STORYBITE PRIVACY POLICIES

Effective as of August 20, 2026 (“Effective Date”)

“StoryBite” (or “we”, “us”, and/or “our”) means Aracya Culture & Technology Limited with registered address 3A 42 SMITHFIELD KENNEDY TOWN, HONG KONG.

These Privacy Policies describe how StoryBite, its affiliated and associated entities, as further detailed below (collectively, ‘StoryBite’, ‘we’ and ‘us’) collects, uses, discloses, transfers, stores, retains or otherwise processes your personal data.

These Privacy Policies apply when:

You register a StoryBite account
You use StoryBite’s content and streaming services
You download and/or use StoryBite clients, e.g. StoryBite mobile applications, websites or other technical interfaces provided by StoryBite (‘StoryBite clients’)
You visit or interact with our websites and fan pages on social networks
You interact with us in any other way, such as when you contact our customer support service, respond to our surveys, participate in our competitions, review our services, use our developer platform and similar
Our websites, services or documents refer to this Privacy Policies

The Privacy Policies collectively refer to the above as processing of your data in the context of provision of our ‘Services’. Our policy is to always process your personal data in accordance with applicable data protection laws and regulations.

These Privacy Policies are separate from StoryBite’s Terms and Conditions (‘Terms’), which govern your use of and access to the StoryBite Services.

Your Personal Data

We collect 'personal data', which is information that identifies a living person, or which can be identified as relating to a living person.When we talk about 'you' or 'your' in this policy we mean any living person whose personal data we collect. When we talk about 'Members' and 'Membership' we are referring to subscribing Members of StoryBite.

We may collect your personal data directly from you, from your device or automatically through your use of our Services. We may also receive your personal data from third parties, as outlined below.

Personal data category	Examples of personal data collected	When we collect this data
contact details	account name mobile number email address	We collect this information when you create or update your account
Data that you have shared with third party social media platform operators	account login name profile picture contact details language preference	We collect this information when you create or update your account with third party SSO.
Device specific information	IP address hardware model operating system version GAID(Google Advertising ID) IDFA (Identifier For Advertising) setting configurations software and mobile network configuration	We collect this information when you use our clients with your consents.
Subscription data	Type of your current and previous subscription plan(s) Length of your subscription Events relating to your subscription, such as start, renewal, cancellation, upgrade or downgrade Information about any marketing campaigns or trial subscriptions you utilised Subscription discounts and related documentation proving your eligibility for discounts	We collect this information when you subscribe to our Services or change your subscription.
Payment and billing data	Payment method (e.g., credit or debit card, PayPal, mobile payment, app store payment and similar) Payment token (A random string of characters generated from your credit or debit card information by your payment service provider. It makes the payments for our Services more secure as we do not collect or store all your credit or debit card information. Where we facilitate further payments for our Services, we provide this token together with the requested amount to your payment service provider which charges you based on this information) Credit or debit card expiration date and certain digits of your card (for security reasons, we do not collect or store the full number of your card) PayPal billing agreement number, Details of your purchase and payment history, including the information about your billing status, paying period, past payments (amount, currency, payment type and payment reference number) and overdue payment (information about failed payment and days overdue)	We collect this information when you register your account, pay for your subscription or coins.
Usage data	Your reading information, including: titles, descriptions, content and related metadata etc. Your search history (queries) Your reading history and related metadata, such as time and date of viewing specific content Information on how you engage with and navigate through clients and websites – opens, taps, clicks and scrolling information Information about your interaction with marketing and other emails from us – email opens and clicks	We collect this information when you use our clients
Login data	Date and time of your login to our Services Client used for login and its version Device and/or browser used for login	When you log in or use the Services, our servers record the login data from your browser or device.
Marketing data	Your preferences to receive marketing communications from us	We collect this information when you interact with our Services – for example when you change your marketing preferences

We may also receive information about you from third parties that may have collected and transferred your personal data to us in accordance with their own privacy policies and/or terms of use. When we receive such information from third parties, we may combine it with the other personal data that we have collected about you as set out above and use such information either alone or in combination with the other personal data we hold.

How We Collect Your Data

We collect your information through the following methods:

Information you provide directly, including:

(1) Data you submit when registering a service account or using StoryBite;

(2) Information you share with other users via our service, as well as data you store during your use of the service.

Information we automatically acquire about you, including:

(1) Log data, location data, and device information, which we collect, compile and document when you use our Services.

Information we acquire from third parties, including:

Single sign-on platforms (Google, Apple, Facebook, etc.), affiliated entities, business partners, other customers, or your authorized representatives acting with your proper consent;

Publicly accessible information sources;

Your activity on our websites, mobile applications or smart TV applications (see the "Privacy Data" section below); and/or

Your participation in survey activities or marketing promotions hosted by us or organized on our behalf.

How We Use Your Data

We only ever use your personal data with your consent, or where it's necessary in order to:

enter into, or perform, a contract with you
comply with a legal duty
protect your vital interests
carry out a task in the public interest
for our own (or for a third party's) legitimate interests, provided your rights don't override these interests

In any event, we will only use your personal data for the purpose or purposes for which it was obtained.

We may collect, use, share or otherwise process personal data about you for the below purposes:

Purposes	Details
Helping you complete registration and login	To deliver our services to you, you are required to provide basic registration or login information, such as your email address, phone number, account username, language setting, and profile photo, to set up your account. You can also log in to StoryBite via a third-party platform account that we support. In this scenario, we will request permission to obtain relevant information (including your account name, profile photo, email address, phone number, and language preference) from the third-party platform, in accordance with your authorization.
Offering search services	When you use the search feature on StoryBite, we gather your search keywords, browsing history, browsing duration, and frequency of interaction. This data helps us more effectively deliver the content you need and services you may be interested in.
Providing subscription and inquiry services	When you top up (purchase coins on StoryBite), we will collect information related to your order and payment. If you check the remaining coin balance in your user account, we will gather this data and display it on the corresponding page. If you use a third-party payment service to process your transaction, all of your payment-related information (including payment account, email address, credit/debit card details, etc.) will be provided directly to the third-party payment provider; we do not collect or store the payment information listed above, with the exception of the transaction ID, payment amount, and transaction currency.
Providing online fiction and subscription services	Guaranteeing account security, service operation, and optimizing user experience When you use StoryBite, to help us identify abnormal account activity, evaluate product adaptability, deliver basic services (such as browsing and search), and maintain the stable operation of core functions, we may automatically collect, store, and process data related to your use of the service and your usage patterns, including: (1) Log details: When you use this service, we may automatically collect comprehensive data about your usage and save it as corresponding network logs. This log information includes your login account, search queries, IP address, browser type, telecommunications service provider, network environment, language settings, access date and time, as well as records such as total page views, push notification open records, time spent on each page, refresh records, posting records, follow and subscription records, bookmarked content, and sharing records. (2) Device information: Based on the specific permissions you grant during the installation and use of StoryBite, we may receive and store data about your device (including device type, operating system and its version, StoryBite app version, screen resolution, software package name, device settings, running processes and installed software list, GAID (Google Advertising ID)/IDFA (Identifier For Advertising), software and hardware feature data), as well as your IP address.
Providing information display and recommendation services	We may combine your personal data (such as your interests, personalized tags, browsing and search history, device information, usage habits, location information, order information, etc.), and use recommendation algorithm modeling, program development, advertising modeling, user behavior analysis and user profiling to extract your browsing and search preferences, behavior patterns and location information. This allows us to deliver page layouts and personalized content recommendations that better match your needs.
Sending service notifications to you	We may send you service-related announcements when necessary (for example, when we suspend individual services for system maintenance). If you no longer wish to receive messages from us, you can submit a request to stop these pushes. However, we may still continue to send relevant messages in compliance with applicable laws and regulations.
Improving our services	We may invite you to take part in service-related surveys to help us optimize existing services or develop new functions; at the same time, we may use your information to support software updates. Therefore, to uphold our legitimate interest in improving our services, we will process your personal data for this purpose.
Other uses of anonymized information	You understand and agree that in specific circumstances, after collecting your information, we will use technical means to remove identifying information and fully anonymize the data, so that it no longer counts as personal data that can be directly or indirectly linked to you or any other individual. The de-identified information cannot be used to identify you or linked to you. In this case, we reserve the right to use such de-identified information for user database analysis and commercial utilization. If we plan to use your information for purposes not specified in this Policy, we will obtain your prior consent through page prompts, interactive processes, website announcements or other methods. Once you give your consent, this additional use of your information will be regarded as part of this Policy and bound by its terms.
Notes on permissions for specific functions	You acknowledge and agree that we may request certain access permissions on your device to collect and use data related to specific functions and services. For example: (1) With your consent, we can access your device's storage space, allowing you to cache, download and save content. (2) With your consent, we can access your device information, use it as the unique identifier of your device to provide you with more personalized recommendations, evaluate product applicability, identify abnormal activity, and guarantee network and service security.
Deliver our marketing emails and app notifications	consistent with your local law and your preferences for receiving marketing communications from us, we may send you emails or app notifications about our Services or events, which we consider may be of interest to you, until you opt-out. We may also deliver promotional offers and communications on behalf of third-party advertisers concerning their products or services and/or events sponsored or hosted by such advertisers.
Personalisation of our marketing campaigns	if your marketing communications settings are turned on, we may use some of your previously collected personal data, such as your usage data or marketing data to send you marketing emails or app notifications that are more personalised. For example, we may send you an offer for a bundle package with your telecommunication service provider or marketing content based on your listening habits.
Personalized advertising	StoryBite and its ad partners that provide advertising or other functionality on StoryBite’s behalf, may use cookies and similar technologies to help us tailor the advertising of our Services to you as informed by your interests. The information about your interests is based on your activity, including but not limited to your browsing or product purchasing on or through our websites or on third-party websites or your responses to our marketing emails.

Exceptions to authorization:

In accordance with relevant laws and regulations, we do not need to obtain your authorization to collect your information in the following circumstances:

(1) Collection is related to the performance of obligations under applicable laws and regulations;

(2) Collection relates to public safety, public health, and major public interests;

(3) Collection relates to criminal investigation, prosecution, court trials, and the execution of judgments;

(4) When it is difficult to obtain your consent to protect the life, property and other major legitimate rights and interests of you or other individuals;

(5) When the information collected has already been publicly disclosed by you yourself;

(6) Information collected from legally disclosed channels, such as legitimate news reports, government information disclosure and other public channels;

(7) Collection is necessary for signing a contract at your request;

(8) Collection is required to maintain the safe and stable operation of our services, such as detecting and resolving product or service faults;

(9) Collection is necessary for legitimate news reporting;

(10) When an academic research institution uses the information for public-interest statistical or academic research, and de-identifies all personal information in the research results;

(11) Other circumstances specified by laws and regulations.

Special note on personal sensitive information

Personal sensitive information refers to information that, if leaked, illegally provided or misused, may threaten personal and property safety, and easily lead to harm to personal reputation, physical and mental health, or discriminatory treatment.

For example, ID numbers, personally identifiable biological information (such as facial recognition data, voiceprints, etc.), bank accounts, contact list information, communication records and content, property information, location information, full browsing history, health and physiological information, and transaction information are all classified as sensitive data. Please handle your sensitive data with caution. You agree that we may process your sensitive data in accordance with the terms of this policy.

Disclosing and Sharing Your Personal Data

We will never sell your personal data. However, we may share, transfer, or disclose your information under the following circumstances:

We may share your personal data with contractors and suppliers that deliver services to us. For example, we work with a mailing service to distribute The British Museum Magazine; we cooperate with direct debit processors to handle payment transactions, and partner with email service providers for our marketing outreach. When we transfer information to these data processors, we do so through secure channels, and we remain fully responsible for your personal data as the data controller. All such activities are conducted under formal contracts that require our suppliers to strictly maintain the confidentiality and security of your personal data.

We may also share part of your personal data with your payment service provider for processing your payments, refunds, and other relevant payment-related tasks. This includes anti-fraud checks, and assisting you in investigating and settling disputes when you contest a transaction. Your payment service provider may further process the shared personal data for its own independent purposes, as detailed in its own terms of service and privacy policy.

We engage third-party services to support our analytics, forecasting, reporting, as well as our marketing and advertising activities. We leverage cookies and similar technologies to collect and share different types of data with our advertising partners and analytics service providers, which support our analytics and marketing work.

We only share your information for legal, legitimate, necessary, specific, and transparent purposes. For all companies, organizations, and individuals that we share information with, we will sign strict non-disclosure agreements, and require them to process your information in compliance with our instructions, this policy, and all applicable confidentiality and security requirements.

Data Security

Data Protection

We adopt a range of physical and technical safeguards to secure the information we keep about you, and block unauthorized access to, improper use of, or unintended disclosure of your personal data.

Electronic data and databases are hosted on secured computer systems, and we restrict access to information through both physical and digital access controls. Our employees receive regular training on data protection, and we have established a complete set of data protection protocols that all staff must follow when processing personal data.

Payment Security

All online forms that require you to enter financial information use the Secure Sockets Layer (SSL) protocol to encrypt data during transmission between your browser and our servers.

If you use a payment card to make a subscription, or buy any product from us via our online clients, we will transmit your payment card details through a secure channel to our payment service provider. We fully adhere to the Payment Card Industry Data Security Standard (PCI-DSS) released by the PCI Security Standards Council.

Services Provided by Third Parties and Advertising/Payment Partners

Our Service may include links to social media platforms or other services offered by third-party providers. You acknowledge that when you access and use such services, third parties are allowed to directly collect and process your personal information. We will conduct reviews to confirm that third-party collection of your information is legal and necessary, and we will require these third parties to put in place appropriate safeguards to protect your personal data.

You can opt out of targeted advertising through the dedicated opt-out channels listed below:

FACEBOOK - https://www.facebook.com/settings/?tab=ads

GOOGLE - https://www.google.com/settings/ads/anonymous

In addition, you can opt out of a number of these services via the opt-out portal operated by the Digital Advertising Alliance, which is accessible at:http://optout.aboutads.info/.

Cookies

We or our third-party partners may obtain and use your information through Cookie and Similar Technologies(for example Local Storage, Pixel .etc)(collectively referred to herein as “Tracker(s)”) and save this information as log information.

Children’s Privacy Policy

StoryBite serves the general public. We do not intentionally collect data from children (as defined by relevant applicable laws) without advance consent from the child's parent or legal guardian, except when permitted by applicable law. If you are a parent or legal guardian who believes we have accidentally collected your child's information, or used/shared your child's information through our products and services without your permission, you can contact us at service@storybite.live with identity and relationship verification documents. We will delete relevant data within 3 working days, as required by applicable law.

Your Privacy Rights

We take all reasonable precautions to ensure that the Data we collect, retain, use and disclose is accurate, complete and up-to-date. However, the accuracy of that Data depends to a large extent on the Data you provide. You have a right to request access to, and correction of, your Data and we recommend that you:

let us know if there are any errors in your Data; and
keep us up-to-date with changes to your Data.

If you wish to access or amend any of your Data we hold, or request that we delete any of your information that is no longer necessary for the provision of our Services, you may contact us by sending Email to service@storybite.live.

Additional Disclosures for Individuals Residing in Select Jurisdictions

Brazil

If you reside in Brazil. StoryBite complies with the Brazilian General Data Protection Law (Law No. 13,709/2018) (the ‘LGPD’). This Privacy Policies includes all the necessary disclosures in line with the LGPD.

If you are not satisfied with how we handled your request to exercise your rights or you have any other questions or concerns about your rights or this Privacy Policies, please contact our data protection officer at service@storybite.live.

You also have the right to complain to your national data protection authority Autoridade Nacional de Proteção de Dados.

We may share your personal data with third parties outside of Brazil. This may include transfers of your personal data to the United States

Indonesia

If you use our Services in Indonesia, the following additional terms apply. In case of conflict between these terms and the main Policy, the additional terms shall prevail.

Your Choices: You have the right to withdraw consent for disclosure of your personal data to third parties. Upon request, we will present, publish, transmit, distribute, and/or grant access to your personal data to third parties. Note that revoking consent for disclosure and/or collection of your data may prevent us from fulfilling requests and you from using some StoryBite features.

You may request that we:

Disclose the history of personal data that we have collected; and/or
Erase and dispose of your personal data that we have collected on our server.

Please note that by requesting us to erase and dispose of your personal data, you may not be able to use some of StoryBite's features and functionalities.

Philippines

If you use our Services in Philippines, the following additional terms apply. In case of conflict between these terms and the main Policy, the additional terms shall prevail.

You shall have the right to information, object, access, rectification, erasure or blocking, lodge complaints，damages and data portability.Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details.

Vietnam

If you use our Services in Vietnam, the following additional terms apply. In case of conflict between these terms and the main Policy, the additional terms shall prevail.

Methods of processing your personal data. We may process your personal data by manual or automated methods.

Data subject’s rights and obligations. Subject to certain exceptions, you have statutory rights and obligations under applicable laws. In particular, your have the following statutory rights:

Right to know
Right to consent and withdraw consent
Right to access
Right to delete data
Right to restrict data processing
Right to be provided with data
Right to object data processing
Right to complain, denounce or initiate lawsuits
Right to claim for damages
Right to self-protection

You may exercise these rights by contacting us through details in the"How to Contact Us"section. We will respond to requests regardless of data storage location.

Changes Applied to This Privacy Policy

We may amend this privacy policy from time to time to ensure it remains up-to-date and continues to reflect how and why we use your personal data. The current version of our privacy policy will always be posted on our website.

Any questions you may have in relation to this privacy policy or how we use your personal data should be sent to us:service@storybite.live