United States Privacy Addendum

This United States Privacy Addendum supplements the Fraw Privacy Policy and applies to users located in the United States. This Addendum provides additional information about how Untitled Labs Limited (“Fraw,” “we,” “us,” or “our”) collects, uses, discloses, transfers, retains, protects, and handles personal information in connection with the Fraw mobile application, website, software, official functions, extensions, creator tools, and related services.

This Addendum should be read together with the Fraw Privacy Policy. If there is any conflict between this Addendum and the Fraw Privacy Policy, this Addendum will apply to users located in the United States to the extent required by applicable U.S. federal or state privacy laws.

For purposes of this Addendum, “personal information,” “personal data,” “sensitive personal information,” “sell,” “share,” “consumer,” “business,” “controller,” “processor,” and similar terms have the meanings given to them under applicable U.S. state privacy laws, to the extent those laws apply.

1. Scope of This United States Addendum

This Addendum applies to personal information we collect, use, disclose, retain, or otherwise process when users located in the United States:

• create or use a Fraw account;
• subscribe to a plan or purchase top-up credits;
• use official features such as Official Extensions or Rebuild / Blend;
• upload, capture, submit, edit, transform, rebuild, blend, or generate images;
• create, edit, publish, archive, or use extensions;
• participate in referral, reward, creator, or withdrawal features;
• contact us for support;
• visit our website or interact with our communications;
• otherwise use the Service.

This Addendum includes additional disclosures for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other applicable U.S. state privacy laws.

2. Categories of Personal Information We Collect

The categories of personal information we collect are described in the Fraw Privacy Policy. Depending on how you use the Service, we may collect the following categories of personal information:

We do not collect all of these categories from every user. The categories collected depend on how you use the Service.

3. Sources of Personal Information

We may collect personal information from the following sources:

• directly from you when you create an account, upload content, use features, purchase credits, create extensions, participate in creator features, or contact us;
• automatically from your device, browser, app installation, or use of the Service;
• from app stores, payment platforms, and payment processors;
• from third-party authentication providers, such as Apple ID or Google login;
• from payout providers where creator withdrawal or payout features are available;
• from analytics, hosting, cloud, infrastructure, security, fraud-prevention, moderation, customer-support, and communications providers;
• from other users or public interactions where you publish an extension or otherwise make information available through the Service;
• from legal, compliance, or safety sources where necessary to protect the Service or comply with applicable law.

4. How We Use Personal Information

We use personal information for the purposes described in the Fraw Privacy Policy and this Addendum, including to:

• create, authenticate, secure, and manage accounts;
• provide subscriptions, credits, top-ups, official functions, Rebuild / Blend, extensions, creator tools, and generated outputs;
• process user-requested image transformations and transmit uploaded images to third-party AI image-generation or image-processing providers where necessary to generate the requested output;
• operate, store, display, archive, moderate, and manage private and published extensions;
• process purchases, subscriptions, refunds, chargebacks, billing records, and related transaction information;
• administer creator rewards, Diamonds, withdrawal requests, payout-status records, fraud-prevention records, and creator-program records;
• operate referral, reward, and promotional programs;
• provide customer support and respond to inquiries, complaints, or requests;
• analyze performance, debug issues, maintain reliability, improve safety controls, and protect the Service;
• detect, investigate, prevent, and respond to fraud, abuse, spam, prohibited content, policy violations, security incidents, and misuse of the Service;
• comply with applicable laws, legal process, regulatory obligations, tax, accounting, audit, and recordkeeping requirements;
• enforce our Terms, policies, creator rules, and other agreements;
• protect the rights, safety, property, and security of Fraw, our users, and others.

We do not use Face-Containing Images, uploaded face images, original input images containing faces, or generated face-containing outputs to train general-purpose artificial intelligence or machine-learning models, including facial-recognition, identity-matching, biometric-identification, or general-purpose image-generation models, unless we obtain your separate consent where required by applicable law.

5. Face-Containing Images and Biometric Information Clarification

Some Fraw features allow you to upload, capture, edit, transform, rebuild, blend, or otherwise process images that may contain a human face. We refer to these as “Face-Containing Images” in the Fraw Privacy Policy.

Fraw does not use Face-Containing Images to identify you as a real-world person, verify your identity, authenticate your account, perform facial recognition, perform identity matching, or create a biometric identification profile.

Fraw does not create or store biometric templates, faceprints, face-geometry scans, facial-recognition templates, facial-recognition profiles, or other biometric identifiers from Face-Containing Images.

Fraw does not use Face-Containing Images to determine your race, ethnicity, religion, health status, sexual orientation, or other sensitive attributes.

Fraw does not sell, rent, or trade Face-Containing Images.

When you choose to upload, capture, select, or submit an image that contains a human face for image generation or transformation, you direct Fraw to process that image for the requested feature and related purposes described in the Fraw Privacy Policy and this Addendum.

Where applicable U.S. state law treats certain face-containing images, biometric-related information, or sensitive image-processing information as sensitive personal information or biometric information, we process such information only for the purposes described in the Fraw Privacy Policy and this Addendum, and we will obtain consent where required by applicable law.

6. Notice for Illinois, Texas, Washington, and Other Biometric Privacy States

Certain U.S. state laws may regulate the collection, use, storage, disclosure, or retention of biometric identifiers or biometric information.

Fraw’s Service is designed so that Face-Containing Images are processed for user-requested image generation or transformation, not for biometric identification.

Fraw does not knowingly collect, capture, purchase, receive through trade, possess, sell, lease, trade, profit from, or otherwise use biometric identifiers such as scans of hand or face geometry, faceprints, biometric templates, voiceprints, fingerprints, retina scans, or iris scans for biometric identification purposes.

Fraw does not use Face-Containing Images for facial recognition, identity verification, identity matching, account authentication, or creation of biometric templates.

If Fraw materially changes how it processes Face-Containing Images in a way that would require additional notice or consent under applicable biometric privacy laws, we will provide the required notice and obtain any required consent before engaging in that processing.

7. Disclosure of Personal Information

We may disclose personal information to service providers and third parties as described in the Fraw Privacy Policy and this Addendum, including:

• cloud hosting and storage providers;
• AI image-generation or image-processing providers;
• analytics, crash-reporting, and diagnostic providers;
• app stores, payment platforms, and payment processors;
• payout providers where creator withdrawal or payout features are available;
• customer support and communications providers;
• security, fraud-prevention, abuse-prevention, and moderation providers;
• infrastructure, database, monitoring, and operational service providers;
• professional advisers, auditors, legal advisers, or compliance service providers where necessary;
• public users or other users where you publish an extension or otherwise make content or creator information publicly available through the Service;
• government authorities, courts, regulators, law enforcement, or other parties where required or permitted by law.

When you initiate an image transformation, your uploaded image, which may contain a human face, may be transmitted to one or more third-party AI image-generation or image-processing providers where necessary to generate the requested output, perform related safety or abuse-prevention checks, maintain service reliability, or support the requested feature.

We do not authorize third-party AI providers to use Face-Containing Images for unrelated advertising, resale, independent profiling, facial recognition, biometric identification, unrelated model training, or any purpose not described in the Fraw Privacy Policy.

Where supported by the applicable provider terms or service configuration, we require or configure providers to delete or de-identify input images and related Face-Containing Images after processing or after any limited technical, safety, security, abuse-prevention, service-reliability, or legal retention period.

8. Sales, Sharing, Targeted Advertising, and Cross-Context Behavioral Advertising

Fraw does not sell personal information for money.

Fraw does not sell, rent, or trade Face-Containing Images.

Fraw does not share Face-Containing Images for cross-context behavioral advertising, targeted advertising, interest-based advertising, or personalized advertising.

Fraw does not authorize third parties to use Face-Containing Images for advertising, resale, independent profiling, facial recognition, biometric identification, unrelated model training, or sensitive-attribute profiling.

We do not share personal information for cross-context behavioral advertising or targeted advertising unless we provide any legally required notice and opt-out rights.

If we engage in activities that constitute “selling,” “sharing,” or “targeted advertising” under applicable U.S. state privacy laws, we will provide any legally required notices, links, preference controls, and opt-out rights.

9. Analytics, Cookies, SDKs, and Similar Technologies

We may use analytics, diagnostics, crash-reporting, SDKs, cookies, or similar technologies to operate, secure, debug, analyze, and improve the Service.

These technologies may collect information such as device identifiers, app identifiers, usage events, pages viewed, session duration, feature interactions, crash logs, diagnostics, approximate location derived from IP address, and technical metadata.

Where required by applicable law, we will provide notice and choice regarding non-essential analytics, advertising, or similar technologies.

We do not use Google Analytics, Firebase Analytics, or similar analytics tools to process Face-Containing Images for advertising, facial recognition, biometric identification, or sensitive-attribute profiling.

We do not use Face-Containing Images for cross-context behavioral advertising, targeted advertising, or personalized advertising.

10. California Privacy Notice

This section applies to California residents and supplements the rest of this Addendum and the Fraw Privacy Policy.

10.1 Categories of Personal Information Collected

In the preceding 12 months, depending on how users interacted with the Service, we may have collected the categories of personal information listed below.

We do not collect every category from every user.

10.2 Categories of Sources

We collect personal information from:

• you;
• your device, browser, app installation, or use of the Service;
• app stores, payment platforms, and payment processors;
• authentication providers;
• payout providers where applicable;
• service providers that help us operate, secure, support, analyze, or improve the Service;
• other users or public interactions where you choose to publish content or creator information;
• legal, safety, compliance, or fraud-prevention sources where necessary.

10.3 Business or Commercial Purposes

We collect, use, disclose, and retain personal information for the business or commercial purposes described in the Fraw Privacy Policy and this Addendum, including:

• providing and operating the Service;
• account creation and authentication;
• subscriptions, credits, top-ups, and transactions;
• image generation and transformation;
• extension creation, publication, archiving, and moderation;
• creator rewards and withdrawal administration;
• fraud prevention, security, and abuse prevention;
• analytics, debugging, reliability, and improvement;
• customer support and communications;
• legal compliance, audit, accounting, tax, and dispute resolution;
• enforcing our Terms and policies.

10.4 Categories of Personal Information Disclosed for Business Purposes

In the preceding 12 months, we may have disclosed the following categories of personal information for business purposes to service providers, contractors, or other parties described in the Fraw Privacy Policy:

10.5 Sale or Sharing of Personal Information

Fraw does not sell personal information for money.

Fraw does not sell, rent, or trade Face-Containing Images.

Fraw does not share Face-Containing Images for cross-context behavioral advertising.

Fraw does not knowingly sell or share personal information of users under 16 years of age.

If we engage in activities that constitute a “sale” or “sharing” of personal information under California law, we will provide a “Do Not Sell or Share My Personal Information” mechanism or other legally required opt-out method.

10.6 Sensitive Personal Information

We use sensitive personal information only for purposes permitted by applicable law, including:

• providing the Service requested by the user;
• account login and security;
• fraud prevention, security, and abuse prevention;
• payment, transaction, or payout-related processing where applicable;
• user-requested image generation and transformation;
• compliance with law;
• safety, moderation, dispute resolution, and enforcement of our Terms.

We do not use sensitive personal information to infer characteristics about you, unless permitted by law or with your consent where required.

We do not use Face-Containing Images to infer sensitive attributes, including race, ethnicity, religion, health status, sexual orientation, or similar sensitive characteristics.

10.7 Retention

We retain personal information as described in the Fraw Privacy Policy. Retention periods vary depending on the type of information, purpose of processing, account status, user choices, legal requirements, security needs, fraud-prevention needs, creator-program administration, dispute-resolution needs, backup-retention practices, and operational requirements.

Temporary processing images that are not saved to your account gallery, associated with a saved extension, or otherwise retained as part of an account feature are deleted from active systems within the period described in the Fraw Privacy Policy, unless a longer period is necessary for security, abuse prevention, legal compliance, dispute resolution, technical troubleshooting, enforcement of our Terms, or protection of legal rights.

Creator-program, withdrawal, payout-status, transaction, fraud-prevention, accounting, audit, and compliance records may be retained for the period required or permitted for creator-program administration, withdrawal processing, payout tracking, accounting, audit, fraud prevention, legal compliance, and dispute resolution.

Deleted information may remain in encrypted backups for a limited period until those backups are overwritten or deleted according to our backup retention schedule.

10.8 California Privacy Rights

Subject to applicable law, California residents may have the right to:

• request that we disclose the categories and specific pieces of personal information we have collected about you;
• request information about the categories of personal information collected, sources, purposes, categories of recipients, and categories of information sold, shared, or disclosed;
• request deletion of personal information we collected from you;
• request correction of inaccurate personal information;
• opt out of the sale or sharing of personal information, if applicable;
• limit the use or disclosure of sensitive personal information where applicable;
• not receive discriminatory treatment for exercising privacy rights;
• use an authorized agent to submit a request where permitted by law.

To exercise these rights, contact us using the details in the Privacy Contact section below or use any privacy controls we make available.

We may need to verify your identity before fulfilling a request. We may decline, limit, or delay a request where permitted by law, including where we cannot verify your identity, where fulfilling the request would conflict with legal obligations, tax or accounting requirements, payment or payout processing requirements, fraud-prevention needs, security requirements, creator-program administration, dispute-resolution needs, or the rights and freedoms of others.

10.9 Authorized Agents

California residents may be permitted to use an authorized agent to submit certain privacy requests.

If an authorized agent submits a request on your behalf, we may require proof that you authorized the agent to act for you. We may also require you to verify your identity directly with us or confirm that you provided the authorized agent permission to submit the request.

10.10 California “Shine the Light”

California residents may have rights to request information about certain disclosures of personal information to third parties for their own direct marketing purposes.

Fraw does not disclose Face-Containing Images to third parties for their own direct marketing purposes.

If you have questions about direct marketing disclosures, contact us using the details in the Privacy Contact section below.

11. Other U.S. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state privacy laws. Depending on your state of residence and subject to applicable law, these rights may include the right to:

• confirm whether we process your personal information;
• access personal information;
• correct inaccurate personal information;
• delete certain personal information;
• obtain a copy of certain personal information in a portable format;
• opt out of targeted advertising;
• opt out of the sale of personal information;
• opt out of certain profiling that produces legal or similarly significant effects;
• appeal a decision relating to a privacy request.

To exercise applicable state privacy rights, contact us using the details in the Privacy Contact section below or use any privacy controls we make available.

We will respond to privacy requests in accordance with applicable law. If your state provides a right to appeal and we deny your request, you may appeal our decision by contacting us and stating that you are appealing a privacy-rights decision.

12. Children and Teens

The Service is not intended for children below the age permitted under applicable law to use the Service without parental consent.

We do not knowingly collect personal information from children in violation of applicable law.

We do not knowingly sell or share personal information of users under 16 years of age.

If you believe a child has provided us with personal information unlawfully, please contact us so we can investigate and take appropriate action.

13. Creator Payout and Withdrawal Records

For the global version of the Service, Fraw does not directly collect government identification documents, tax identification numbers, tax forms, or other formal identity-verification or tax records from users as part of the standard account signup, login, creator participation, or withdrawal flow.

Creator payouts may be processed through third-party payout providers, such as PayPal, where available. When you use a third-party payout provider, you may be required to provide payout account information, identity information, tax information, or other compliance-related information directly to that provider. That provider’s collection, use, retention, disclosure, and protection of such information are governed by its own terms, privacy policy, and legal obligations.

Fraw may receive or retain limited information from or about the payout process, such as your Fraw account identifier, creator account status, withdrawal eligibility, withdrawal requests, payout status, payout amount, transaction reference, payout provider identifier, fraud-prevention signals, and related creator-program records.

Creator-program, withdrawal, payout-status, transaction, fraud-prevention, accounting, audit, and compliance records may be retained for the period required or permitted for creator-program administration, withdrawal processing, payout tracking, fraud prevention, accounting, audit, legal compliance, and dispute resolution.

14. International Transfers

Fraw is operated by Untitled Labs Limited, a company based in Hong Kong. We use service providers, infrastructure, and technical systems that may be located outside the United States. As a result, personal information of users located in the United States may be processed, stored, accessed, disclosed, or transferred outside the United States.

The countries or regions where personal information may be processed, stored, accessed, disclosed, or transferred may include Hong Kong, the United States, Japan, Singapore, Canada, Australia, the United Kingdom, member states of the European Economic Area, and other countries or regions where our service providers or their infrastructure operate.

The categories of personal information that may be processed outside the United States may include:

• account information;
• device, technical, diagnostic, usage, and activity information;
• transaction, subscription, top-up, purchase, refund, chargeback, and billing-related information;
• support, complaint, moderation, security, and fraud-prevention records;
• user content, uploaded images, generated content, prompts, and extension assets;
• Face-Containing Images where processed as part of a requested image-generation or image-processing feature;
• creator-program, withdrawal, payout-status, transaction-reference, fraud-prevention, accounting, audit, and compliance records.

We use contractual, technical, organizational, and administrative safeguards designed to protect personal information processed by service providers, including service providers located outside the United States.

15. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in the Fraw Privacy Policy and this Addendum, unless a longer retention period is required or permitted by applicable law.

You may manage certain information directly through account settings or available in-app controls. Account deletion is available in the app. You may delete individual saved images, generated content, and gallery items through available in-app controls.

For saved extensions in your extension library or similar account area, individual deletion may not be available. Saved extensions may instead be archived through available in-app controls. Archiving an extension does not delete the extension or its associated assets.

You may also request account deletion or data deletion by contacting us at hi@fraw.ai.

When you delete your account, we will schedule deletion or de-identification of personal information associated with your account from active systems, subject to the limitations and exceptions described in the Fraw Privacy Policy and this Addendum.

16. Privacy Requests

To make an access, correction, deletion, opt-out, withdrawal-of-consent, portability, appeal, or other privacy request, contact us using the details in the Privacy Contact section below or use any privacy controls we make available.

Depending on your request, we may need to verify your identity before responding or taking action. Verification may require us to match information you provide with information we maintain about you.

We may decline, limit, or delay a request where permitted by applicable law, including where:

• we cannot verify your identity;
• fulfilling the request would conflict with legal obligations;
• fulfilling the request would interfere with security, fraud prevention, or abuse prevention;
• the request would affect creator-program, payout, tax, accounting, audit, or transaction records that we are required or permitted to retain;
• the request would interfere with dispute resolution or enforcement of our Terms;
• the request would affect the rights, privacy, or safety of others;
• an exception under applicable law applies.

17. Non-Discrimination

We will not discriminate against you for exercising privacy rights under applicable law.

This means we will not deny you goods or services, charge you different prices or rates, provide a different level or quality of service, or suggest that you may receive a different price, rate, level, or quality of service because you exercised applicable privacy rights, except where permitted by law.

18. Changes to This United States Addendum

We may update this United States Privacy Addendum from time to time.

If we make material changes, we may provide notice through the Service, by email, on our website, or by other reasonable means, as required by law.

Your continued use of the Service after the updated United States Privacy Addendum becomes effective means you acknowledge the revised Addendum.

19. Privacy Contact

If you have questions, concerns, complaints, or requests regarding this United States Privacy Addendum or our handling of personal information, you may contact us using the details below:

• Untitled Labs Limited
• Address: 20/F, Harbourside HQ, 8 Lam Chak Street, Kowloon Bay, Kowloon
• Support Email: hi@fraw.ai
• Company Registration: 71095371

Depending on the nature of your request, we may need to verify your identity before responding or taking action.