Privacy Policy (Dubai Version - No Tips/Withdrawal)

Effective Date: 27 April 2026

Publisher: NBI NEWS TECHNOLOGY - FZCO (hereinafter referred to as the "Platform"). Regulated by the UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, PDPL) and applicable Dubai data protection regulations. The Platform processes users’ personal data in strict compliance with UAE and Dubai data protection laws and the virtual asset regulations of the Dubai Virtual Assets Regulatory Authority (VARA).

This Policy sets forth the rules governing the collection, use, storage, transfer and protection of users’ personal data by the Platform and informs data subjects of their rights. By clicking the “Agree” button, completing registration, or actually using any of the services, you are deemed to have fully read, understood and accepted all terms of this Policy and agreed to the Platform’s processing of your personal data in accordance with this Policy.

1. Scope and Purpose of Data Collection

The Platform adheres to the principle of “data minimization” and only collects necessary data required for service provision and compliance. Details are as follows:

1.1 Account and Identity Verification Data

Basic registration data: username, email address, encrypted password, mobile phone number. Used for account creation, login verification, security protection and ownership confirmation.
Compliance verification data: For host users, full name and valid ID information. Used for anti-money laundering (AML) checks and host qualification review, in compliance with mandatory user identity verification requirements of VARA.

1.2 Usage Behavior and Device Data

Interaction and content data: live stream viewing history, likes, comments, sharing activities, fan group join and chat records. Used for live stream function optimization, community management and content compliance review to prevent the spread of prohibited information.
Browsing preference data: virtual asset market viewing records, news reading preferences. Used solely for personalized content recommendation (which you may manually disable in your profile) and not for commercial marketing or third-party sharing.
Device and network data: device model, IP address, browser type, operating system version. Used to detect abnormal logins, prevent cyberattacks, troubleshoot service faults and ensure Platform and account security.

1.3 Third-Party Data Inclusion

The news section includes posts and news from Twitter and other third-party platforms by extracting only public information for display. The Platform does not collect personal data of third-party platform users. When you upload original content, only the content itself and necessary publisher identification information are collected for storage, display and compliance review.

2. Lawful Bases for Data Processing

Performance of a contract: Processing is necessary to provide core services including account services, live streaming and content display under the service agreement.
Legitimate interests: Processing is necessary to ensure operational security, prevent fraud and violations, and improve service experience, with impact on user rights outweighed by such legitimate interests (e.g., abnormal login monitoring, account security, troubleshooting).
User consent: For non-essential processing such as personalized recommendations and non-essential third-party data sharing, the Platform obtains explicit consent. You may withdraw consent at any time via your profile, without affecting the lawfulness of prior processing based on consent.
Legal obligation: Processing is necessary to comply with Dubai AML and VARA virtual asset requirements, including mandatory identity data retention for regulatory filing.

3. Data Storage and Security Protection

Storage period: Personal data is retained only for the minimum period necessary to fulfill the purpose of collection. Upon expiration, data will be deleted or anonymized in accordance with applicable laws. Identity verification data is retained for at least the minimum period required by Dubai and VARA regulations to fulfill legal obligations.
Security measures: Technical safeguards including transmission encryption, storage encryption and access control are implemented. A data security emergency response plan is established, with regular security testing and vulnerability remediation.
Cross-border transfer: If cross-border data transfer outside Dubai is required, the recipient must meet the adequacy recognition requirements under the UAE PDPL and Dubai data protection regulations, or data security must be ensured through legitimate mechanisms such as standard contractual clauses. Transfer to jurisdictions without adequate data protection is prohibited.

4. Data Sharing and Disclosure

Third-party service providers: Data is shared only with third parties providing essential services to the Platform, including OKX, CMC (market data providers), AML verification agencies, etc. The Platform signs confidentiality agreements with third parties, limits the scope of data use and conducts regular compliance audits to ensure data security.
Regulatory and legal disclosure: User data may be disclosed in accordance with law upon request from Dubai regulators, VARA, court orders or other valid legal instruments to fulfill legal obligations and protect public interests.
Prohibited acts: The Platform shall not sell, rent or lend user personal data to any unrelated third parties or use such data for purposes outside those specified in this Policy.

5. Data Subject Rights

Right of access: Request to view personal data collected and stored by the Platform and details of its processing.
Right of rectification: Request correction of inaccurate or incomplete personal data.
Right to erasure (right to be forgotten): Request deletion of personal data when the purpose of processing is fulfilled, consent is withdrawn or data is no longer necessary (except where retention is required by law).
Right to restriction: Request suspension of data processing where accuracy is disputed or processing purpose ends but retention is required.
Right to data portability: Request provision of personal data in a structured, commonly used format to facilitate transfer to another service provider.
Right to object: Object to non-essential processing based on legitimate interests (e.g., personalized recommendations). The Platform shall cease such processing unless overriding legitimate grounds apply.

The Platform shall respond to requests to exercise data subject rights within the time limit prescribed by the UAE PDPL and Dubai data protection regulations. Only necessary verification information will be collected to ensure the realization of your rights.

6. Policy Updates and Notices

The Platform may update this Policy to reflect changes in UAE and Dubai laws, VARA regulations or business needs. The updated Policy will be posted in a prominent place in the Platform App (e.g., homepage pop-up, settings page) and take effect automatically after 7 days’ publication. If updates materially affect your data rights, you will be notified in advance via in-app message. Continued use of the Platform’s services after updates constitutes acceptance of the revised Policy.

7. Contact Information and Complaints

Data Protection Officer contact details: Email [Platform Fixed Email], Phone [Platform Fixed Phone]. You may contact us with questions, complaints or to exercise data subject rights, and we will respond promptly. If you are dissatisfied with the outcome, you may lodge a complaint with the UAE data protection supervisory authority.

8. Miscellaneous

This Policy is an integral part of the Platform’s services and has the same legal effect as the User Agreement. Matters not covered herein shall be governed by the UAE PDPL, Dubai data protection regulations and applicable Dubai virtual asset laws.
If any provision of this Policy is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.
No failure or delay by the Platform in exercising any right under this Policy shall constitute a waiver of such right.