PRIVACY POLICY FOR ARAPLAY
Effective Date: June 2026

1. GENERAL INTRODUCTION AND COMMITMENT TO PRIVACY

Araplay values its community and is deeply committed to safeguarding your personal data and ensuring your digital privacy remains a foundational pillar of our service infrastructure. This Privacy Policy ("Policy") outlines in a transparent and comprehensive manner the legal, technical, and operational practices applied by Axios AB regarding the collection, storage, processing, and protection of personal data originating from your utilization of our website (araplay.se), the creation of a user account, or the installation and use of our software applications across mobile and digital ecosystems (collectively or individually referred to as the "Service").

We invite you to read this document carefully to fully understand your legal rights and our institutional obligations. This Policy is structured in strict compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), as well as applicable national data protection statutes and regulatory frameworks within the Kingdom of Sweden.

2. DATA CONTROLLER AND CONTACT SPECIFICATIONS

The Swedish legal entity Axios AB, duly registered in Sweden under corporate organization number [Insert Org. Nr. here], with its registered business address at [Insert Address here], Sweden (hereinafter referred to as the "Company", "we", "us", or "our"), operates as the Data Controller responsible for the processing of your personal data under this Policy.

To guarantee the highest standards of data compliance and rights management, the Company maintains an independent data protection function. For any compliance inquiries, verification requests, or to exercise your statutory data rights, you may contact our dedicated team directly at: privacy@araplay.se.

3. ELIGIBILITY CRITERIA AND HOUSEHOLD PROFILE MANAGEMENT

3.1 Age Requirements: To access the Service, establish an active account, or initiate any premium subscription tiers within Araplay, users must be at least eighteen (18) years of age. The Service does not permit direct registration or deployment by individuals below this statutory age threshold.

3.2 Household and Family Usage: Where parents or legal guardians configure a shared profile for household entertainment, the primary account holder retains full legal responsibility for all analytical tracking, streams, and operational activities executed via their authorized devices. This includes the implementation of available parental restriction mechanisms to prevent minors from accessing age-inappropriate content streams.

4. CATEGORIES OF PERSONAL DATA COLLECTED AND PROCESSING METHODOLOGIES

The Company restricts its data collection strictly to information necessary for the functional deployment, optimization, and security of the Service. Collected data is classified within the following frameworks:

4.1 Digital Verification and Identity Management (E-Identification): In strict compliance with regional broadcasting guidelines and statutory age-gating mandates enforced within Sweden, the Service utilizes secure electronic identification (BankID) during account initialization or authentication phases. This secure protocol verifies your name, age, and country of residence. To uphold data minimization principles, our backend databases never store your Swedish personal identity number (Personnummer) in plain text; the system retains only a secure, encrypted verification token confirming successful validation.

4.2 Account Configurations and Registration Data: During registration, we securely log your email address, a unique username, and your operational password (which is fully converted via cryptographic one-way hashing algorithms prior to database insertion and remains entirely unreadable to our personnel). We also store local customizations, including your preferred interface language and compiled favorite channel index arrays.

4.3 Technical System Metrics and Device Telemetry: When you interface with the Araplay application via mobile app stores or smart ecosystems, our servers automatically record technical parameters, encompassing:

• Internet Protocol (IP) address.
• Persistent and non-persistent hardware identifiers (including UUID, MAC address, Apple Identifier for Advertisers [IDFA], or Google Play Services Advertising ID depending on your active OS platform permissions).
• Device hardware specifications, vendor brand, and specific model configurations (e.g., Apple iPhone, Android smartphones, Smart TVs).
• Operating system specifications, version builds, and active browser environments.
• Network telemetry metrics, connection classifications (Wi-Fi, 4G, 5G), data throughput speeds, and stream buffering latency diagnostics.

4.4 Geographical Parameters and Distribution Licensing: We parse your IP address to verify your approximate geographical coordinate zone. This operational process constitutes an absolute technical and contractual mandate to enforce digital geo-blocking boundaries. This guarantees that live video distribution and licensed audio-visual content remain strictly restricted within the designated regional boundaries approved for Araplay inside the Nordic region and the European Union.

4.5 Application Performance Data and Consumption Metrics: To optimize video compression matrix pipelines and generate tailored user content suggestions, we log service interaction traces. This telemetry covers: active channel selections, playback start and termination timestamps, cumulative viewing duration, analytical queries executed inside our search index, and application stability crash logs.

5. PLATFORM DISCLAIMER REGARDING MOBILE SYSTEMS AND THIRD-PARTY HARDWARE

Araplay deploys its client software across a diverse range of hardware ecosystems, including application packages distributed via the Apple App Store (iOS/tvOS) and Google Play Store (Android), alongside various native Smart TV operating systems and gaming consoles.

Please be explicitly advised that the operating system providers (such as Apple Inc. and Google LLC) and third-party hardware manufacturers independently operate their own diagnostic analytics and data harvesting frameworks under their respective platform terms and corporate privacy policies. Axios AB maintains no administrative oversight, operational control, or joint legal liability for any background processing, tracking, or platform-level telemetry executed independently by these operating system vendors or hardware ecosystems.

6. PURPOSES AND LEGAL BASES GENERATING DATA PROCESSING

Axios AB processes personal data under clearly established statutory channels defined within Article 6 of the GDPR:

6.1 Performance of a Contract (Article 6.1.b): Administering your profile, delivering seamless live-streaming video streams, processing service configurations, and responding to application troubleshooting requests submitted to customer support.

6.2 Compliance with Legal Mandates (Article 6.1.c): Fulfilling mandatory age-verification checks via electronic systems to ensure child protection compliance, adhering to strict corporate financial audit frameworks under the Swedish Bookkeeping Act, and cooperating with authorized judicial orders or national law enforcement demands.

6.3 Realization of Legitimate Interests (Article 6.1.f): Securing our cloud architecture against malicious cyberattacks, preventing concurrent account abuse or fraudulent streaming activities, enforcing content copyright boundaries via geographical filtering, and evaluating system performance to enhance streaming frame rates and UI responsiveness.

7. DATA DISCLOSURE ARCHITECTURE AND AUTHORIZED RECIPIENTS

Axios AB maintains a strict policy prohibiting the sale, lease, rental, or unauthorized commercial monetization of user data to third-party ad brokers or marketing syndicates. Data transfers are strictly localized to the following authorized entities under absolute confidentiality terms:

7.1 Data Processors and Technical Vendor Ecosystems: We form operational partnerships with specialized third-party providers acting strictly on our behalf (Data Processors). This includes global cloud hosting partners (such as Amazon Web Services - AWS), Content Delivery Networks (CDNs) optimized for video routing, application diagnostic tools, and secure e-ID integration APIs. All such entities are bound by strict Data Processing Agreements (DPAs / PUB-avtal) prohibiting autonomous data manipulation and mandating adherence to industry-standard digital security frameworks.

7.2 Legal Framework Enforcement: We may share targeted data with regulatory institutions, judicial tribunals, or police authorities within Sweden if legally compelled to investigate contractual breaches, software piracy, or to secure the physical and digital safety of Axios AB and its user community.

8. REGIONAL STORAGE ARCHITECTURE AND LOCALIZATION

Axios AB enforces a strict and absolute localization protocol: all personal data harvested from users of the Araplay platform is stored and processed exclusively on secured, heavily encrypted server instances physically located within the boundaries of the European Union (EU) and the European Economic Area (EEA). The Company explicitly guarantees that it does not route, transfer, or store user records within any global jurisdictions classified as "Third Countries" outside this secure European legal zone, ensuring your data remains permanently shielded by unified European privacy standards.

9. DATA RETENTION THRESHOLDS AND AUTOMATED PURGING

The Company limits the lifecycle of personal data to the minimum timeframe required to fulfill operational purposes or satisfy statutory audit laws. The following purging cycles are applied:

9.1 Inactive Profile Deletion: If a user ceases application authentication and the profile remains entirely dormant for a continuous block of forty-eight (48) months (4 years), Axios AB will automatically execute a permanent database purge of the profile and all associated telemetry, or convert the data into an irreversible, completely anonymous format (Anonymization) that can never be re-linked to your personal identity.

9.2 Financial and Auditing Records: All invoicing documentation, transaction logs, and subscription payment records are preserved for a duration of seven (7) to eight (8) years following the closure of the fiscal year in which the transaction concluded, satisfying explicit obligations under Swedish accounting statutes.

9.3 Transient Diagnostic Logs: Temporary network traffic logs, server communication handshakes, and application error traces are completely erased within a maximum timeline of ninety (90) days from generation.

10. CRYPTOGRAPHIC AND ORGANIZATIONAL SECURITY CONTROLS

In full compliance with Article 32 of the GDPR, Axios AB maintains robust security countermeasures designed to mitigate risk vectors associated with unauthorized access, alterations, data leaks, or accidental loss. These controls encompass:

• Full end-to-end encryption of sensitive variables during transit (SSL/TLS protocols) and at rest within secure database systems (AES-256 standard).
• Granular Access Control Matrices limiting database access exclusively to credentialed Axios AB staff whose core duties mandate data interaction.
• Systematic backup redundancy schedules and automated penetration testing across our cloud perimeters.

11. YOUR STATUTORY DATA RIGHTS UNDER THE GDPR

As the owner of your personal data, European regulations grant you powerful mechanisms that you can activate free of charge at any time by contacting our privacy desk at privacy@araplay.se:

• Right of Access: The right to demand confirmation and receive a structured readout copy of the personal data currently undergoing processing.
• Right to Rectification: The right to compel the immediate correction of inaccurate or incomplete variables tied to your profile.
• Right to Erasure ("The Right to be Forgotten"): The right to request the total deletion of your profile data from our databases when legal conditions are met (such as account decommissioning).
• Right to Restriction: The right to temporarily freeze data processing operations while the accuracy of your records is being validated.
• Right to Data Portability: The right to export your core data profile in a structured, machine-readable digital layout for transmission to an alternative vendor ecosystem.
• Right to Object: The right to contest processing activities resting on our "Legitimate Interests" framework. Upon activation, we will immediately freeze processing unless overwhelming, mandatory legal bases override your individual freedoms.

12. COGNITIVE TRACKING AND LOCAL STORAGE COOKIE POLICIES

Araplay relies on cookies and platform-specific Local Storage mechanisms to stabilize app authentication and secure interface performance. These variables are split into:

• Strictly Necessary Assets: These are technically essential to maintain profile state, authenticate secure logins, and allow video stream decryption. The application cannot function if these are blocked.
• Functional Customization Assets: Used to cache local UI preferences, volume choices, interface languages, and your exact timestamp position inside a video feed.

You can modulate these settings inside your mobile operating system or web browser, with the understanding that blocking core assets will impair video playback.

13. SYSTEMATIC AND REGULATORY POLICY UPDATES

Axios AB preserves the right to alter, modify, or update this Privacy Policy at any time to reflect changing system technicalities, updated mobile platform policies, or legal adjustments introduced by national bodies. If we execute structural changes affecting your individual data rights, we will provide advanced notice through a mandatory push alert in the Araplay app interface or via an electronic message routed to your registered email address.

14. REGULATORY REGISTRATION AND THE RIGHT TO LODGE COMPLAINTS

If you hold concerns that our data processing steps conflict with established legal frameworks, we encourage you to contact us directly at privacy@araplay.se so we can deploy immediate corrective remedies.

You retain an unalienable statutory right to file a formal grievance with the national data protection supervisory authority inside Sweden, the Swedish Privacy Protection Authority (Integritetsskyddsmyndigheten - IMY), via the following official contact coordinates:

• Website: www.imy.se
• Email: imy@imy.se
• Telephone: +46 (0)8 657 61 00
• Postal Address: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden.