw may publish or provide information such as:

• Fraw’s legal name;
• country of incorporation;
• registered address;
• registration or filing number;
• service name;
• website domain;
• application name;
• service category;
• responsible-contact information;
• local representative or contact information where applicable;
• complaint channel;
• cybersecurity contact;
• data-processing information; and
• other information required by law.

Publication of regulatory information does not mean that Fraw:

• is incorporated in Bangladesh;
• has a permanent establishment in Bangladesh;
• maintains a Bangladesh office;
• has appointed a local representative for every legal purpose; or
• provides every feature in Bangladesh.

35. Language

This Bangladesh Addendum may be made available in English and Bengali.

Where a Bengali translation is provided, it is intended to improve accessibility, transparency, and understanding.

If there is an inconsistency between language versions:

• the English version will control to the extent permitted by applicable law; and
• the Bengali version or mandatory local interpretation will apply to the extent required by applicable Bangladesh law.

The absence of a translation does not waive any mandatory language requirement.

36. Changes to This Bangladesh Addendum

Fraw may update this Bangladesh Addendum to reflect:

• changes to the Service;
• changes to personal-data practices;
• changes to service providers;
• changes to technical systems;
• changes to Bangladesh law;
• regulatory guidance;
• registration or representative requirements;
• cross-border transfer requirements;
• localization requirements;
• child-protection requirements;
• security or operational requirements; or
• improvements to clarity.

If Fraw makes a material change, Fraw may provide notice:

• through the Service;
• by email;
• on Fraw’s website;
• through an app-store update; or
• by another reasonable method.

The revised Bangladesh Addendum will become effective on the date stated at the top.

Your continued use after the effective date means that you acknowledge the revised Bangladesh Addendum.

Where additional consent is required by law, continued use alone will not replace that required consent.

37. Contact Us

For questions, concerns, requests, complaints, or grievances concerning this Bangladesh Addendum or Fraw’s privacy practices, contact:

• Untitled Labs Limited
• 20/F, Harbourside HQ
• 8 Lam Chak Street
• Kowloon Bay, Kowloon
• Hong Kong
• Privacy and Support Email: hi@fraw.ai
• Suggested subject line: Bangladesh Privacy Request
• Company Registration: 71095371

Where Fraw appoints a Bangladesh-specific representative, data-protection officer, responsible contact, cybersecurity contact, grievance contact, or other local responsible person, the relevant contact information may be published through:

• this Bangladesh Addendum;
• the Privacy Policy;
• Fraw’s website;
• the Service;
• an app-store listing;
• a Bangladesh regulatory register; or
• another reasonable method.

This Bangladesh Addendum forms part of the Fraw Privacy Policy.