01Data Controller and Scope

The data controller responsible for the processing of your personal data within the scope of this Privacy Policy is Zynvora Tech LLC (hereinafter the "Company" or "we"), headquartered in Delaware, United States of America (USA). The fanzu.live, broadza.live, and lovtube brands operated by the Company, together with their associated websites and applications, are collectively referred to as the "Platform" within the scope of this Policy.

This Policy applies to all persons who visit or use the Platform; to everyone in the roles of User (viewer), Broadcaster, Agent (a partner who brings in broadcasters/users), and Administrator. The Platform is intended only for persons aged 18 and over.

By using the Platform, you accept that your personal data is processed in the manner described in this Policy. The Policy should be read together with other documents such as the Terms of Use and the Community Guidelines. In the event of a conflict between these documents on a particular matter, this Privacy Policy shall prevail with respect to data processing activities.

02Data We Collect

In order to provide the services on the Platform, manage your account, and fulfill our legal obligations, we process the following categories of personal data. The scope of the data processed may vary according to the services you use and your role on the Platform.

• Account and identity information: email address, username, password (stored only in hashed/digested form), avatar or profile photo, biography, and account role.
• Financial and transaction information: coin and earnings balance, and payment and transaction records relating to coin purchases, gift sending, and earnings/withdrawal transactions.
• Technical and connection information: IP address, session and log records, device information, and push notification subscription information.
• Communication and interaction data: private message and broadcast chat content, video call metadata (e.g., call duration, parties, timestamp), and follow relationships.
• Security and moderation data: blocking records, complaint and report records, and records relating to moderation actions.

03Methods of Collecting Data

We collect your personal data by various methods, both automated and non-automated. The method of collection differs according to the type of data and the nature of your interaction.

• Directly from you: the information you provide when creating an account, editing your profile, purchasing coin, sending messages, broadcasting, or submitting a support request.
• Automatically: data collected during your use of the Platform through the IP address, session/log records, device information, and cookies and similar technologies recorded by our servers and applications.
• From third parties: payment results and transaction verification information transmitted to us by the payment infrastructure (Stripe, via zynvoratech.com); connection metadata generated through the real-time video/audio and live-streaming infrastructure (Agora).
• From other users: complaint, report, or blocking records submitted about you.

04Purposes of Data Use

We process the personal data we collect only for specific, explicit, and legitimate purposes, in a manner connected with, limited to, and proportionate to those purposes.

• To create your account, verify your identity, and manage your access to the Platform.
• To provide services and carry out transactions, including coin purchases, gift sending, video calls, access to private content/broadcasts, and earnings/withdrawal transactions.
• To process payments, issue invoices, and keep transaction records.
• To ensure the security of the Platform, prevent fraud, abuse, and manipulation, and conduct complaint and moderation processes.
• To fulfill our legal obligations and respond to the requests of competent authorities.
• To provide you with support, deliver important notices, and, subject to your preference, send push notifications.
• To improve our services, understand usage trends, and resolve technical issues.

05Legal Bases (GDPR Article 6)

With respect to users located in the EU/EEA, we process your personal data on the basis of at least one legal ground provided for in Article 6 of the GDPR. More than one basis may apply to a particular processing activity.

• Performance of a contract (Article 6(1)(b)): to manage your account and provide the services you request (coin transactions, broadcasting, video calls, etc.).
• Legitimate interest (Article 6(1)(f)): to ensure the security of the Platform, prevent fraud, and improve our services; provided that such interest is balanced against your fundamental rights and freedoms.
• Legal obligation (Article 6(1)(c)): for legal requirements such as retaining financial records and responding to competent authorities.
• Explicit consent (Article 6(1)(a)): for consent-based processing such as non-essential cookies and marketing push notifications; you may withdraw your consent at any time.
• Protection of vital interests (Article 6(1)(d)): in exceptional cases where it is necessary to protect the vital interests of a person.

06Sharing with Third Parties

We do not sell your personal data. We share your data with the following parties only to the extent necessary, for the purposes of providing our services, fulfilling our legal obligations, and protecting the security of the Platform.

These disclosures are carried out within the framework of contractual arrangements ensuring that the relevant service providers act solely on our behalf and in accordance with our instructions.

• Payment service providers: In coin purchases, payments are processed through the Company's payment infrastructure (Stripe via zynvoratech.com); after successful payment, coin is added to your account. Your card information is processed directly by the payment provider.
• Real-time communication infrastructure: Agora services are used for video/audio calls and live streaming, and the related connection metadata is processed through this infrastructure.
• Hosting and CDN providers: providers supplying infrastructure services for the storage of Platform data and the delivery of content.
• Push notification providers: for the delivery of push notifications subject to your preference.
• Competent authorities and legal requirements: where applicable legislation, a court order, or a legal request so requires, or where necessary to protect our rights.

07International Data Transfer

The Company is headquartered in Delaware, USA, and our service providers may be located in different countries. For this reason, your personal data may be transferred to and processed in countries outside the country where you are located (chiefly the USA). The data protection legislation in such countries may differ from that in your own country.

For transfers made from the EU/EEA and Turkey, we take the necessary measures to provide the appropriate safeguards required by applicable legislation. In this context, to the extent applicable, instruments such as Standard Contractual Clauses are used, and the KVKK's requirements regarding transfers abroad are observed. For detailed information on the legal basis of the transfer, you may contact us at privacy@fanzu.live.

08Cookies and Similar Technologies

The Platform uses cookies and similar technologies (local storage, session identifiers, etc.) for the purposes of maintaining your session, remembering your preferences, ensuring security, and analyzing use of the Platform.

Essential cookies are necessary for the core functions of the Platform to operate, and the service cannot be provided without them. Non-essential (analytics and preference) cookies, on the other hand, we use only on the basis of your consent to the extent applicable. You can manage your cookie preferences from your browser settings or through the tools provided on the Platform; however, disabling certain cookies may affect the functionality of the Platform. All details relating to cookies are explained in this Privacy Policy.

09Retention Periods

We retain your personal data only for as long as necessary for the purpose for which it was processed and for the minimum retention periods prescribed by applicable legislation. In determining the period, the nature of the data, the purpose of processing, and the limitation periods relating to potential legal disputes are taken into account.

If you close your account, we delete or anonymize your account and profile data within a reasonable time. However, financial/payment records, security and anti-fraud records, and data that must be retained pursuant to our legal obligations may continue to be retained for the relevant legal periods. Data whose retention period has expired is securely deleted, destroyed, or anonymized.

10Data Security

We apply reasonable administrative, technical, and physical security measures to protect your personal data against unauthorized access, loss, misuse, and disclosure. These measures include storing passwords only in hashed (digested) form, encryption during transmission, access controls, and regular security reviews.

We remind you that no system or transmission over the internet is one hundred percent secure. For the security of your account, it is important that you use a strong password, do not share your password with anyone, and notify us at destek@fanzu.live when you notice a suspicious situation. In the event of a breach affecting your personal data, we will inform the relevant individuals and competent authorities in the manner and within the timeframes prescribed by applicable legislation.

11Children's Privacy (18+)

The Platform is only for persons aged 18 and over and is not directed at persons under 18. We do not knowingly collect personal data of persons under 18.

The Platform, although it requires adult verification, is not a pornographic platform; explicit sexual content, pornography, and obscene broadcasting are strictly prohibited. If we become aware that data belonging to a person under 18 has been collected, we delete such data without delay. If you believe that data belonging to a minor is being processed, please contact us at privacy@fanzu.live.

12Your Rights Under the KVKK (Turkey)

Users located in Turkey have the following rights regarding their personal data pursuant to the Law No. 6698 on the Protection of Personal Data (KVKK).

• To learn whether your personal data is being processed and, if so, to request information about it.
• To learn the purpose of processing and whether the data is used in accordance with its purpose.
• To know the third parties, domestically or abroad, to whom the data is transferred.
• To request the correction of the data in the event that it has been processed incompletely or incorrectly.
• To request the deletion or destruction of the data within the framework of the conditions provided for in the KVKK.
• To request that correction, deletion, or destruction operations be notified to the third parties to whom the data has been transferred.
• To object to a result arising against you as a result of the analysis of the processed data exclusively by automated systems.
• To claim compensation for the damage in the event that you suffer damage due to the unlawful processing of the data.

13Your Rights Under the GDPR (EU/EEA)

Users located in the EU/EEA have the following rights regarding their personal data pursuant to the GDPR. You may exercise these rights subject to the exceptions in applicable legislation.

• Right of access: to access the personal data processed about you and request a copy of it.
• Right to rectification: to request the correction of incorrect or incomplete data.
• Right to erasure (right to be forgotten): to request the deletion of your data under certain conditions.
• Right to restriction of processing: to request the limitation of the processing activity in certain situations.
• Right to data portability: to receive your data in a structured, commonly used, and machine-readable format, or to request its transfer to another controller.
• Right to object: to object to processing based on legitimate interest and to processing for direct marketing purposes.
• Right to withdraw consent: in consent-based processing, to withdraw your consent at any time, without affecting the lawfulness of past processing.
• Right to lodge a complaint with a supervisory authority: to lodge a complaint with the competent data protection supervisory authority.

14Requests and Applications

To exercise your rights under the KVKK, the GDPR, or this Policy, or to submit your questions regarding our data processing activities, you may contact us at privacy@fanzu.live. In the event that a written notice is required, an application may also be made via [Company mailing address]; however, we recommend contact by email to expedite the process.

In order to assess your application, we may request additional information for the purpose of verifying your identity. We endeavor to conclude your requests free of charge within the periods prescribed by applicable legislation (as a rule, within thirty days at the latest from the request reaching us); however, in the event that the operation requires an additional cost, a fee may be charged on the basis of the tariff specified in the legislation. You may use legal@fanzu.live for legal notices and dmca@fanzu.live for copyright/DMCA requests.

15Changes

We may update this Privacy Policy from time to time. When a change is made, we publish the updated text on the Platform and revise the effective/last-updated date at the beginning of the document. In the event of substantial changes, we will additionally inform you to the extent required by applicable legislation.

Your continued use of the Platform after the changes take effect means that you accept the updated Policy. We recommend that you regularly review the most current version of the Policy. The effective date of this document is August 22, 2026.