Canada Privacy Addendum

Effective Date: 1 June 2026

Last Updated: 22 June 2026

This Canada Privacy Addendum supplements the Fraw Privacy Policy and applies to users located in Canada, including users located in Quebec. This Addendum explains additional information about how Untitled Labs Limited (“Fraw,” “we,” “us,” or “our”) collects, uses, discloses, transfers, stores, retains, protects, and handles personal information in connection with the Fraw mobile application, website, software, official functions, extensions, creator tools, and related services.

This Addendum should be read together with the Fraw Privacy Policy. If there is any conflict between this Addendum and the Fraw Privacy Policy, this Addendum will apply to users located in Canada to the extent required by applicable Canadian privacy laws, including applicable federal, provincial, and Quebec privacy laws.

1. Meaningful Consent and Key Privacy Points

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances and as described in the Fraw Privacy Policy and this Addendum.

To help you understand the key privacy points before using the Service:

Fraw is an AI image-generation and image-transformation service. When you use image-related features, you may upload, capture, select, submit, or generate images that may contain a human face.
Your uploaded images, which may contain a human face, may be transmitted to third-party AI image-generation or image-processing providers where necessary to generate the requested output, perform related safety or abuse-prevention checks, maintain service reliability, or support the requested feature.
Fraw does not use Face-Containing Images for biometric identification, facial recognition, identity verification, identity matching, account authentication, or creation of biometric templates, faceprints, face-geometry scans, or other biometric identifiers.
Fraw does not sell, rent, or trade Face-Containing Images.
Fraw does not authorize third-party AI providers to use Face-Containing Images for unrelated advertising, resale, independent profiling, facial recognition, biometric identification, unrelated model training, or any purpose not described in the Fraw Privacy Policy.
Your personal information may be processed outside Canada, including by service providers located in or operating from Hong Kong, the United States, Japan, Singapore, the United Kingdom, member states of the European Economic Area, Australia, and other countries or regions where our service providers or their infrastructure operate.
Foreign laws may permit courts, law enforcement, regulators, or government authorities in those countries to access personal information in certain circumstances.
If you save generated images to your gallery, create private extensions, publish public extensions, archive extensions, or use creator features, the related content and records may be retained as described in the Fraw Privacy Policy.
Account deletion is available in the app. You may also request account deletion or data deletion by contacting us at hi@fraw.ai.
Some records may be retained after account deletion where required or permitted for legal, security, fraud-prevention, creator-program, payout, tax, accounting, audit, dispute-resolution, enforcement, backup, or other legitimate purposes.

By creating an account, using the Service, uploading or submitting content, initiating image generation, creating or using extensions, participating in creator or referral features, or otherwise using Fraw, you consent to the collection, use, disclosure, transfer, retention, and processing of personal information as described in the Fraw Privacy Policy and this Addendum, subject to applicable law.

Where applicable law requires express consent for certain processing activities, we will seek consent using an appropriate consent mechanism.

2. Personal Information We Collect

The categories of personal information we may collect are described in the Fraw Privacy Policy. These may include:

account information, such as name, username, display name, profile information, email address, phone number where applicable, login credentials, authentication information, and account identifiers;
third-party login information received from supported authentication providers, such as Apple ID or Google login;
device, technical, diagnostic, usage, and activity information, such as device type, operating system, app version, IP address, approximate location derived from IP, app identifiers, crash logs, usage events, timestamps, and transaction activity;
transaction, subscription, top-up, purchase, refund, chargeback, and billing-related information;
prompts, uploaded images, generated images, image transformations, extension configurations, creator publication data, moderation records, and other user content;
Face-Containing Images, meaning photographs, images, or visual content containing a human face that you voluntarily upload, capture, select, or otherwise submit to the Service, together with related non-identifying image-processing information as described in the Fraw Privacy Policy;
extension-related information, including extension names, descriptions, prompts, configurations, reference images, thumbnails, before-and-after images, generated examples, publication status, archive status, and usage records;
creator-program and withdrawal-related information, such as creator account status, withdrawal eligibility, withdrawal requests, payout status, payout amount, transaction reference, payout provider identifier, fraud-prevention signals, and related creator-program communications;
referral, rewards, fraud-prevention, support, complaint, moderation, security, legal, and compliance records.

3. How We Use Personal Information

We use personal information for the purposes described in the Fraw Privacy Policy and this Addendum, including to:

create, authenticate, secure, and manage accounts;
provide subscriptions, credits, top-ups, official functions, Rebuild / Blend, extensions, creator tools, and generated outputs;
process user-requested image transformations and transmit uploaded images to third-party AI image-generation or image-processing providers where necessary to generate the requested output;
operate, store, display, archive, moderate, and manage private and published extensions;
process purchases, subscriptions, refunds, chargebacks, billing records, and related transaction information;
administer creator rewards, Diamonds, withdrawal requests, payout-status records, fraud-prevention records, and creator-program records;
operate referral, reward, and promotional programs;
provide customer support and respond to inquiries, complaints, or requests;
analyze performance, debug issues, maintain reliability, improve safety controls, and protect the Service;
detect, investigate, prevent, and respond to fraud, abuse, spam, prohibited content, policy violations, security incidents, and misuse of the Service;
comply with applicable laws, legal process, regulatory obligations, tax, accounting, audit, and recordkeeping requirements;
enforce our Terms, policies, creator rules, and other agreements;
protect the rights, safety, property, and security of Fraw, our users, and others.

We do not use Face-Containing Images, uploaded face images, original input images containing faces, or generated face-containing outputs to train general-purpose artificial intelligence or machine-learning models, including facial-recognition, identity-matching, biometric-identification, or general-purpose image-generation models, unless we obtain your separate consent where required by applicable law.

4. Face-Containing Images and Biometric Clarification

Some Fraw features allow you to upload, capture, edit, transform, rebuild, blend, or otherwise process images that may contain a human face. We refer to these as “Face-Containing Images” in the Fraw Privacy Policy.

Fraw does not use Face-Containing Images for biometric identification, facial recognition, identity verification, identity matching, account authentication, or creation of biometric templates, faceprints, face-geometry scans, or other biometric identifiers.

Some laws may treat face-containing images, facial images, or related image-processing information as sensitive information, biometric-related information, or similar categories depending on how the information is processed. Where required by applicable law, we rely on your consent and process such information only to provide the image-processing feature you request and for related safety, security, abuse-prevention, service-reliability, legal-compliance, dispute-resolution, and enforcement purposes.

By choosing to upload, capture, select, or submit an image that contains a human face for image generation or transformation, you direct Fraw to process that image for the requested feature and related purposes described in the Fraw Privacy Policy and this Addendum.

5. Disclosure to Service Providers and Third Parties

We may disclose personal information to service providers and third parties as described in the Fraw Privacy Policy and this Addendum. These may include:

cloud hosting and storage providers;
AI image-generation or image-processing providers;
analytics, crash-reporting, and diagnostic providers;
app stores, payment platforms, and payment processors;
payout providers where creator withdrawal or payout features are available;
customer support and communications providers;
security, fraud-prevention, abuse-prevention, and moderation providers;
infrastructure, database, monitoring, and operational service providers;
professional advisers, auditors, legal advisers, or compliance service providers where necessary;
public users or other users where you publish an extension or otherwise make content or creator information publicly available through the Service;
government authorities, courts, regulators, law enforcement, or other parties where required or permitted by law.

When you initiate an image transformation, your uploaded image, which may contain a human face, may be transmitted to one or more third-party AI image-generation or image-processing providers where necessary to generate the requested output, perform related safety or abuse-prevention checks, maintain service reliability, or support the requested feature.

We do not sell, rent, or trade Face-Containing Images.

We do not authorize third-party AI providers to use Face-Containing Images for unrelated advertising, resale, independent profiling, facial recognition, biometric identification, unrelated model training, or any purpose not described in the Fraw Privacy Policy.

Where supported by the applicable provider terms or service configuration, we require or configure providers to delete or de-identify input images and related Face-Containing Images after processing or after any limited technical, safety, security, abuse-prevention, service-reliability, or legal retention period.

6. Cross-Border Transfers and Processing Outside Canada

Fraw is operated by Untitled Labs Limited, a company based in Hong Kong. We use service providers, infrastructure, and technical systems that may be located outside Canada. As a result, personal information of users located in Canada may be processed, stored, accessed, disclosed, or transferred outside Canada.

The countries or regions where personal information may be processed, stored, accessed, disclosed, or transferred may include Hong Kong, the United States, Japan, Singapore, the United Kingdom, member states of the European Economic Area, Australia, and other countries or regions where our service providers or their infrastructure operate.

The categories of personal information that may be processed outside Canada may include:

account information;
device, technical, diagnostic, usage, and activity information;
transaction, subscription, top-up, purchase, refund, chargeback, and billing-related information;
support, complaint, moderation, security, and fraud-prevention records;
user content, uploaded images, generated content, prompts, and extension assets;
Face-Containing Images where processed as part of a requested image-generation or image-processing feature;
creator-program, withdrawal, payout-status, transaction-reference, fraud-prevention, accounting, audit, and compliance records.

We remain responsible for personal information transferred to service providers for processing on our behalf. We use contractual, technical, organizational, and administrative safeguards designed to protect personal information processed by service providers, including service providers located outside Canada.

Foreign laws may permit courts, law enforcement, regulators, or government authorities in those countries to access personal information in certain circumstances.

If you have questions about our use of service providers outside Canada, you may contact us using the details in the Privacy Contact section below.

7. Quebec-Specific Disclosures

This section applies to users located in Quebec and supplements the rest of this Canada Privacy Addendum.

7.1 French-Language Availability

Where required by applicable Quebec law, Fraw will make this Canada Privacy Addendum, the Fraw Privacy Policy, and other required privacy notices available in French. If there is any inconsistency between the English and French versions, the version that provides the greater protection to the user will apply, unless applicable law requires otherwise.

7.2 Privacy Contact and Person Responsible for Personal Information

Fraw has designated a contact for privacy-related questions, requests, and complaints. Unless another person or role is identified by Fraw, privacy-related requests may be directed to the contact listed in the Privacy Contact section of this Addendum.

Where required by applicable Quebec law, Fraw will make available the title and contact information of the person responsible for the protection of personal information.

7.3 Consent and Sensitive Information

Where Quebec law requires consent, Fraw will seek consent that is clear, free, informed, and given for specific purposes.

Where applicable Quebec law requires express consent for sensitive personal information, including sensitive face-containing images or related image-processing information, Fraw will seek consent using an appropriate consent mechanism.

7.4 Privacy by Default

Where required by applicable Quebec law, Fraw will configure privacy settings by default to provide a high level of privacy protection, subject to the functionality of the Service and choices made by the user.

7.5 Cross-Border Transfers Outside Quebec

Fraw may communicate or make available personal information of Quebec users outside Quebec, including to service providers, infrastructure providers, AI image-generation or image-processing providers, payment platforms, payout providers, analytics providers, customer support providers, security providers, fraud-prevention providers, and other service providers described in the Fraw Privacy Policy and this Addendum.

Before communicating personal information outside Quebec where required by applicable Quebec law, Fraw will conduct an assessment of privacy-related factors, including the sensitivity of the information, the purposes of use, the protection measures that apply, the location of processing, and the legal framework applicable in the relevant jurisdiction.

Where required by applicable Quebec law, Fraw will use written agreements or other appropriate safeguards designed to ensure that personal information communicated outside Quebec receives protection consistent with applicable legal requirements.

7.6 Confidentiality Incidents

If Fraw becomes aware of a confidentiality incident involving personal information of Quebec users, Fraw will assess the incident and take reasonable measures to reduce the risk of harm and prevent similar incidents.

Where required by applicable Quebec law, Fraw will notify the Commission d’accès à l’information du Québec and affected individuals if the incident presents a risk of serious injury. Fraw will also keep records of confidentiality incidents where required by applicable law.

7.7 Rights of Quebec Users

Subject to applicable law, Quebec users may have rights regarding their personal information, including the right to:

access personal information held by Fraw;
request correction of inaccurate, incomplete, or equivocal personal information;
request deletion of certain personal information where available under applicable law;
withdraw consent where processing is based on consent;
request information about how personal information is collected, used, disclosed, retained, or transferred;
request that Fraw cease disseminating certain personal information or de-index certain information where required by applicable law;
request data portability where required by applicable law and where the information is computerized personal information collected from the user, subject to applicable exceptions.

To exercise these rights, contact Fraw using the details in the Privacy Contact section below.

7.8 Automated Decision-Making

If Fraw uses personal information to make a decision based exclusively on automated processing and that decision produces legal effects or similarly significant effects concerning a Quebec user, Fraw will provide information required by applicable Quebec law and will allow the user to submit observations to a member of Fraw personnel who is able to review the decision, where required by applicable law.

At this stage, Fraw does not use Face-Containing Images to make decisions based exclusively on automated processing that produce legal effects or similarly significant effects concerning users.

8. Creator Payout and Withdrawal Records

For the global version of the Service, Fraw does not directly collect government identification documents, tax identification numbers, tax forms, or other formal identity-verification or tax records from users as part of the standard account signup, login, creator participation, or withdrawal flow.

Creator payouts may be processed through third-party payout providers, such as PayPal, where available. When you use a third-party payout provider, you may be required to provide payout account information, identity information, tax information, or other compliance-related information directly to that provider. That provider’s collection, use, retention, disclosure, and protection of such information are governed by its own terms, privacy policy, and legal obligations.

Fraw may receive or retain limited information from or about the payout process, such as your Fraw account identifier, creator account status, withdrawal eligibility, withdrawal requests, payout status, payout amount, transaction reference, payout provider identifier, fraud-prevention signals, and related creator-program records.

9. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in the Fraw Privacy Policy and this Addendum, unless a longer retention period is required or permitted by applicable law.

Retention periods may vary depending on the type of information, the purpose of processing, account status, user choices, legal requirements, security needs, fraud-prevention needs, creator-program administration, dispute-resolution needs, payout processing, tax, accounting, audit, backup-retention practices, and operational requirements.

In particular:

temporary processing images that are not saved to your account gallery, associated with a saved extension, or otherwise retained as part of an account feature are deleted from active systems within the period described in the Fraw Privacy Policy, unless a longer period is necessary for security, abuse prevention, legal compliance, dispute resolution, technical troubleshooting, enforcement of our Terms, or protection of legal rights;
saved gallery images and generated content are retained while your account is active, or until you delete them through available in-app controls, subject to applicable exceptions;
original input images are retained only where saved to your account, gallery, extension, project, history, or other account feature at your request or as part of a feature you use;
saved private extensions, published extensions, archived extensions, archived public extension assets, unpublished public extension assets, and related extension records may be retained as described in the Fraw Privacy Policy;
archiving an extension does not delete the extension or its associated assets;
creator-program, withdrawal, payout-status, transaction, fraud-prevention, accounting, audit, and compliance records may be retained for the period required or permitted for creator-program administration, withdrawal processing, payout tracking, fraud prevention, accounting, audit, legal compliance, and dispute resolution;
deleted information may remain in encrypted backups for a limited period until those backups are overwritten or deleted according to our backup retention schedule.

When the purpose of collection or processing has been fulfilled, the applicable retention period has expired, or deletion is required by applicable law, we will delete, de-identify, anonymize, or otherwise securely dispose of personal information, unless retention is required or permitted for legal, tax, accounting, audit, security, fraud-prevention, dispute-resolution, enforcement, creator-program, payout, backup, or other legitimate purposes described in the Fraw Privacy Policy or this Addendum.

10. Access, Correction, Deletion, Withdrawal of Consent, and Portability

Subject to applicable law, users located in Canada may request access to personal information we hold about them and may request correction of inaccurate or incomplete personal information.

You may also request deletion of certain personal information, withdraw consent where processing is based on consent, request portability where available under applicable law, or ask questions about how we collect, use, disclose, retain, or transfer your personal information.

You may manage certain information directly through account settings or available in-app controls. Account deletion is available in the app. You may delete individual saved images, generated content, and gallery items through available in-app controls. For saved extensions in your extension library or similar account area, individual deletion may not be available; saved extensions may instead be archived through available in-app controls.

You may also request account deletion or data deletion by contacting us at hi@fraw.ai.

To make an access, correction, deletion, withdrawal-of-consent, portability, or privacy request, contact us using the details in the Privacy Contact section below. We may need to verify your identity before responding to your request.

We will respond to requests within a reasonable period after receiving the request. We may decline, limit, or delay a request where permitted by applicable law, including where we cannot verify your identity, where fulfilling the request would conflict with legal obligations, security requirements, fraud-prevention needs, creator-program administration, payment or payout processing requirements, dispute-resolution needs, or the rights and freedoms of others.

If you withdraw consent, we may no longer be able to provide some or all features of the Service. Withdrawal of consent does not affect processing already carried out before the withdrawal, or processing that is permitted or required by applicable law.

11. Privacy Complaints

If you have a concern or complaint about how we handle your personal information, please contact us using the details in the Privacy Contact section below.

Please include enough information for us to understand and investigate your complaint. We may need to verify your identity or request additional information.

We will review and respond to privacy complaints within a reasonable period.

If you are not satisfied with our response, or if you believe your privacy rights have been violated, you may contact the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or another applicable federal or provincial privacy authority.

12. Safeguards

We use reasonable technical, administrative, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, theft, interference, alteration, disclosure, copying, modification, or disposal.

These safeguards may include:

encryption in transit using TLS;
encryption at rest where supported by the applicable storage system;
access controls and permission management;
internal access limitations based on need to know;
logging and monitoring of systems where appropriate;
technical safeguards designed to protect against unauthorized access, alteration, loss, interference, misuse, theft, disclosure, copying, modification, or disposal;
service-provider review and management;
procedures for responding to security incidents;
confidentiality obligations for personnel and contractors where applicable.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Breach and Security Incident Response

If we become aware of a security incident or confidentiality incident affecting personal information of users located in Canada, we will investigate and take appropriate steps to mitigate and respond to the incident.

Where required by applicable law, we will notify affected individuals, regulators, or other organizations within the legally required timeframe and maintain required records of the incident.

14. Direct Marketing

We may send marketing or promotional communications where permitted by law. You may opt out of marketing communications by using the unsubscribe link in the message or by contacting us.

Even if you opt out of marketing communications, we may still send service-related, account-related, billing, security, transactional, and legal communications.

15. Children’s Personal Information

The Service is not intended for children below the age permitted under applicable law to use the Service without parental consent. We do not knowingly collect personal information from children in violation of applicable law.

If you believe a child has provided us with personal information unlawfully, please contact us so we can investigate and take appropriate action.

16. Privacy Contact

If you have questions, concerns, complaints, or requests regarding this Canada Privacy Addendum or our handling of personal information, you may contact us using the details below:

Untitled Labs Limited
Address: 20/F, Harbourside HQ, 8 Lam Chak Street, Kowloon Bay, Kowloon
Support Email: hi@fraw.ai
Company Registration: 71095371

Depending on the nature of your request, we may need to verify your identity before responding or taking action.

17. Changes to This Canada Privacy Addendum

We may update this Canada Privacy Addendum from time to time.

If we make material changes, we may provide notice through the Service, by email, on our website, or by other reasonable means, as required by applicable law.

Your continued use of the Service after the updated Canada Privacy Addendum becomes effective means you acknowledge the revised Addendum.