Vietnam Privacy Addendum

This Vietnam Privacy Addendum (the “Vietnam Addendum”) supplements the Fraw Privacy Policy and applies to individuals located in Vietnam who access or use the Fraw mobile application, website, software, official functions, extensions, creator tools, and related services collectively referred to as the “Service.”

The Service is operated by Untitled Labs Limited (“Fraw,” “we,” “us,” or “our”), a company incorporated in Hong Kong.

This Vietnam Addendum should be read together with the Privacy Policy, the Fraw Terms & Conditions, the Creator & Diamonds Policy, and any notices presented through the Service.

Capitalized terms not defined in this Vietnam Addendum have the meanings given in the Privacy Policy or Terms & Conditions.

If this Vietnam Addendum conflicts with the Privacy Policy, this Vietnam Addendum will apply to individuals in Vietnam to the extent required by applicable Vietnamese law.

Nothing in this Vietnam Addendum excludes, restricts, or limits any right or protection that cannot lawfully be excluded, restricted, limited, or waived.

1. Scope and Applicable Vietnamese Law

This Vietnam Addendum provides additional information concerning Fraw’s collection, recording, analysis, storage, alteration, access, retrieval, disclosure, transfer, deletion, destruction, and other processing of personal data in connection with offering the Service to individuals in Vietnam.

Where applicable, Fraw’s processing may be subject to:

• Law No. 91/2025/QH15 on Personal Data Protection;
• regulations and guidance implementing the Personal Data Protection Law;
• Decree No. 13/2023/ND-CP on Personal Data Protection to the extent it remains applicable or is incorporated, amended, replaced, or supplemented;
• the Law on Cybersecurity and its implementing regulations;
• the Law on Data and applicable data-management regulations;
• Decree No. 147/2024/ND-CP concerning the management, provision, and use of internet services and online information;
• laws relating to electronic transactions, consumer protection, telecommunications, information security, digital platforms, electronic commerce, taxation, payments, intellectual property, advertising, child protection, and criminal conduct; and
• other applicable Vietnamese laws, regulations, decisions, directions, standards, and regulatory requirements, as amended, replaced, or supplemented from time to time.

The applicability, scope, commencement, and interpretation of particular duties may depend on:

• the nature and scale of the Service;
• the categories of personal data processed;
• whether personal data is considered basic or sensitive;
• the purposes and effects of processing;
• whether users publish or distribute information publicly;
• Fraw’s establishment and operations;
• the activities and locations of service providers;
• regulatory classification of the Service; and
• the requirements in force at the relevant time.

For purposes of applicable Vietnamese personal-data law:

• Fraw may act as a Personal Data Controller where it determines the purposes and means of processing personal data;
• Fraw may act as a Personal Data Controller and Processor where it both determines and carries out processing;
• you may be referred to as a Data Subject; and
• service providers processing personal data on Fraw’s behalf may act as Personal Data Processors or in an equivalent service-provider capacity.

2. Application to Fraw Outside Vietnam

Fraw is established outside Vietnam.

Applicable Vietnamese personal-data, cybersecurity, internet-platform, or electronic-information laws may apply to processing carried out outside Vietnam where the processing:

• concerns individuals located in Vietnam;
• relates to goods or services provided to users in Vietnam;
• involves personal data collected from Vietnam;
• affects users or activities in Vietnam;
• involves cross-border provision of online information or digital services; or
• otherwise falls within the territorial or extraterritorial scope of applicable Vietnamese law.

Nothing in this Vietnam Addendum means that Fraw:

• is incorporated in Vietnam;
• maintains a permanent establishment in Vietnam;
• has an office in Vietnam;
• stores all Vietnamese user data in Vietnam;
• has appointed a local representative for every legal purpose;
• is classified as a social network or another particular regulated platform; or
• has completed every registration, filing, licence, notification, appointment, or approval that may become applicable.

Where Fraw determines that a registration, filing, local representative, responsible contact, local-storage arrangement, licence, notification, or other regulatory step is required, Fraw may take the steps it considers necessary to comply.

Fraw may restrict, delay, suspend, or discontinue the Service or particular functions in Vietnam while assessing or implementing a legal or regulatory requirement.

3. Personal Data We Process

We may process the categories of personal data described in the Privacy Policy, including the categories below.

3.1 Account and Profile Information

This may include:

• name;
• username;
• display name;
• creator name;
• profile information;
• email address;
• phone number where supported or required;
• account identifier;
• authentication information;
• Apple or Google login information;
• subscription tier;
• account status;
• account preferences;
• country or region;
• age or eligibility information where required;
• publication or creator status; and
• other information connected with your account.

3.2 Device and Technical Information

This may include:

• device type;
• operating system;
• application version;
• browser type;
• language setting;
• time zone;
• IP address;
• approximate location derived from IP address;
• device identifiers;
• application identifiers;
• app-installation or app-instance identifiers;
• network information;
• session information;
• timestamps;
• crash logs;
• diagnostic information;
• performance information;
• error reports;
• security logs; and
• fraud-prevention signals.

3.3 Usage and Activity Information

This may include information about:

• screens or pages viewed;
• functions used;
• buttons selected;
• generation requests;
• session duration;
• subscription activity;
• credit use;
• top-up activity;
• official-function use;
• extension creation and use;
• publication activity;
• creator activity;
• Diamond activity;
• referral activity;
• reports and complaints;
• moderation activity;
• account deletion activity; and
• other interactions with the Service.

3.4 Transaction and Subscription Information

This may include:

• subscription status;
• plan type;
• purchase date;
• top-up purchase;
• renewal status;
• cancellation status;
• transaction identifier;
• payment-provider identifier;
• refund status;
• chargeback status;
• currency;
• entitlement information;
• limited billing information received from an app store or payment provider; and
• records required for accounting, fraud prevention, dispute resolution, or legal compliance.

Where transactions are processed by Apple, Google, or another payment provider, Fraw generally does not directly receive complete payment-card information.

3.5 User Content and Generated Content

This may include:

• prompts;
• text;
• instructions;
• images;
• photographs;
• files;
• reference materials;
• original input images;
• generated images;
• transformed images;
• generated Output;
• gallery content;
• extension assets;
• extension titles and descriptions;
• thumbnails;
• before-and-after images;
• generated examples;
• configurations;
• publication data;
• moderation information; and
• other content submitted to or generated through the Service.

3.6 Creator and Reward Information

This may include:

• creator eligibility;
• creator profile information;
• extension-publication status;
• extension activity;
• Diamond records;
• qualifying and non-qualifying usage;
• withdrawal requests;
• payout status;
• payout amount;
• payout-provider identifier;
• transaction reference;
• verification status;
• fraud-prevention signals;
• tax or compliance status received from a provider where applicable; and
• communications relating to creator, withdrawal, or payout functions.

3.7 Support, Complaint, Moderation, and Enforcement Information

This may include:

• customer-support requests;
• privacy requests;
• content complaints;
• intellectual-property complaints;
• image-rights complaints;
• child-safety reports;
• security reports;
• user reports;
• grievance records;
• investigation information;
• moderation decisions;
• enforcement actions;
• correspondence;
• evidence provided by users; and
• records relating to legal or regulatory requests.

3.8 Phone Verification Information

Where Vietnamese law, platform classification, safety requirements, or Fraw’s regional rules require phone-number authentication before a user may publish, post, share, distribute, comment on, or otherwise make information publicly available, Fraw may process:

• telephone number;
• country calling code;
• verification status;
• verification timestamp;
• verification-provider reference;
• one-time-password status;
• failed verification attempts; and
• related security or fraud-prevention information.

Fraw may use a third-party verification provider to perform phone-number verification.

Availability of Apple or Google login does not guarantee that third-party login alone will satisfy all requirements applicable to public publication or sharing in Vietnam.

3.9 Face-Containing Images

We may process Face-Containing Images and related non-identifying image-processing information as described in Section 3 of the Privacy Policy.

Fraw does not create or store:

• biometric templates;
• faceprints;
• face-geometry scans;
• facial-recognition profiles; or
• biometric identifiers

from Face-Containing Images.

Fraw does not use Face-Containing Images to:

• identify you as a real-world person;
• verify your identity;
• authenticate your account;
• perform facial recognition;
• match your identity against another database;
• infer sensitive personal characteristics; or
• create a biometric identification profile.

An ordinary photograph containing a face is not necessarily processed by Fraw as biometric data.

Where an image, information derived from an image, or the manner of processing qualifies as sensitive personal data under applicable Vietnamese law, Fraw will apply any additional consent, notice, security, impact-assessment, retention, transfer, or other safeguards required by law.

4. Basic and Sensitive Personal Data

Vietnamese law may distinguish between basic personal data and sensitive personal data.

Depending on the circumstances, sensitive personal data may include information concerning:

• political or religious views;
• health or medical information;
• racial or ethnic origin;
• genetic characteristics;
• biometric characteristics used for identification;
• sexual life or orientation;
• criminal allegations or records;
• financial-account or payment information;
• precise location;
• children;
• communications;
• authentication credentials;
• government identifiers; or
• other legally protected matters.

Fraw does not request that users include sensitive personal data in prompts, profiles, images, extensions, support messages, or other User Content unless the information is reasonably necessary for an available function and Fraw has provided an appropriate method for submitting it.

You should not submit:

• government identity documents;
• complete payment-card information;
• medical records;
• tax records;
• passwords;
• bank-account credentials;
• authentication codes; or
• other highly sensitive information

unless Fraw specifically requests it through an approved secure process.

Where Fraw processes sensitive personal data, Fraw may apply additional:

• notices;
• consent requirements;
• access restrictions;
• encryption;
• processing-impact assessments;
• cross-border transfer assessments;
• retention restrictions;
• security controls;
• deletion procedures; and
• regulatory filings or records

where required by applicable law.

5. Sources of Personal Data

We may collect personal data:

• directly from you;
• automatically when you access or use the Service;
• from Apple, Google, or another authentication provider;
• from Apple App Store, Google Play, or another app store;
• from payment processors;
• from payout providers;
• from phone-verification providers;
• from cloud-hosting and storage providers;
• from AI image-generation and image-processing providers;
• from analytics, diagnostics, and performance providers;
• from security, fraud-prevention, and moderation providers;
• from customer-support and communication providers;
• from another user who submits content, a complaint, or a report concerning you;
• from public authorities;
• from professional advisers; and
• from other sources described in the Privacy Policy or disclosed to you.

If you provide personal data relating to another person, including an image containing another person’s face, you are responsible for ensuring that you have the consent, permission, authority, release, or other lawful basis required to:

• provide that information to Fraw;
• request the relevant AI or image processing;
• store the information;
• include it in an extension;
• publish it where applicable; and
• permit other users to process it through an extension where applicable.

6. Purposes of Processing

We may process personal data for the purposes described in the Privacy Policy and this Vietnam Addendum.

6.1 Providing and Operating the Service

We may process personal data to:

• create and manage accounts;
• authenticate users;
• verify users where required;
• secure accounts;
• provide subscriptions;
• manage credits and top-ups;
• process generation requests;
• return generated Output;
• save gallery content;
• provide Rebuild, Blend, and official functions;
• enable private extensions;
• enable Published Extensions where available;
• operate creator and Diamond functionality;
• provide account and transaction history;
• provide customer support; and
• maintain the availability and functionality of the Service.

6.2 AI and Image Processing

We may process personal data to:

• receive prompts, images, files, and instructions;
• transmit submitted content to relevant AI service providers;
• generate or transform content;
• return requested Output;
• maintain technical reliability;
• troubleshoot failed generation;
• conduct safety and moderation checks;
• prevent fraud and abuse;
• enforce applicable policies; and
• comply with legal requirements.

6.3 Transactions and Billing

We may process personal data to:

• verify subscriptions and purchases;
• provide purchased entitlements;
• process renewals;
• administer cancellations;
• investigate transaction problems;
• process or track refunds;
• respond to chargebacks;
• maintain accounting records;
• prevent payment fraud; and
• comply with consumer, tax, accounting, or payment requirements.

6.4 Creator and Reward Administration

We may process personal data to:

• assess creator eligibility;
• administer extension publication;
• verify creators where required;
• review creator content;
• calculate Diamonds;
• identify eligible or ineligible activity;
• detect self-dealing and manipulation;
• process withdrawal requests;
• track payout status;
• maintain creator and accounting records;
• handle creator disputes; and
• comply with tax, payment, regulatory, and legal requirements.

6.5 Safety, Security, and Fraud Prevention

We may process personal data to:

• protect accounts and systems;
• detect unauthorized access;
• investigate suspicious behaviour;
• detect fraud, spam, bots, abuse, or manipulation;
• moderate prohibited content;
• protect children;
• enforce regional restrictions;
• prevent misuse of credits, rewards, or referrals;
• investigate related accounts or devices;
• maintain system logs;
• respond to security incidents; and
• protect Fraw, users, providers, and third parties.

6.6 Public Information and Platform Compliance

Where users publish or make extensions, images, profiles, descriptions, or other information available to other users, Fraw may process personal data to:

• verify eligibility to publish;
• display public creator information;
• operate publication and discovery functions;
• authenticate accounts where required;
• moderate public content;
• receive and investigate reports;
• comply with content-removal or access-blocking requirements;
• restrict information within Vietnam;
• prevent repeat violations;
• maintain required content or account records; and
• comply with internet-platform and online-information laws.

6.7 Service Improvement

We may process personal data to:

• monitor reliability;
• diagnose errors;
• measure performance;
• understand feature use;
• improve user experience;
• develop and test functions;
• improve safety and moderation;
• improve fraud-prevention systems; and
• maintain service quality.

Where appropriate, we may use aggregated, anonymized, de-identified, or non-face operational information for these purposes.

Fraw does not use Face-Containing Images to train general-purpose artificial-intelligence or machine-learning models, including general-purpose image-generation, facial-recognition, identity-matching, or biometric-identification models, unless Fraw obtains separate consent or another lawful authorization where required by applicable law.

6.8 Communications

We may process personal data to:

• send account notices;
• send transaction confirmations;
• provide subscription or billing information;
• respond to support requests;
• send security alerts;
• provide policy notices;
• communicate regional restrictions;
• respond to complaints;
• provide creator or payout information; and
• send marketing communications where permitted.

6.9 Legal and Regulatory Compliance

We may process personal data to:

• comply with Vietnamese or other applicable law;
• complete or maintain regulatory registrations;
• prepare or maintain processing-impact assessments;
• prepare or maintain cross-border transfer documentation;
• respond to court orders;
• respond to lawful governmental requests;
• respond to regulators or law-enforcement bodies;
• comply with cybersecurity obligations;
• process content-removal requests;
• preserve information;
• establish, exercise, or defend legal claims;
• maintain accounting, tax, and audit records; and
• protect legal rights and public safety.

7. Legal Grounds and Permitted Processing

Where applicable Vietnamese law requires a lawful ground or other authorization for processing, Fraw may process personal data based on one or more of the following:

• your consent;
• performance of an agreement with you;
• provision of a product, service, or function you request;
• processing necessary before entering into an agreement at your request;
• compliance with a legal obligation;
• protection of life, health, or vital interests;
• response to an emergency;
• protection of national security, public order, or public safety where legally applicable;
• prevention, detection, investigation, or enforcement relating to fraud, abuse, security incidents, or unlawful conduct;
• establishment, exercise, or defence of legal rights;
• processing made public by you in accordance with applicable law;
• performance of functions required by competent authorities;
• protection of Fraw, users, providers, or third parties where permitted by law; and
• another lawful ground or exception recognized under applicable Vietnamese law.

Fraw does not necessarily rely on every listed ground for every processing activity.

Where processing is necessary to create or operate your account, complete a transaction, perform a generation you request, maintain security, prevent fraud, comply with law, or enforce the Service, Fraw may rely on a legally permitted ground other than consent where applicable.

8. Notice and Consent

Where Fraw relies on consent, Fraw may request consent through:

• an in-app notice;
• an account screen;
• a website notice;
• a setting;
• a checkbox;
• a button;
• an upload or submission action;
• a cookie or analytics preference tool;
• a phone-verification step; or
• another appropriate affirmative action.

A consent request may identify:

• the categories of personal data involved;
• the purposes of processing;
• the organisations or categories of organisations involved;
• the consequences of giving or refusing consent;
• the processing period;
• how consent may be withdrawn;
• how to contact Fraw;
• potential risks or consequences where required; and
• other information required by applicable law.

Consent to one purpose does not automatically constitute consent to a materially different purpose.

Silence, inactivity, failure to respond, or continued use will not replace express consent where express consent is legally required.

Fraw may maintain records of consent, withdrawal, notices shown, choices made, and the applicable policy version.

8.1 User-Initiated AI Processing

By voluntarily submitting a prompt, image, file, instruction, or other content and initiating an AI-generation, transformation, Rebuild, Blend, or extension-based request, you instruct Fraw to:

• receive and process that content;
• transmit the content to Fraw’s systems;
• transmit the content to relevant service providers;
• perform the requested generation or transformation;
• conduct related technical, safety, security, moderation, debugging, fraud-prevention, or reliability checks; and
• return the requested Output.

This instruction does not authorize Fraw or its providers to use Face-Containing Images for:

• unrelated advertising;
• resale;
• independent profiling;
• facial recognition;
• biometric identification;
• identity matching; or
• unrelated model training.

9. Withdrawal of Consent

Where processing is based on consent, you may withdraw consent using an available:

• account control;
• privacy setting;
• cookie preference control;
• device setting;
• unsubscribe link;
• website control;
• in-app control; or
• support channel.

You may also email hi@fraw.ai with the subject line “Vietnam Privacy Request.”

Withdrawal of consent:

• does not affect processing lawfully carried out before withdrawal;
• does not require deletion where retention is required or permitted by law;
• does not affect processing based on another lawful ground;
• may prevent Fraw from continuing to provide a feature; and
• may result in restriction or termination of a function where the relevant personal data is necessary to provide it.

Where required by applicable law, Fraw will process withdrawal requests within the applicable period and make withdrawal reasonably accessible.

10. Face-Containing Images and AI Processing

The Service may allow you to upload, capture, edit, transform, rebuild, blend, save, publish, or otherwise process images containing human faces.

The collection, purposes, sharing, storage, security, retention, and deletion of Face-Containing Images are described in Section 3 of the Privacy Policy.

When you initiate an image-generation or transformation request:

• Fraw may transmit the submitted image and related prompt or instruction to one or more AI image-generation or image-processing providers;
• processing may occur outside Vietnam;
• providers may process information to provide the requested Output;
• providers may process limited information for technical, safety, security, debugging, abuse-prevention, reliability, or legal purposes permitted under their applicable terms and service configuration;
• provider retention may vary according to provider terms and technical settings;
• Fraw does not authorize providers to use information for unrelated advertising, resale, facial recognition, biometric identification, identity matching, independent profiling, or unrelated model training; and
• Fraw may use more than one provider or route requests between providers for reliability, availability, quality, safety, or operational reasons.

You must not submit an image or personal data relating to another person unless you have the rights, permissions, consent, authority, release, or other lawful basis necessary to do so.

11. Personal Data Relating to Other People

If you submit, save, or publish personal data relating to another person, you represent that you are authorized to provide the data and request the relevant processing.

This may include:

• a photograph;
• a group photograph;
• a reference image;
• a likeness;
• a name;
• a creator asset;
• an extension example;
• a before-and-after image; or
• other information relating to another person.

You must not submit or publish personal data in violation of:

• privacy rights;
• image or personality rights;
• confidentiality obligations;
• intellectual-property rights;
• child-protection law;
• personal-data law;
• contractual restrictions; or
• other applicable rights.

Fraw may remove, restrict, preserve, or disclose content where reasonably necessary to investigate a complaint, enforce applicable policies, protect another person, or comply with law.

12. Service Providers and Other Recipients

We may disclose or make personal data available to the categories of recipients below.

12.1 Cloud Hosting and Storage Providers

These providers may store or process:

• account information;
• uploaded content;
• generated content;
• gallery content;
• extension assets;
• transaction information;
• logs;
• backups; and
• other Service data.

12.2 AI Providers

AI image-generation and image-processing providers may process:

• prompts;
• uploaded images;
• reference images;
• instructions;
• related technical information; and
• generated Output.

12.3 Authentication and Verification Providers

Apple, Google, phone-verification providers, or other authentication providers may process information necessary to authenticate or verify an account.

12.4 App Stores and Payment Providers

Apple App Store, Google Play, payment processors, and other billing providers may process information relating to:

• subscriptions;
• purchases;
• renewals;
• cancellations;
• refunds;
• chargebacks;
• entitlements; and
• payment compliance.

12.5 Payout Providers

Where creator payout functionality is available, a payout provider may process:

• identity information;
• tax information;
• payment-account information;
• bank or financial information;
• compliance information;
• sanctions information;
• withdrawal requests; and
• payout transactions.

A payout provider may collect this information directly under its own terms and privacy policy.

12.6 Analytics and Performance Providers

These providers may process:

• device information;
• app activity;
• usage information;
• event information;
• performance information;
• crash reports;
• diagnostic data; and
• app-instance identifiers.

Fraw does not intend to provide analytics providers with uploaded Face-Containing Images, generated images, complete prompts, extension reference images, complete payment information, or private support-message content unless separately disclosed and lawfully authorized.

12.7 Safety, Security, and Moderation Providers

These providers may process limited information to:

• detect prohibited content;
• investigate fraud;
• prevent abuse;
• secure accounts;
• respond to security incidents;
• identify spam or bots; and
• support policy enforcement.

12.8 Support and Communication Providers

These providers may process:

• contact information;
• support communications;
• complaint records;
• notification information; and
• account-related messages.

12.9 Professional Advisers

We may disclose information to:

• lawyers;
• accountants;
• auditors;
• insurers;
• consultants;
• compliance advisers; and
• other professional advisers.

12.10 Corporate Transactions

We may disclose information in connection with:

• a merger;
• acquisition;
• financing;
• restructuring;
• asset sale;
• insolvency;
• investment transaction; or
• similar corporate event.

12.11 Public Authorities

We may disclose information to:

• courts;
• regulators;
• law-enforcement agencies;
• cybersecurity authorities;
• consumer-protection bodies;
• personal-data protection authorities;
• telecommunications or online-information authorities;
• tax authorities;
• ministries; and
• other competent authorities,

where required or permitted by law.

Fraw does not sell personal data.

Fraw does not authorize personal data to be used for unrelated cross-context behavioural advertising unless Fraw provides any notice, consent mechanism, opt-out, or other choice required by applicable law.

13. Personal Data Processors

Where a provider processes personal data on Fraw’s behalf, Fraw may require the provider to be subject to appropriate:

• contractual obligations;
• confidentiality duties;
• data-processing instructions;
• security requirements;
• retention restrictions;
• access controls;
• platform terms;
• technical safeguards;
• audit or review rights; or
• legal obligations.

The precise safeguards may vary depending on:

• the provider;
• the service;
• the information involved;
• the processing location;
• available provider terms;
• technical configuration; and
• applicable law.

Fraw may replace, add, or remove providers from time to time.

14. Personal Data Processing Impact Assessments

Where required by applicable Vietnamese law, Fraw may prepare, maintain, update, and submit or make available a personal-data processing impact-assessment dossier or equivalent compliance record.

Such documentation may include information concerning:

• Fraw’s identity and contact details;
• processing purposes;
• categories of personal data;
• categories of data subjects;
• recipients and processors;
• processing activities;
• retention periods;
• security measures;
• risk assessments;
• measures designed to reduce or control risks;
• rights-request procedures;
• breach-response measures;
• cross-border transfers; and
• other information required by law.

Fraw may update the documentation where:

• processing activities change;
• new data categories are introduced;
• new providers are used;
• processing purposes change;
• new technologies are implemented;
• legal requirements change; or
• regulators request an update.

15. International Transfers and Processing Outside Vietnam

Fraw is established in Hong Kong and uses providers, infrastructure, and technical systems that may operate outside Vietnam.

Personal data relating to users in Vietnam may be transferred to, stored in, accessed from, or otherwise processed in:

• Hong Kong;
• Singapore;
• the United States;
• Japan;
• Korea;
• countries in which Fraw’s providers operate; and
• other countries or regions reasonably necessary to provide or support the Service.

The information transferred may include:

• account and authentication information;
• phone-verification information;
• device and technical information;
• usage and diagnostic information;
• transaction and subscription information;
• support and complaint records;
• prompts;
• uploaded images;
• Face-Containing Images;
• generated content;
• extension assets;
• creator and Diamond records;
• payout-status information;
• fraud and security records; and
• other information described in the Privacy Policy.

We may transfer personal data outside Vietnam where reasonably necessary to:

• provide the Service;
• process generation requests;
• maintain accounts;
• store content;
• process transactions;
• provide support;
• secure the Service;
• moderate content;
• prevent fraud;
• operate creator functions;
• maintain regulatory compliance;
• comply with law; and
• protect legal rights.

Where required by applicable Vietnamese law, Fraw may take measures such as:

• preparing a cross-border transfer impact-assessment dossier;
• identifying exporters, importers, processors, and recipients;
• documenting the purposes and categories of transferred data;
• assessing risks to data subjects;
• entering into data-processing or transfer terms;
• applying contractual safeguards;
• obtaining consent where required;
• conducting provider due diligence;
• implementing access controls;
• using encryption in transit;
• using encryption at rest where supported;
• maintaining transfer records;
• limiting provider instructions;
• submitting, notifying, updating, or making documentation available to a competent authority;
• maintaining a local or replicated copy where required;
• restricting a provider or transfer route;
• suspending a transfer; or
• using another legally recognized safeguard or mechanism.

No statement in this Vietnam Addendum guarantees that personal data will be stored exclusively in Vietnam.

16. Cross-Border Transfer Impact Assessments

Where legally required, Fraw may prepare, maintain, review, update, submit, or make available a cross-border personal-data transfer impact-assessment dossier or equivalent documentation.

The documentation may include:

• Fraw’s identity and contact details;
• the identity of exporters, importers, processors, and other recipients;
• the purposes of transfer;
• categories of personal data transferred;
• categories of data subjects;
• transfer methods;
• destination countries or regions;
• processing and storage locations;
• retention periods;
• onward-transfer arrangements;
• provider safeguards;
• potential risks;
• measures to reduce or control risks;
• procedures for handling data-subject rights;
• procedures for handling breaches;
• contractual documents; and
• other information required by law.

Fraw may restrict or discontinue a transfer route where:

• required documentation cannot be completed;
• a provider does not provide adequate information;
• a provider’s retention or training practices are incompatible with Fraw’s policies;
• a competent authority orders or requires suspension;
• applicable safeguards cannot be maintained; or
• continued transfer creates unacceptable legal, security, or operational risk.

17. Data Localization and Local Presence

Fraw does not generally promise that all personal data relating to Vietnamese users will be stored in Vietnam.

However, Fraw may:

• maintain selected data in Vietnam;
• maintain a local or replicated copy of specified information;
• use a Vietnamese hosting or service provider;
• maintain local compliance documentation;
• maintain regulatory-registration information;
• maintain complaint or content-removal records;
• maintain local contact information;
• establish or appoint a local office, representative, or responsible person;
• restrict transfers of particular data; or
• apply another localization or local-presence measure,

where required by applicable law, a competent authority, or Fraw’s compliance arrangements.

Fraw may restrict, suspend, or discontinue the Service or particular functions in Vietnam if a local-storage, local-office, representative, registration, or related requirement applies and cannot reasonably be implemented or maintained.

18. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in the Privacy Policy and this Vietnam Addendum, unless a longer period is required or permitted by law.

Retention periods may depend on:

• whether your account remains active;
• whether content is saved;
• whether an extension remains active, archived, published, unpublished, or previously used;
• whether a subscription remains active;
• whether a transaction, refund, or chargeback remains unresolved;
• whether creator or payout activity remains under review;
• whether a complaint, dispute, investigation, or legal matter remains open;
• fraud-prevention requirements;
• cybersecurity requirements;
• moderation requirements;
• tax, accounting, or audit obligations;
• regulatory requirements;
• legal claims;
• governmental requests;
• preservation obligations; and
• backup-retention schedules.

General retention periods and practices are described in Sections 3.6 and 9 of the Privacy Policy.

These include retention relating to:

• temporary processing images;
• gallery images;
• original input images;
• draft extensions;
• private extensions;
• Published Extensions;
• archived extensions;
• unpublished extensions;
• account deletion;
• transaction records;
• creator and payout records;
• fraud records;
• support records;
• moderation records;
• security logs; and
• backups.

19. Deletion, Destruction, Anonymization, and De-Identification

When personal data is no longer reasonably necessary and retention is not required or permitted, Fraw may:

• delete it;
• remove it;
• destroy it;
• anonymize it;
• de-identify it;
• aggregate it; or
• otherwise securely dispose of it.

Deletion from active systems may not result in immediate deletion from:

• encrypted backups;
• disaster-recovery systems;
• legal-preservation systems;
• security records;
• audit records;
• transaction records;
• fraud records;
• content-moderation records; or
• regulatory records.

Backup copies are not ordinarily used for active processing and may remain until overwritten or deleted under applicable backup-retention procedures.

20. Your Rights in Vietnam

Subject to applicable law, identity verification, exceptions, technical feasibility, and relevant provisions being in force, you may have the rights described below.

20.1 Right to Know and Be Informed

You may request information concerning:

• Fraw’s identity;
• categories of personal data processed;
• purposes of processing;
• processing methods;
• recipients or categories of recipients;
• retention practices;
• international transfers;
• potential consequences or risks where required;
• available rights; and
• complaint methods.

20.2 Right to Consent

Where consent is required, you may decide whether to give consent to the relevant processing.

Refusal to consent may prevent Fraw from providing a feature where the relevant personal data is necessary for that feature.

20.3 Right to Access and Obtain a Copy

You may request access to personal data concerning you and, where required by law, obtain a copy in an available or legally required format.

20.4 Right to Correction or Updating

You may request that Fraw:

• correct inaccurate personal data;
• complete incomplete personal data;
• update outdated personal data; or
• otherwise rectify information concerning you.

20.5 Right to Withdraw Consent

You may withdraw consent where processing is based on consent.

20.6 Right to Deletion

You may request deletion of personal data where available under applicable law, subject to lawful retention grounds.

20.7 Right to Restrict Processing

Where provided by applicable law, you may request restriction of particular processing.

20.8 Right to Object to Processing

Where provided by applicable law, you may object to particular processing or request that Fraw stop specified processing.

20.9 Right to Data Portability

Where required by law and technically feasible, you may request that personal data you provided be made available in a structured, commonly used, machine-readable, or interoperable format.

20.10 Rights Concerning Automated Processing

Where applicable law grants a right concerning decisions made solely through automated processing that produce a legal or similarly significant effect, you may request available information, reconsideration, or human review, subject to applicable exceptions.

20.11 Right to Complain, Denounce, or Seek a Remedy

You may submit a privacy complaint or grievance to Fraw.

You may also contact a competent Vietnamese authority, bring a lawful claim, or seek compensation or another remedy where permitted by applicable law.

20.12 Other Rights

You may exercise additional rights provided under applicable Vietnamese law.

21. Duties of Data Subjects

Applicable Vietnamese law may impose duties on individuals in connection with personal-data processing.

You should:

• protect your own personal data;
• provide accurate information where required;
• respect the personal data of others;
• comply with applicable personal-data laws;
• avoid submitting false or misleading requests;
• avoid impersonating another person;
• avoid providing another person’s information without lawful authority;
• cooperate reasonably in preventing and addressing personal-data violations; and
• notify Fraw where you reasonably believe your account or personal data has been compromised.

These duties do not limit your right to make a good-faith complaint or exercise a lawful right.

22. Limits and Exceptions to Rights

Privacy rights are not absolute.

Fraw may decline, limit, defer, or request clarification of a request where permitted by law, including where:

• Fraw cannot reasonably verify your identity;
• Fraw cannot verify your authority to act for another person;
• the request concerns another person’s information;
• fulfilment would adversely affect another person’s rights;
• retention is required or permitted by law;
• information is required for a transaction;
• information is required for tax, accounting, or audit purposes;
• information is required for fraud prevention;
• information is required for security;
• information is required for moderation;
• information is required for creator-program administration;
• information is required for payment or payout processing;
• information is subject to a legal hold;
• information is required to establish or defend a legal claim;
• the request is fraudulent, abusive, excessive, repetitive, or manifestly unfounded;
• disclosure would compromise security, moderation, or fraud-detection systems;
• compliance would violate another legal obligation; or
• another lawful exception applies.

23. How to Exercise Your Rights

You may exercise available rights by:

• using relevant account controls;
• using gallery deletion controls;
• using account-deletion controls;
• using privacy or cookie preference controls;
• contacting Fraw support; or
• emailing hi@fraw.ai with the subject line “Vietnam Privacy Request.”

Your request should include sufficient information for us to:

• identify the relevant account;
• understand the right you wish to exercise;
• identify the information concerned;
• verify your identity or authority; and
• communicate with you.

We may request additional information where reasonably necessary to:

• verify your identity;
• prevent unauthorized disclosure;
• prevent unauthorized deletion;
• locate relevant information;
• determine whether an exception applies; or
• complete the request.

Do not send passwords, complete payment-card information, government identity documents, tax records, biometric information, authentication codes, or other highly sensitive information unless Fraw specifically requests it through an approved secure method.

Where required by applicable law, Fraw will respond within the applicable period.

Response or completion time may depend on:

• identity verification;
• complexity;
• scope;
• the number of systems involved;
• applicable exceptions;
• third-party processing;
• archived information;
• backup systems; and
• technical circumstances.

24. Vietnam Privacy Contact and Complaints

Users in Vietnam may submit privacy-related questions, complaints, requests, or grievances to:

Vietnam Privacy Contact Untitled Labs Limited 20/F, Harbourside HQ 8 Lam Chak Street Kowloon Bay, Kowloon Hong Kong

Email: hi@fraw.ai Suggested subject line: Vietnam Privacy Request

Please provide:

• the email address, phone number, or account identifier connected with your account;
• a description of the request or complaint;
• the relevant date or approximate period;
• any previous support reference;
• the content or extension concerned where applicable; and
• the resolution you are seeking.

Fraw may:

• acknowledge the complaint;
• verify your identity;
• investigate the issue;
• request additional information;
• provide an explanation;
• correct information;
• remove or restrict content;
• take corrective action;
• preserve relevant records;
• decline a request where permitted; or
• refer the matter to another responsible team or provider.

Nothing in this section prevents you from contacting a competent Vietnamese authority where legally permitted.

25. Data Protection Officer, Representative, or Responsible Contact

Where applicable Vietnamese law requires Fraw to appoint a:

• personal-data protection department;
• personal-data protection officer;
• local representative;
• responsible person;
• grievance contact;
• cybersecurity contact;
• online-information contact; or
• other designated official,

Fraw may appoint the relevant role and publish the details through:

• this Vietnam Addendum;
• the Privacy Policy;
• the Service;
• Fraw’s website;
• a regulatory registration;
• an app-store listing; or
• another reasonable method.

Until a separate contact is published, privacy questions may be sent to hi@fraw.ai.

26. Security Safeguards

We use reasonable technical, administrative, and organisational measures designed to protect personal data against:

• unauthorized access;
• unauthorized disclosure;
• unlawful use;
• alteration;
• misuse;
• loss;
• destruction;
• interference; and
• other security risks.

These measures may include, where appropriate:

• encryption in transit;
• encryption at rest where supported;
• authentication controls;
• authorization controls;
• role-based access;
• system logging;
• monitoring;
• vulnerability management;
• security testing;
• incident response;
• backup and recovery;
• access restrictions;
• provider safeguards;
• fraud-detection systems;
• abuse-prevention controls;
• content-safety controls; and
• confidentiality obligations.

No security method, transmission, storage process, or system is completely secure.

Fraw cannot guarantee absolute security.

You are responsible for:

• maintaining the confidentiality of login credentials;
• securing devices used to access Fraw;
• avoiding unauthorized account sharing;
• reviewing suspicious account activity; and
• notifying Fraw promptly if you suspect unauthorized access.

27. Personal Data Breaches

If Fraw becomes aware of a personal-data breach affecting personal data within its control, Fraw may:

• investigate the incident;
• contain the incident;
• take remediation measures;
• preserve relevant records;
• assess affected data and risks;
• notify affected individuals;
• notify a competent Vietnamese authority;
• notify law enforcement or a cybersecurity authority;
• coordinate with providers; and
• provide protective recommendations.

Where required by applicable law, notification may include information concerning:

• the personal data affected;
• when and how the incident occurred;
• the likely or potential impact;
• remediation steps;
• protective steps users may take; and
• contact information.

The timing, form, content, and recipients of notification may depend on:

• applicable law;
• the nature of the incident;
• the information involved;
• the number of people affected;
• risk of harm;
• technical investigation;
• law-enforcement requests;
• security considerations; and
• legal restrictions.

Not every security event constitutes a legally reportable personal-data breach.

28. Cybersecurity and Electronic-System Security

Fraw may process and preserve information in connection with:

• unauthorized system access;
• malware;
• account compromise;
• service disruption;
• fraud;
• scraping;
• automated attacks;
• content abuse;
• manipulation;
• suspicious traffic;
• security vulnerabilities;
• regulatory investigations; and
• other cybersecurity events.

Fraw may disclose information to:

• cybersecurity authorities;
• law-enforcement agencies;
• infrastructure providers;
• app stores;
• payment providers;
• affected users;
• professional advisers; and
• other relevant parties,

where required or permitted by law.

Fraw may retain security logs and related records for the period reasonably necessary to:

• investigate incidents;
• protect the Service;
• comply with law;
• respond to authorities;
• prevent repeat incidents; and
• establish or defend legal claims.

29. Lawful Requests and Regulatory Access

Fraw may receive requests, orders, notices, or inquiries from:

• Vietnamese courts;
• law-enforcement agencies;
• ministries;
• regulators;
• cybersecurity authorities;
• consumer-protection bodies;
• personal-data protection authorities;
• telecommunications or online-information authorities;
• tax authorities; and
• other competent bodies.

Subject to applicable law, Fraw may:

• verify a request;
• seek clarification;
• preserve relevant information;
• disclose personal data;
• provide electronic records;
• provide technical or registration information;
• restrict or remove content;
• block access to content in Vietnam;
• restrict an account;
• restrict a feature;
• cooperate with an investigation;
• challenge an invalid or excessive request; or
• take another legally permitted action.

Fraw will seek to limit disclosures to information reasonably relevant to a valid request, taking into account:

• the authority relied upon;
• the scope of the request;
• privacy and confidentiality obligations;
• technical feasibility;
• user rights;
• public safety; and
• lawful grounds for objection or challenge.

Fraw may be legally prohibited from notifying you about a request, investigation, preservation instruction, disclosure, or enforcement action.

30. Published Extensions and Public Information

The Service may permit eligible users to create, publish, distribute, or make available Published Extensions and other user-generated content.

Depending on applicable Vietnamese law and regulatory classification, Fraw may require additional steps before a user can publish or distribute public information, including:

• Vietnamese phone-number verification;
• identity or account authentication;
• age verification;
• acceptance of additional content rules;
• creator verification;
• confirmation of rights and permissions;
• manual or automated review; or
• another legally required measure.

Fraw may restrict public publication while allowing private generation or private extension functions.

Availability of Apple or Google login does not guarantee eligibility to publish public content in Vietnam.

31. Content Reports and User-Generated Content

Fraw may process personal data to:

• receive user reports;
• investigate unlawful or prohibited information;
• investigate false or misleading content;
• investigate intellectual-property complaints;
• investigate unauthorized use of images;
• investigate privacy complaints;
• address child-safety concerns;
• address impersonation;
• address fraud or deceptive content;
• enforce platform rules; and
• respond to lawful content-removal or access-blocking requests.

Information processed may include:

• reporter contact information;
• reported-user information;
• content identifiers;
• extension information;
• account records;
• phone-verification status;
• evidence;
• device information;
• IP addresses;
• transaction information;
• moderation decisions; and
• communications.

Fraw may preserve relevant records after content is removed where reasonably necessary for:

• legal compliance;
• fraud prevention;
• repeat-offender enforcement;
• dispute resolution;
• audit;
• security;
• regulatory reporting; and
• protection of legal rights.

32. Children’s Personal Data

Vietnamese law may impose additional requirements concerning children’s use of digital services and the processing of children’s personal data.

The Service is not intended to be used by a child in Vietnam where applicable law requires:

• parental or guardian consent;
• verification of parental or guardian authority;
• age assurance;
• age verification;
• child-specific notices;
• age-appropriate design;
• restricted profiling;
• restricted advertising;
• restricted publication;
• restricted creator participation;
• child-specific safety controls; or
• another safeguard

that Fraw has not made available.

Where required, Fraw may seek the consent of the child and the child’s parent or legal guardian, taking into account the child’s age and applicable legal requirements.

A parent or legal guardian must not permit a child to use the Service where doing so would violate applicable law or Fraw’s eligibility requirements.

Where Fraw becomes aware that it has unlawfully processed a child’s personal data, Fraw may:

• suspend or restrict the account;
• request information concerning age;
• request information concerning parental authority;
• disable publication;
• disable creator or reward functions;
• disable transactions;
• remove content;
• delete or de-identify personal data;
• preserve information required by law; and
• take other legally permitted action.

Fraw does not knowingly use children’s personal data for:

• targeted advertising;
• unlawful profiling;
• prohibited behavioural monitoring; or
• other prohibited processing.

If you believe that a child has provided personal data to Fraw unlawfully, contact hi@fraw.ai with the subject line “Vietnam Child Privacy.”

33. Automated Systems and Moderation

Fraw may use automated, manual, or hybrid systems to:

• process generation requests;
• detect unsafe or prohibited content;
• identify fraud or manipulation;
• identify spam or automated activity;
• assess creator eligibility;
• calculate Diamonds;
• prioritize moderation;
• protect accounts;
• enforce country restrictions; and
• support cybersecurity.

These systems may:

• flag content;
• reject a generation;
• restrict an extension;
• delay a transaction;
• refer activity for review;
• restrict a creator reward;
• suspend an account; or
• take another automated action.

Where applicable law grants a right concerning a decision based solely on automated processing that produces a legal or similarly significant effect, you may contact Fraw to request available information or review.

Any such right remains subject to:

• identity verification;
• security needs;
• fraud-prevention requirements;
• intellectual-property rights;
• confidential business information;
• applicable exceptions; and
• technical feasibility.

34. Marketing Communications

Fraw may send marketing or promotional communications where permitted by law.

You may opt out of marketing email by:

• using the unsubscribe link; or
• contacting hi@fraw.ai.

Opting out of marketing does not prevent Fraw from sending:

• account notices;
• billing information;
• purchase confirmations;
• security alerts;
• support communications;
• policy updates;
• legal notices;
• service notices;
• regulatory notices; or
• creator and payout communications.

35. Cookies, SDKs, Analytics, and Similar Technologies

Fraw may use:

• cookies;
• local storage;
• mobile SDKs;
• app-instance identifiers;
• device identifiers;
• authentication technologies;
• analytics technologies;
• crash-reporting technologies;
• fraud-prevention technologies;
• security technologies; and
• similar tools.

These technologies may be used for:

• authentication;
• account security;
• user preferences;
• service operation;
• analytics;
• diagnostics;
• performance monitoring;
• fraud prevention;
• abuse prevention; and
• service improvement.

Additional information is available in the Fraw Cookie Policy or any replacement Cookies and Similar Technologies Policy.

Where consent is required for optional analytics, advertising, or similar technologies, Fraw will seek consent through an appropriate notice or preference control.

Where available, you may withdraw or modify analytics consent through the relevant cookie, app, account, browser, or device control.

36. Creator, Diamond, Withdrawal, and Payout Data

If you participate in creator, extension-publication, Diamond, withdrawal, or payout functionality, Fraw may process personal data to:

• assess eligibility;
• authenticate or verify creators;
• administer creator activity;
• review extensions;
• calculate Diamonds;
• determine qualifying activity;
• investigate fraud or self-dealing;
• process withdrawal requests;
• track payout status;
• resolve payout disputes;
• comply with tax requirements;
• comply with accounting and audit obligations;
• maintain regulatory records; and
• enforce the Terms and Creator Policy.

Creator payout and withdrawal functionality may not be available in Vietnam.

The display or accumulation of Diamonds does not guarantee that:

• withdrawal is available in Vietnam;
• a payout provider supports Vietnam;
• a provider will approve your account;
• you satisfy legal or tax requirements;
• you satisfy identity or payment verification;
• a registration or regulatory approval has been completed;
• foreign-exchange or remittance requirements can be satisfied; or
• Diamonds create an immediate or unconditional entitlement to cash.

Where a third-party payout provider is used, that provider may independently collect:

• identity information;
• tax information;
• payout-account information;
• banking information;
• sanctions information;
• source-of-funds information; and
• other compliance information.

That information is governed by the provider’s own terms, privacy policy, and legal obligations.

37. Consumer Transactions

Personal data relating to subscriptions, credits, top-ups, refunds, renewals, cancellations, and app-store transactions may be processed to:

• perform the transaction;
• provide purchased entitlements;
• verify payment status;
• prevent fraud;
• address complaints;
• respond to chargebacks;
• comply with consumer-protection obligations;
• maintain records; and
• establish or defend legal claims.

Where a transaction is processed by Apple, Google, or another provider, that provider acts under its own terms and privacy policy.

38. Regulatory Registration Information

Where Fraw completes or maintains a Vietnamese regulatory registration, filing, notification, appointment, or licence, Fraw may publish or provide information such as:

• Fraw’s legal name;
• country of incorporation;
• registered address;
• registration, filing, or licence number;
• service name;
• website domain;
• application name;
• service category;
• responsible-contact information;
• local representative or contact information where applicable;
• complaint channel;
• cybersecurity contact;
• data-processing information;
• cross-border transfer information; and
• other information required by law.

Publication of regulatory information does not mean that Fraw:

• is incorporated in Vietnam;
• has a permanent establishment in Vietnam;
• maintains a Vietnamese office;
• has appointed a local representative for every legal purpose; or
• provides every feature in Vietnam.

39. Language

This Vietnam Addendum may be made available in English and Vietnamese.

Where a Vietnamese translation is provided, it is intended to improve accessibility, transparency, and understanding.

If there is an inconsistency between language versions:

• the English version will control to the extent permitted by applicable law; and
• the Vietnamese version or mandatory local interpretation will apply to the extent required by applicable Vietnamese law.

The absence of a translation does not waive any mandatory language requirement.

40. Changes to This Vietnam Addendum

Fraw may update this Vietnam Addendum to reflect:

• changes to the Service;
• changes to personal-data practices;
• changes to providers;
• changes to technical systems;
• changes to Vietnamese law;
• regulatory guidance;
• registration or representative requirements;
• cross-border transfer requirements;
• localization requirements;
• account-authentication requirements;
• platform-classification requirements;
• child-protection requirements;
• security or operational requirements; or
• improvements to clarity.

If Fraw makes a material change, Fraw may provide notice:

• through the Service;
• by email;
• on Fraw’s website;
• through an app-store update; or
• by another reasonable method.

The revised Vietnam Addendum will become effective on the date stated at the top.

Your continued use after the effective date means that you acknowledge the revised Vietnam Addendum.

Where additional consent is required by law, continued use alone will not replace that required consent.

41. Contact Us

For questions, concerns, requests, complaints, or grievances concerning this Vietnam Addendum or Fraw’s privacy practices, contact:

Untitled Labs Limited 20/F, Harbourside HQ 8 Lam Chak Street Kowloon Bay, Kowloon Hong Kong

Privacy and Support Email: hi@fraw.ai Suggested subject line: Vietnam Privacy Request Company Registration: 71095371

Where Fraw appoints a Vietnam-specific representative, personal-data protection officer, responsible contact, cybersecurity contact, online-information contact, grievance contact, or other local responsible person, the relevant contact information may be published through:

• this Vietnam Addendum;
• the Privacy Policy;
• Fraw’s website;
• the Service;
• an app-store listing;
• a Vietnamese regulatory register; or
• another reasonable method.

This Vietnam Addendum forms part of the Fraw Privacy Policy.