India Privacy Addendum

This India Privacy Addendum (the “India Addendum”) supplements the Fraw Privacy Policy and applies to individuals located in India who access or use the Fraw mobile application, website, software, official functions, extensions, creator tools, and related services collectively referred to as the “Service.”

The Service is operated by Untitled Labs Limited (“Fraw,” “we,” “us,” or “our”), a company incorporated in Hong Kong.

This India Addendum should be read together with the Privacy Policy. Capitalized terms not defined in this India Addendum have the meanings given in the Privacy Policy.

If this India Addendum conflicts with the Privacy Policy, this India Addendum will apply to individuals in India to the extent required by applicable Indian law. Nothing in this India Addendum limits any right or protection that cannot lawfully be limited or waived.

1. Scope and Applicable Indian Law

This India Addendum provides additional information concerning Fraw’s processing of digital personal data in connection with offering the Service to individuals in India.

Where applicable and in force, our processing of personal data relating to individuals in India is subject to the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and other applicable Indian privacy, information-technology, cybersecurity, consumer-protection, and electronic-commerce requirements.

Certain provisions of Indian data-protection legislation and implementing rules may commence or become enforceable in phases. We will apply the rights, obligations, procedures, and safeguards described in this India Addendum to the extent required by the provisions applicable to Fraw at the relevant time.

For purposes of applicable Indian data-protection law:

• Fraw may act as a Data Fiduciary when it determines the purpose and means of processing your personal data;
• you may be referred to as a Data Principal; and
• service providers that process personal data on our behalf may act as Data Processors or in an equivalent service-provider capacity.

2. Personal Data We Process

We may process the categories of personal data described in the Privacy Policy, including:

• account, profile, login, and authentication information;
• contact information;
• device, browser, app, network, and technical information;
• IP address and approximate location derived from IP address;
• usage, interaction, diagnostic, crash, and performance information;
• subscription, top-up, purchase, refund, and transaction records;
• prompts, text, files, images, and other content you submit;
• generated images, transformations, and other outputs;
• extension, creator, publication, moderation, and reward information;
• referral, fraud-prevention, safety, and security information;
• support requests, reports, complaints, and communications;
• creator-program, Diamond, withdrawal, and payout-status information where applicable; and
• Face-Containing Images and related non-identifying image-processing information as described in Section 3 of the Privacy Policy.

Fraw does not create or store biometric templates, faceprints, face-geometry scans, or biometric identifiers from Face-Containing Images.

Fraw does not use Face-Containing Images to identify you as a real-world person, authenticate your account, perform facial recognition, or create a biometric identification profile.

3. Sources of Personal Data

We may collect personal data:

• directly from you;
• automatically when you access or use the Service;
• from Apple, Google, or another authentication provider;
• from app stores and payment providers;
• from cloud, analytics, security, fraud-prevention, moderation, and infrastructure providers;
• from payout providers where creator payout functionality is available; and
• from other persons where they submit content, reports, communications, or lawful requests concerning you.

If you provide personal data relating to another person, including an image containing another person’s face, you are responsible for ensuring that you have the authority, permission, consent, or other lawful basis necessary to provide that information to Fraw and request the relevant processing.

4. Purposes of Processing

We may process personal data for the purposes described in the Privacy Policy, including to:

• create, authenticate, secure, and administer accounts;
• provide subscriptions, credits, top-ups, and purchased features;
• process prompts, images, and other content to generate requested outputs;
• provide official functions, Rebuild, Blend, and extension-based features;
• allow users to create, save, archive, publish, unpublish, moderate, and use extensions;
• operate creator, Diamond, referral, and promotional programs;
• process and track transactions, refunds, chargebacks, and entitlements;
• provide customer support and respond to complaints or reports;
• communicate service, billing, account, security, transactional, policy, and legal information;
• improve the reliability, safety, quality, usability, and performance of the Service;
• detect, prevent, investigate, and respond to fraud, abuse, unlawful activity, security incidents, manipulation, and policy violations;
• enforce our Terms, Creator Policy, community standards, and other applicable rules;
• establish, exercise, or defend legal claims;
• comply with applicable laws, court orders, governmental requests, regulatory duties, cybersecurity requirements, accounting duties, and tax obligations; and
• carry out other purposes disclosed to you at or before the time of processing.

We will not use personal data for a new purpose that is materially incompatible with the purpose originally disclosed unless permitted by applicable law or after providing any additional notice or obtaining any additional consent required by law.

5. Legal Grounds and Permitted Uses

Where applicable Indian law requires a lawful ground for processing, we process personal data based on one or more of the following:

• your consent;
• processing necessary to provide a service or feature you request;
• processing of information voluntarily provided by you for a specified purpose;
• compliance with a legal obligation, court order, regulatory requirement, or lawful governmental request;
• responding to a medical emergency or threat to life or health, where applicable;
• responding to a disaster, breakdown of public order, or other legally recognized emergency, where applicable;
• employment-related purposes permitted by law, where relevant;
• prevention, detection, investigation, or prosecution of offences or cybersecurity incidents;
• protection of Fraw, our users, service providers, partners, or other persons from fraud, abuse, unlawful conduct, or security threats; and
• any other legitimate use or lawful basis permitted under applicable Indian law.

Nothing in this section means that Fraw will rely on every listed ground in every situation.

6. Notices and Consent

Where we rely on consent, we will seek consent through a notice, request, setting, affirmative action, or other method appropriate to the relevant processing and required by applicable law.

A consent request may identify:

• the personal data or category of personal data involved;
• the specified purpose of processing;
• how the consent may be withdrawn;
• how to contact Fraw regarding privacy questions or grievances; and
• any other information required by applicable law.

By voluntarily submitting a prompt, image, file, instruction, or other content and initiating an AI-generation, transformation, Rebuild, Blend, or extension-based request, you instruct Fraw to process and transmit that content to Fraw’s systems and to the service providers reasonably necessary to perform, secure, support, moderate, or troubleshoot the requested function.

This instruction does not authorize Fraw or its service providers to use your Face-Containing Images for unrelated advertising, resale, independent profiling, facial recognition, biometric identification, or unrelated model training.

Consent to one purpose does not automatically constitute consent to a materially different purpose.

7. Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent using an available account, privacy, communication, device, website, or support control.

You may also contact us at hi@fraw.ai with the subject line “India Privacy Request.”

Withdrawal of consent:

• will not affect the lawfulness of processing carried out before withdrawal;
• may not require deletion of information that Fraw is legally required or permitted to retain;
• may not affect processing based on another lawful ground; and
• may prevent Fraw from continuing to provide a feature or the Service where the relevant personal data is reasonably necessary to provide it.

Where reasonably practicable and required by applicable law, withdrawing consent will be made as accessible as providing it.

8. Face-Containing Images and AI Processing

The Service may allow you to upload, capture, edit, transform, rebuild, blend, save, publish, or otherwise process images containing human faces.

The collection, purposes, sharing, storage, security, retention, and deletion of Face-Containing Images are described in detail in Section 3 of the Privacy Policy.

When you initiate an image-generation or transformation request:

• Fraw may transmit the submitted image and related prompt or instruction to one or more third-party AI image-generation or image-processing providers;
• those providers may process the information to generate the requested output and for limited technical, safety, security, debugging, abuse-prevention, service-reliability, or legal purposes permitted by their applicable terms and service configuration;
• processing may occur outside India;
• Fraw does not authorize providers to use the information for unrelated advertising, resale, facial recognition, biometric identification, independent profiling, or unrelated model training; and
• provider retention and deletion may depend on the provider terms and technical configuration available to Fraw.

You should not submit an image of another person unless you have the rights, permissions, consents, or other legal authority necessary to do so.

9. Data Processors and Other Recipients

We may disclose or make personal data available to:

• cloud-hosting and storage providers;
• AI image-generation and image-processing providers;
• app stores and payment platforms;
• login and authentication providers;
• analytics and performance providers;
• customer-support and communication providers;
• content-safety and moderation providers;
• cybersecurity, fraud-prevention, and abuse-prevention providers;
• professional advisers, auditors, insurers, and consultants;
• corporate transaction participants;
• courts, regulators, law-enforcement agencies, cybersecurity authorities, and other public authorities where disclosure is required or permitted by law; and
• other parties described in the Privacy Policy or in a notice presented to you.

We require service providers processing personal data on our behalf to be subject to appropriate contractual, technical, platform, organizational, or legal safeguards, taking into account the nature of the service and information involved.

Fraw does not sell your personal data.

Fraw does not authorize the sharing of personal data for cross-context behavioural advertising unless we provide any notice, consent mechanism, or choice required by applicable law.

10. Processing Outside India

Fraw is established in Hong Kong and uses service providers and technical infrastructure that may operate in Hong Kong, the United States, Singapore, Japan, Korea, or other countries and regions.

Accordingly, personal data relating to users in India may be transferred to, stored in, accessed from, or otherwise processed outside India.

The information transferred may include:

• account and authentication information;
• device, usage, diagnostic, and security information;
• transaction and subscription information;
• support and communication records;
• prompts, uploaded images, generated content, and extension assets;
• Face-Containing Images;
• creator, Diamond, moderation, withdrawal, and payout-status information; and
• other information described in the Privacy Policy.

We may transfer personal data outside India where reasonably necessary to provide, operate, secure, maintain, support, moderate, analyze, improve, or legally administer the Service.

Where required by applicable Indian law, we will take reasonable measures designed to protect transferred personal data and comply with restrictions, conditions, or requirements imposed by the Government of India concerning transfers to particular countries, territories, entities, or classes of processing.

No statement in this India Addendum guarantees that personal data will be stored exclusively in India.

11. Data Retention and Erasure

We retain personal data only for as long as reasonably necessary for the purposes described in the Privacy Policy and this India Addendum, unless a longer period is required or permitted by law.

The applicable period may depend on:

• whether your account remains active;
• whether content is saved to your account, gallery, extension, project, or history;
• whether an extension remains active, archived, published, unpublished, or previously used;
• whether a transaction, refund, chargeback, creator reward, withdrawal, or dispute remains unresolved;
• fraud-prevention, safety, cybersecurity, moderation, and enforcement requirements;
• accounting, tax, audit, and legal-record obligations;
• legal claims or governmental requests; and
• backup and disaster-recovery schedules.

General retention periods and practices, including those applicable to temporary processing images, gallery images, extension assets, archived extensions, account deletion, backups, creator-program records, and Face-Containing Images, are set out in Sections 3.6 and 9 of the Privacy Policy.

When the purpose for processing has been fulfilled and retention is no longer required or permitted, we may delete, remove, de-identify, anonymize, aggregate, or otherwise securely dispose of the information.

Deletion from active systems may not result in immediate deletion from encrypted backups. Backup copies are not used for ordinary active processing and are overwritten or deleted according to applicable backup-retention practices.

12. Your Rights in India

Subject to applicable law, verification requirements, exceptions, and the relevant provisions being in force, you may have the following rights.

12.1 Access Information

You may request a summary of:

• personal data being processed about you;
• processing activities concerning that personal data;
• identities or categories of Data Processors or other persons with whom the personal data has been shared, where required by law; and
• other information prescribed under applicable law.

12.2 Correction, Completion, and Updating

You may request that we:

• correct inaccurate or misleading personal data;
• complete incomplete personal data; or
• update personal data that has changed.

12.3 Erasure

You may request erasure of personal data that is no longer necessary for the specified purpose for which it was processed, subject to information that Fraw is required or permitted to retain.

12.4 Withdraw Consent

You may withdraw consent where processing is based on consent, as described in Section 7 of this India Addendum.

12.5 Grievance Redressal

You may submit a grievance concerning:

• Fraw’s processing of your personal data;
• our response to a privacy request; or
• an alleged failure to comply with applicable Indian data-protection law.

12.6 Nomination

Where provided by applicable law, you may nominate another individual to exercise your rights in the event of your death or incapacity.

12.7 Other Rights

You may exercise any additional rights made available under applicable Indian law.

These rights are not absolute. We may decline, limit, defer, or request clarification of a request where permitted by law, including where:

• we cannot reasonably verify your identity or authority;
• the request relates to another person’s rights or information;
• the request is fraudulent, abusive, manifestly unfounded, or excessive;
• retention is required or permitted by law;
• information is required for fraud prevention, cybersecurity, moderation, creator-program administration, payment processing, accounting, tax, audit, disputes, legal claims, or enforcement;
• compliance would adversely affect the rights or safety of another person; or
• another lawful exception applies.

13. How to Exercise Your Rights

You may exercise available rights by:

• using relevant account, gallery, privacy, content, or deletion controls within the Service; or
• emailing hi@fraw.ai with the subject line “India Privacy Request.”

Your request should include sufficient information for us to:

• identify the account or information concerned;
• understand the right you wish to exercise;
• verify your identity or authority; and
• communicate with you regarding the request.

We may request additional information where reasonably necessary to verify your identity, prevent unauthorized disclosure or deletion, locate the relevant information, or assess the request.

Do not send passwords, complete payment-card information, government identity documents, or other highly sensitive information unless we specifically request it through an approved secure method.

Where required by applicable law, we will respond within the applicable period. Response and completion time may vary depending on the nature, complexity, scope, verification requirements, legal exceptions, and technical circumstances of the request.

14. Grievance Redressal

Users in India may submit privacy-related questions, complaints, or grievances to:

• India Privacy and Grievance Contact
• Untitled Labs Limited
• 20/F, Harbourside HQ
• 8 Lam Chak Street
• Kowloon Bay, Kowloon
• Hong Kong
• Email: hi@fraw.ai
• Suggested subject line: India Privacy Grievance

Please provide:

• the email address or account identifier connected with your Fraw account;
• a description of the issue;
• the relevant date or approximate period;
• any previous request or support reference; and
• the resolution you are seeking.

We may acknowledge, investigate, request further information, provide an explanation, take corrective action, or decline the grievance where permitted by law.

Where applicable Indian law requires you to use Fraw’s grievance process before approaching the Data Protection Board of India or another competent authority, you should first provide Fraw a reasonable opportunity to address the grievance.

Nothing in this section prevents you from contacting a competent authority where you are legally entitled to do so.

15. Duties of Users

Applicable Indian law may impose duties on individuals exercising data-protection rights.

You must not:

• impersonate another person;
• submit false or misleading information;
• suppress material information when providing personal data for an official purpose;
• submit a grievance or complaint that is false or frivolous;
• fraudulently exercise another person’s rights; or
• provide content or personal data in violation of applicable law or another person’s rights.

You should provide authentic information when requesting correction, completion, updating, erasure, or other action concerning your personal data.

This section does not limit your right to make a good-faith complaint or exercise a lawful right.

16. Children’s Personal Data

For purposes of applicable Indian data-protection law, a child generally means an individual who has not completed eighteen years of age, unless a different threshold or exemption applies under law.

The Service is not intended to be used by a child in India where Fraw would be required to obtain verifiable parental or lawful guardian consent and Fraw has not provided an approved method for obtaining and verifying that consent.

A parent or lawful guardian must not permit a child to use the Service where doing so would violate applicable law or Fraw’s eligibility requirements.

Where Fraw becomes aware that it has unlawfully processed a child’s personal data, Fraw may:

• suspend or restrict the relevant account;
• request information reasonably necessary to assess age or parental authority;
• delete or de-identify the child’s personal data;
• remove submitted or generated content;
• disable creator, publication, communication, or transaction functions; or
• take other action required or permitted by law.

Where applicable law permits processing involving a child based on verified parental consent or an exemption, Fraw may apply additional eligibility, consent, safety, content, tracking, advertising, creator, publication, or account controls.

Fraw does not knowingly use children’s personal data for targeted advertising, behavioural monitoring, or other processing prohibited by applicable Indian law.

If you believe that a child has provided personal data to Fraw unlawfully, contact hi@fraw.ai with the subject line “India Child Privacy.”

17. Security Safeguards

We use reasonable technical, administrative, and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, misuse, loss, or destruction.

These measures may include, where appropriate:

• encryption in transit;
• encryption at rest where supported;
• account and system access controls;
• authentication and authorization controls;
• logging and monitoring;
• security testing and review;
• vulnerability and incident management;
• backup and recovery measures;
• service-provider safeguards;
• fraud, abuse, and content-safety controls; and
• internal access restrictions.

No security measure, transmission method, or storage system is completely secure. We cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your login credentials, securing your devices, and notifying us promptly if you suspect unauthorized access to your account.

18. Personal Data Breaches and Cybersecurity Incidents

If Fraw becomes aware of a personal data breach or cybersecurity incident affecting information within our control, we may:

• investigate and contain the incident;
• take reasonable remediation measures;
• preserve relevant records;
• notify affected individuals;
• notify the Data Protection Board of India, CERT-In, law-enforcement authorities, regulators, or other competent authorities; and
• provide information, updates, or protective recommendations,

in each case where and within the period required by applicable law.

The timing, form, content, and recipients of a notification may depend on:

• the nature of the incident;
• the information involved;
• the risk of harm;
• legal restrictions;
• law-enforcement requests; and
• the requirements applicable to Fraw.

Nothing in this India Addendum guarantees that every security event will result in a notification.

19. Marketing and Analytics

We may send marketing or promotional communications where permitted by law.

You may opt out of marketing emails by:

• using the unsubscribe link included in the communication; or
• contacting hi@fraw.ai.

Even after opting out of marketing communications, you may continue to receive:

• account messages;
• billing and subscription messages;
• security notices;
• transaction confirmations;
• support communications;
• policy updates; and
• legal notices.

Fraw may use cookies, local storage, mobile SDKs, device identifiers, or similar technologies for authentication, security, preferences, analytics, diagnostics, and service improvement as described in the Fraw Cookie Policy and any notice or preference control presented to you.

Where consent is required for optional analytics or similar technologies, we will seek that consent in accordance with applicable law.

20. Creator and Payout Information

If you participate in creator, Diamond, extension-publication, reward, withdrawal, or payout functionality, Fraw may process information necessary to:

• assess eligibility;
• administer creator and reward activity;
• calculate or adjust Diamonds;
• investigate fraud, manipulation, refunds, or chargebacks;
• process or track withdrawal requests;
• communicate payout status;
• maintain transaction, accounting, audit, tax, and compliance records; and
• enforce the Terms and Creator Policy.

Creator payout and withdrawal functionality may not be available in every country or region.

The accumulation or display of Diamonds does not guarantee that:

• withdrawal is available in India;
• a particular payout provider supports India;
• you satisfy verification, tax, legal, or eligibility requirements; or
• Diamonds create an immediate or unconditional entitlement to cash.

Where a third-party payout provider is used, that provider may independently collect identity, tax, payment, or compliance information under its own terms and privacy policy.

21. Automated Systems and Moderation

Fraw may use automated, manual, or hybrid systems to:

• process AI-generation requests;
• detect prohibited or unsafe content;
• investigate fraud, spam, manipulation, or abuse;
• assess creator or reward eligibility;
• prioritize moderation or security review;
• enforce platform rules; and
• protect the Service and its users.

These systems may restrict, delay, flag, reject, or refer content, transactions, extensions, rewards, or accounts for review.

Where applicable law grants a right concerning a decision made solely through automated processing, you may contact us to request available information or review, subject to applicable exceptions and verification requirements.

22. Changes to This India Addendum

We may update this India Addendum from time to time to reflect:

• changes to the Service;
• changes to our data practices;
• changes to service providers or technical systems;
• changes to applicable Indian law;
• regulatory guidance;
• security, operational, or business requirements; or
• improvements to clarity and transparency.

If we make a material change, we may provide notice through the Service, by email, on our website, or by another reasonable method as required by law.

The revised India Addendum will become effective on the date stated at the top of the document.

Your continued use of the Service after the effective date means that you acknowledge the revised India Addendum. Where additional consent is legally required, continued use alone will not replace that required consent.

23. Contact Us

For questions, concerns, requests, or grievances relating to this India Addendum or Fraw’s privacy practices, contact:

• Untitled Labs Limited
• 20/F, Harbourside HQ
• 8 Lam Chak Street
• Kowloon Bay, Kowloon
• Hong Kong
• Privacy and Support Email: hi@fraw.ai
• Suggested subject line: India Privacy Request
• Company Registration: 71095371

This India Addendum forms part of the Fraw Privacy Policy.