PRIVACY POLICY

This Privacy Policy explains how QOSMIC CO PTY LTD (ABN 28 667 365 479), trading as X SIREN MEDIA and operating the SirenCY brand ("SirenCY", "we", "us"), handles personal information. We are an Australian company and the entity responsible for your information. For people in the EU or UK, we are the "controller".

It covers:

• visitors to www.sirency.com;
• people who apply to work with us as a creator, chatter, team member or partner;
• creators we manage, and people who book calls, sign agreements, message us or subscribe to our emails;
• people who sign in to the SirenCY dashboard;
• people who click SirenCY tracking links or interact with creator accounts we manage.

This policy is a notice about how we handle information, not a contract.

We follow the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where they apply to you, we also follow the EU and UK General Data Protection Regulation (GDPR) and United States state privacy laws.

We collect only what we reasonably need for the purposes in section 4. Most of it comes from you directly.

Collected automatically

• Analytics: pages viewed, how you arrived, device and browser type, approximate location (city or country, estimated from your IP address) and the steps you take in our application form (for example, which step you reached).
• Session replay: our product analytics tool records how pages are used (clicks, scrolling, page changes and form interactions) so we can find and fix problems. It is not loaded on private creator share links.
• Server and security data: our hosting provider processes your IP address, browser details and request times to deliver the site and block abuse. We read your country from your IP address to show the right application form first; we do not store it.
• Tracking links: when someone clicks a SirenCY tracking link on a creator's promotional page, we record the type of event, the approximate city and country (looked up by the page through ip-api.com), the browser's user agent and a random session ID. We do not collect names through these links.
• Saved form drafts: the application form saves your unfinished answers in your own browser's local storage so you do not lose them. They stay on your device until you submit or clear the form.

From other sources

• Platforms you connect or ask us to manage (such as OnlyFans, Fansly, Fanvue, Instagram and X), which give us account data, earnings and messages.
• Publicly available social media profiles, when we research or contact creators who may be interested in our services.
• People who refer you to us.

If you don't give us information

You can browse the site without telling us who you are. You cannot apply, sign an agreement or be managed anonymously: without your contact and account details we cannot assess your application, pay you or run your accounts. No law requires you to give us information, but we must keep some records (for example for tax) once we work together.

• We collect it only with your consent, which you give by choosing to provide it. Most of these fields are optional, and you can withdraw consent at any time (we may then be unable to continue working with you).
• We use it only to assess your application, plan and manage your work with us, and keep you safe within the boundaries you set.
• We never sell it, never use it for advertising, and share it only as described in section 5.
• Our application forms do not accept photos, videos or identity documents. Please don't send explicit images through our forms, chat widget or email. If you become a creator with us, we set up a private content folder for your files.

• Applications: to assess your application, contact you about it and onboard you if we work together.
• Managing creators: to run the accounts you ask us to manage, plan and post content, chat with fans on your behalf, report on performance, and calculate and pay your share.
• Team members: to recruit, train, schedule and pay our team.
• Agreements and records: to prepare and sign agreements, keep evidence of signature, invoice, and meet tax and accounting duties.
• Communication: to reply to you, send service messages and, if you have subscribed, send marketing emails. Every marketing email has an unsubscribe link.
• Improving the site: to understand how the site and forms are used and fix problems.
• Security and legal: to prevent spam, fraud and abuse, enforce our agreements, and comply with the law.

We use information for another purpose only if it is related to the original purpose and you would reasonably expect it (directly related, for sensitive information), if you consent, or if the law allows or requires it.

Under the creator agreement, we may use content you provide to train our team and, with your approval for public use, in case studies. That licence ends when the agreement ends. We do not use your content or application to train our own AI models.

AI tools and automated decisions

We use AI tools to help our team draft messages and captions, to help score written answers in our chatter certification exam, and, for creators we manage, to produce AI-assisted images and videos from content they provide. When an AI tool scores an exam, it uses your name, contact handle and exam answers, and a team member reviews the result before any decision is made about engaging or certifying you.

We do not make decisions that significantly affect you using only automated means.

We share information only as needed with:

• Our team: staff and contractors, some of them overseas (see section 6), who see only what their role needs. Application summaries are posted to private team channels on Discord so the right people can review them.
• Service providers who process information for us (table below). They may use it only to provide their service to us, under their own terms and privacy policies.
• Platforms: when we run an account for you, we share content and account details with that platform (such as OnlyFans, Fansly, Fanvue, Instagram or X).
• Professional advisers such as accountants and lawyers.
• Authorities when the law requires it, or to protect someone's safety.
• A buyer or successor if our business is sold or restructured, under the same protections.

We may share de-identified or aggregated information that does not identify anyone.

Links to other sites and platforms are governed by their own privacy policies.

We are based in Australia, but most of our service providers store or process data outside Australia. Your information is likely to be disclosed to or stored in:

• the United States, where most of our providers (including Vercel, Clerk, Resend, Google, OpenAI, Discord and PayPal) are based or host data;
• the European Union (for example, Metricool is based in Spain);
• Singapore or China, when creator content is processed by the Kling AI video tool (operated by Kuaishou);
• the Philippines and other countries where our remote team members and contractors work.

Before we disclose information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs: we choose established providers, limit what they receive, and limit team access by role.

EU and UK data: when your data leaves the EU or UK, we rely on an adequacy decision where one exists (for example, for providers certified under the EU-US Data Privacy Framework) or on the Standard Contractual Clauses (and the UK Addendum) that our providers include in their data processing terms. You can ask us for more detail about the safeguard for a particular provider.

We do not use advertising or retargeting cookies. We do not currently show a cookie consent banner. You can control these technologies by:

• blocking or deleting cookies and site data in your browser settings;
• installing the Google Analytics opt-out browser add-on;
• using a browser or extension that blocks analytics scripts.

Blocking strictly necessary cookies may stop sign-in from working. Our site does not change its behaviour in response to "Do Not Track" or Global Privacy Control signals. Because we do not sell or share personal information for advertising, there is nothing for those signals to opt you out of.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:

• encrypted connections (HTTPS) across the site;
• storing platform login details encrypted, with a separate key;
• role-based access, so team members see only what their role needs;
• private file storage with short-lived links for documents such as signed agreements;
• checking the input our forms receive, and verifying that automated messages from our providers are genuine;
• using established providers that encrypt the data they store.

No system is completely secure, so we cannot guarantee security. Please keep your login details private and tell us straight away if you think your account has been misused.

When we no longer need personal information, we delete or de-identify it (see section 10).

If we suspect a data breach, we act quickly to contain it and assess it. Under the Notifiable Data Breaches scheme, if a breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and tell you what you can do to protect yourself.

Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a reportable breach, and notify you without undue delay if the breach is likely to put your rights and freedoms at high risk.

We may keep information longer if the law requires it or if it is needed for a legal claim or dispute. Encrypted backups expire on their normal cycle.

Wherever you live, you can ask us to:

• access the personal information we hold about you (APP 12);
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13);
• delete information we no longer need to keep;
• stop marketing emails at any time, using the unsubscribe link or by emailing us.

Email anyro@sirency.com with the subject "Privacy request". We will confirm your identity before acting, which usually means replying from the email address we already hold. We respond within 30 days. Making a request is free. If we refuse a request, we will tell you why in writing and how to complain. If we refuse to correct something, you can ask us to attach a statement that you believe it is wrong.

Some information cannot be deleted straight away, such as records we must keep for tax, or evidence that an agreement was signed.

If the EU or UK GDPR applies to you, these are our lawful bases:

We respond within one month, which may be extended by two months for complex requests. You can complain to the supervisory authority where you live or work: in the UK, the Information Commissioner's Office; in the EU, your national data protection authority. We would appreciate the chance to resolve your concern first.

Some US state laws, such as the California Consumer Privacy Act (as amended by the CPRA), give residents extra rights. We honour the requests below for all US residents, whether or not a particular law applies to us.

Over the past 12 months, we collected these categories of personal information, from the sources and for the purposes in sections 2 and 4, and disclosed them for business purposes to the recipients in section 5:

• identifiers (name, email, phone, usernames, IP address);
• customer records (contact, address and payout details);
• characteristics of protected classifications (age, and nationality or ethnicity if you share it);
• commercial information (earnings ranges, revenue and payments);
• internet activity (pages viewed and site interactions);
• approximate geolocation (city or country, not precise location);
• audio and visual information (content creators provide);
• professional information (experience and previous agencies);
• sensitive personal information (account login details, sex life, and ethnic origin if you share it).

We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We use sensitive personal information only to provide our services and as the law allows, not to infer characteristics about you.

You can ask to know, access, correct or delete your personal information by emailing anyro@sirency.com. You can use an authorised agent, and we may ask them for proof of authority. We will verify your request and respond within 45 days (extendable by 45 days with notice). If we deny a request, you may appeal by replying to our decision. We will not discriminate against you for exercising these rights.

Creators must confirm they are 18 or older when signing an agreement, and we may ask for an identity document to check. If we learn that we hold information about someone under 18, we will stop any work, delete the information except what we must keep to meet a legal duty, and report to the relevant authorities where the law requires it.

If you believe we hold information about a minor, email anyro@sirency.com straight away.

If you have a concern about how we handled your information, email anyro@sirency.com with the subject "Privacy complaint" and tell us what happened. We will acknowledge your complaint within 7 days and aim to respond in full within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). If you are in the EU or UK, see section 12. Since 10 June 2025, Australian law also lets individuals take legal action for serious invasions of privacy.

We update this policy when our practices or the law change. The effective date and version at the top show the current version. If we make a significant change, we will tell creators and dashboard users by email before it takes effect.

Australian privacy law requires policies to describe automated decision-making from 10 December 2026. Section 4 already does this, and we will update it if our use of automated tools changes.

Effective 5 October 2026. Version 2026-10-05.

© 2026 QOSMIC CO PTY LTD. All rights reserved.