PRIVACY POLICY

1.1 About This Policy

This Privacy Policy ("Policy") describes how QOSMIC CO PTY LTD (ABN 28 667 365 479), registered business name X SIREN MEDIA, operating the SirenCY brand (collectively, "SirenCY," "Company," "we," "us," "our") collects, uses, discloses, stores, protects, and processes personal information when you use our website at sirency.com, our dashboard platform, mobile applications, APIs, and all related services (collectively, the "Services").

1.2 Acceptance

BY ACCESSING OR USING OUR SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THE PRACTICES DESCRIBED IN THIS PRIVACY POLICY. If you do not agree to this Policy, you must not use our Services.

1.3 Scope

This Policy applies to:

• All users of our website and Services
• Creators, models, and staff members
• Applicants and prospective users
• Visitors to our website
• Individuals who communicate with us

1.4 Changes to This Policy

We may update this Policy from time to time. Changes are effective immediately upon posting. Your continued use constitutes acceptance of the updated Policy. We encourage you to review this Policy periodically.

2.1 Information You Provide Directly

Account & Profile Information:

• Full legal name, display name, username
• Email address, phone number
• Date of birth (for age verification)
• Profile photos, avatar images
• Government-issued identification documents
• Social media handles and profiles
• Biographical information

Application Information (Creators/Staff):

• Portfolio content (images, videos, samples)
• Previous work experience
• Platform account credentials (with your authorization)
• Performance history and metrics
• References and testimonials

Financial Information:

• Bank account details for payments
• PayPal, Payoneer, or other payment accounts
• Tax identification numbers
• Billing addresses
• Transaction history

Content Data:

• Photos, videos, audio files you upload
• Captions, descriptions, metadata
• Messages and communications through our platform
• Content strategies and plans
• Performance analytics and reports

Communication Data:

• Emails, messages, and correspondence
• Support tickets and inquiries
• Feedback and survey responses
• Phone call recordings (with notice)

2.2 Information Collected Automatically

Device & Technical Information:

• IP address and approximate geolocation
• Device type, model, and manufacturer
• Operating system and version
• Browser type and version
• Unique device identifiers
• Screen resolution and display settings
• Language and timezone preferences

Usage Information:

• Pages viewed and features used
• Time spent on pages and interactions
• Click patterns and navigation paths
• Search queries within our platform
• Login times, session duration, frequency
• Error logs and performance data
• Referring websites and exit pages

2.3 Information from Third Parties

• Platform APIs: Data from OnlyFans, social media, and connected services (with your authorization)
• Payment Processors: Transaction verification and payment status
• Identity Verification: Age and identity verification results from third-party services
• Analytics Providers: Aggregated usage data and insights
• Public Sources: Publicly available information
• Business Partners: Information shared through partnerships

2.4 Sensitive Information

We may collect sensitive information including:

• Government ID for identity verification
• Biometric data for verification (with consent)
• Adult content (for creators in our management program)

We handle sensitive information with enhanced security measures.

3.1 To Provide and Operate Our Services

• Create and manage your account
• Process applications and onboarding
• Manage creator accounts on third-party platforms
• Provide customer support
• Process transactions and payments
• Deliver content and features you request

3.2 To Improve and Develop Our Services

• Analyze usage patterns and trends
• Develop new features and services
• Conduct research and analytics
• Test and optimize performance
• Personalize your experience
• Train machine learning models

3.3 For Business Operations

• Generate invoices and financial reports
• Track performance metrics
• Train staff and develop best practices
• Create case studies and marketing materials (anonymized or with consent)
• Maintain business records

3.4 For Communication

• Send service-related notifications
• Provide performance reports and analytics
• Send marketing communications (with consent)
• Respond to inquiries and requests
• Notify you of changes to our Services or Terms

3.5 For Legal and Security Purposes

• Verify identity and prevent fraud
• Enforce our Terms of Service
• Comply with legal obligations
• Respond to legal requests
• Protect our rights and property
• Ensure the safety and security of our users

3.6 Training and Sample Content

We may use content, strategies, and anonymized data for:

• Training our staff and new team members
• Developing educational materials and best practices
• Creating reference examples for operational use
• Demonstrating service capabilities to potential clients
• Internal quality assurance and process improvement

For users in the EEA, UK, and other jurisdictions requiring a legal basis, we process personal data under:

4.1 Contract Performance

Processing necessary to provide Services you've requested, manage your account, and fulfill our contractual obligations.

4.2 Consent

Where you've given explicit consent, such as for marketing communications, certain data sharing, or optional features. You may withdraw consent at any time.

4.3 Legitimate Interests

Processing necessary for our legitimate business interests, including:

• Fraud prevention and security
• Service improvement and analytics
• Direct marketing to existing customers
• Business administration and operations
• Legal claims and disputes

4.4 Legal Obligation

Processing necessary to comply with laws, regulations, court orders, or legal processes.

4.5 Vital Interests

Processing necessary to protect someone's life or safety in emergency situations.

5.1 Service Providers

We share information with vendors who provide services on our behalf:

• Cloud Hosting: Vercel, Supabase
• Analytics: Google Analytics
• Payment Processing: PayPal, Stripe, Payoneer
• Email Services: Resend
• Authentication: Clerk
• File Storage: Google Drive, Supabase Storage

These providers are contractually bound to protect your data and use it only for specified purposes.

5.2 Platform Integration

With your authorization, we share information with third-party platforms:

• OnlyFans, Fansly, and similar creator platforms
• Social media platforms (Twitter/X, Instagram, TikTok)
• Communication tools (Telegram, Discord)

5.3 Business Partners

We may share information with business partners for joint services or promotional activities, with appropriate safeguards.

5.4 Legal Requirements

We may disclose information when required or permitted by law:

• In response to subpoenas, court orders, or legal processes
• To comply with regulatory requirements
• To cooperate with law enforcement investigations
• To protect our legal rights or those of others
• To prevent fraud or illegal activities

5.5 Business Transfers

In connection with a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred. We will provide notice of any such change.

5.6 Aggregated/Anonymized Data

We may share aggregated or anonymized data that cannot reasonably be used to identify you, for any purpose.

5.7 With Your Consent

We may share information for other purposes with your explicit consent.

6.1 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: TLS/SSL for data in transit; AES-256 for data at rest
• Access Controls: Role-based access with multi-factor authentication
• Monitoring: Continuous security monitoring and intrusion detection
• Auditing: Regular security assessments and penetration testing
• Training: Security awareness training for all staff
• Incident Response: Documented breach response procedures

6.2 Data Breach Response

In the event of a data breach affecting your personal information, we will:

• Notify affected users within 72 hours of discovery (GDPR requirement)
• Notify relevant supervisory authorities as required
• Take immediate steps to contain and mitigate the breach
• Investigate the incident and implement preventive measures
• Provide information about steps you can take to protect yourself

6.3 Your Security Responsibilities

You are responsible for:

• Maintaining the confidentiality of your login credentials
• Using strong, unique passwords
• Enabling two-factor authentication when available
• Notifying us immediately of any unauthorized access
• Keeping your contact information up to date

6.4 No Absolute Security

While we implement robust security measures, no system is completely secure. We cannot guarantee absolute security of your data. You transmit data at your own risk.

7.1 What Are Cookies

Cookies are small text files placed on your device that help us provide and improve our Services. We also use similar technologies like pixels, beacons, and local storage.

7.2 Types of Cookies We Use

Type	Purpose	Duration
Essential	Required for basic functionality, authentication, security	Session / 1 year
Functional	Remember preferences, settings, and choices	1 year
Analytics	Understand usage patterns and improve Services	2 years
Marketing	Deliver relevant advertisements, track campaign performance	90 days

7.3 Third-Party Tracking

We use third-party analytics and tracking services:

• Google Analytics: Website usage analytics
• Google tag (gtag.js): Loads Google Analytics
• Clerk: Authentication

7.4 Managing Cookies

You can control cookies through:

• Browser settings (block, delete, or manage cookies)
• Our cookie consent banner
• Opt-out tools provided by analytics services
• Browser extensions for privacy management

Note: Blocking essential cookies may affect site functionality.

7.5 Do Not Track

Our Services do not currently respond to "Do Not Track" browser signals. You can manage tracking preferences through the methods described above.

Depending on your location, you may have the following rights regarding your personal data:

8.1 How to Exercise Your Rights

To exercise any rights, contact us at:

• Email: anyro@sirency.com or sirenxmedia@gmail.com
• Subject: "Privacy Rights Request"

We will respond within 30 days (or as required by law). We may need to verify your identity.

8.2 Right to Complain

You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

8.3 Limitations

Some requests may be subject to limitations:

• We may retain certain data for legal compliance
• Deletion requests don't affect data already distributed or used per our Terms
• We may require verification of identity
• Excessive or unfounded requests may be refused or charged

9.1 Where We Process Data

Your data may be processed in:

• Australia (our primary location)
• United States (cloud services: Vercel, Supabase)
• European Union (for EU data subjects where applicable)
• Other locations where our service providers operate

9.2 Transfer Safeguards

When transferring data internationally, we implement appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Adequacy decisions where applicable
• Binding Corporate Rules where relevant
• Your explicit consent for specific transfers

9.3 Australia-Specific

We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Cross-border disclosures are made in accordance with APP 8.

10.1 Retention Periods

We retain personal data only as long as necessary:

Data Type	Retention Period
Account Information	Duration of account + 3 years
Application Data (rejected)	12 months from decision
Financial/Tax Records	7 years (legal requirement)
Communication Records	3 years from last interaction
Content Data	Duration of agreement + 1 year
Analytics Data	26 months (Google Analytics default)
Training/Sample Materials	Indefinitely (anonymized)
Legal Hold Data	Duration of legal matter + resolution

10.2 Deletion Process

When data is no longer needed, we:

• Securely delete or destroy the data
• Anonymize data where full deletion isn't feasible
• Remove data from active systems and backups

10.3 Exceptions

We may retain data longer if:

• Required by law or regulation
• Necessary for legal claims or disputes
• Required for legitimate business purposes
• You've consented to extended retention

11.1 No Collection from Minors

We do not knowingly collect, use, or disclose personal information from individuals under 18 years of age. Our Services are not directed at minors.

11.2 Discovery of Minor's Data

If we discover that we have collected personal information from someone under 18:

• We will immediately delete such information
• We will terminate the associated account
• We may report to relevant authorities if required

11.3 Reporting

If you believe we have collected information from a minor, please contact us immediately at sirenxmedia@gmail.com.

12.1 Third-Party Websites

Our Services may contain links to third-party websites, applications, and services. This Privacy Policy does not apply to those third parties. We encourage you to read their privacy policies before providing any information.

12.2 Social Media Features

Our Services may include social media features and widgets. These features may collect information about your interactions and are governed by the privacy policies of those companies.

12.3 Third-Party Integrations

When you connect third-party accounts (OnlyFans, social media, etc.), those services have their own privacy practices that apply.

12.4 No Endorsement

Links to third-party services do not imply endorsement. We are not responsible for their content, privacy practices, or security.

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

13.1 Your California Rights

• Right to Know: Request information about data collected, used, shared, or sold
• Right to Delete: Request deletion of personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out of Sale/Sharing: We do not sell personal information
• Right to Limit Sensitive Data Use: Limit use of sensitive personal information
• Right to Non-Discrimination: We won't discriminate for exercising rights

13.2 Categories of Information Collected

In the past 12 months, we have collected:

• Identifiers (name, email, IP address, device IDs)
• Personal information (financial data, phone number)
• Commercial information (transaction history)
• Internet/network activity (usage data, browsing)
• Geolocation data
• Professional information
• Inferences from the above

13.3 Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information for such purposes.

13.4 Do Not Track

California Business & Professions Code Section 22575 requires disclosure regarding Do Not Track signals. Our Services do not currently respond to DNT signals.

13.5 How to Exercise Rights

California residents may submit requests via:

• Email: anyro@sirency.com or sirenxmedia@gmail.com
• Subject: "California Privacy Request"

We will verify your identity and respond within 45 days.

Contact Information

For questions, concerns, or requests regarding this Privacy Policy:

Data Protection Officer

For GDPR-related inquiries, contact our DPO at: anyro@sirency.com

Response Time

We aim to respond to all privacy inquiries within 30 days.

By using SirenCY's Services, you acknowledge that you have read, understood, and agree to this Privacy Policy.

© 2026 QOSMIC CO PTY LTD. All Rights Reserved.