Child Protection Policy

Preamble

P.1. This Policy establishes Service rules and response procedures designed to prevent and address: (i) child sexual exploitation and child sexual abuse, (ii) grooming, (iii) sexual solicitations of minors, (iv) sextortion, and (v) other forms of unsafe interaction with minors and/or content that creates risks to children in connection with use of the Service.

P.2. This Policy applies to all users of the Service and to all uses of the Service, including, without limitation:

(a) user-generated content (including posts, comments, profiles, and media uploads);

(b) links and references disseminated through the Service;

(c) direct user interactions (including messaging or similar functionality, if available);

(d) content created and/or modified using AI and/or automated tools provided as part of the Service.

P.3. This Policy forms part of the Service’s contractual documentation and shall be read together with the Service’s Terms of Use and Privacy Policy.

P.4. Acceptance and execution. Registration of an account, access to the Service, and/or use of the Service constitutes the user’s full and unconditional acceptance of this Policy. A user who does not accept this Policy must not register, access, or use the Service.

Article 1. Definitions

For the purposes of this Policy, the following terms have the meanings assigned below:

1.1. “Operator” means IBURGWALD LTD, Registration Number — HE 486085; Date of Incorporation — 31 December 2025; Director — Christos Adamou; Registered Office — Gianni Kranidioti & Pargas, 9, Flat/Office 102, 1065, Nicosia, Cyprus.

1.2. “Service” means the Flamezy application and website at flamezy.io, including all features, interfaces, and tools made available to users.

1.3. “User” means any individual who registers an account, accesses, and/or uses the Service.

1.4. “Minor” means a person under 18 years of age, unless applicable law provides otherwise for age qualification purposes.

1.5. “Content” means any information and materials uploaded, posted, transmitted, generated, or otherwise made available in the Service, including text, images, video, audio, graphics, links, metadata, profile elements, and other data.

1.6. “CSAM” (Child Sexual Abuse Material) means any material depicting a minor in a sexualised context or otherwise qualifying as child sexual abuse or exploitation material, including photo, video, audio, and text, as well as computer-generated or AI-generated content.

1.7. “CSAE” (Child Sexual Abuse and Exploitation) means sexual abuse and sexual exploitation of minors, including engagement, coercion, manipulation, threats, or other unlawful or unsafe conduct.

1.8. “Grooming” means attempts to establish trust with a minor and/or manipulate a minor for purposes of sexual exploitation, including inducing a minor to create or transmit sexualised content or to meet in person.

1.9. “Sextortion” means threats, blackmail, or coercion to compel sexual acts and/or the provision of sexualised content, including by using compromising materials.

1.10. “Notice” means a report submitted by any person identifying particular content or conduct that the reporting party believes is illegal and/or violates this Policy.

1.11. “Competent authorities” means government authorities, regulators, and law enforcement bodies exercising powers under applicable law.

Article 2. Purpose, Scope, and Applicability

2.1. The purpose of this Policy is to establish Service rules and response procedures to prevent and address conduct, content, and interactions that pose risks to children.

2.2. This Policy applies to all users and all uses of the Service, including content and conduct involving AI and/or automated capabilities within the Service.

Article 3. Legal and Contractual Basis

3.1. The Operator designs, implements, and enforces this Policy taking into account, where applicable, relevant legal and compliance expectations, including (without limitation):

(a) Regulation (EU) 2022/2065 (the Digital Services Act), including notice-and-action mechanisms, statement-of-reasons requirements for certain restrictions, transparency expectations, and user protection mechanisms (where applicable).

(b) Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), including enhanced protection considerations for children’s personal data and rules on children’s consent for information society services (where consent is used as a legal basis).

(c) Directive 2002/58/EC (the ePrivacy Directive), including confidentiality of communications (where the Service includes communications functionality).

(d) Directive 2011/93/EU on combating the sexual abuse and sexual exploitation of children and child pornography.

(e) The Council of Europe Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse (the “Lanzarote Convention”).

(f) Marketplace and platform requirements and guidance applicable to user-generated content services, including the policies and guidelines of Apple and Google (including, inter alia, child-safety-related contact point and enforcement expectations where relevant).

3.2. References to “applicable law” (and “applicable national law”) mean the laws and regulations applicable to the Service and/or the Operator in relevant jurisdictions, including (without limitation) the laws of the Republic of Cyprus. Specific national acts are not exhaustively listed in this Policy.

Article 4. Prohibited Content and Prohibited Conduct

4.1. Users must not create, upload, post, transmit, distribute, request, promote, store, or link to content involving minors in a sexualised or exploitative context, or any other content that poses risks to children.

4.2. Prohibited content and conduct include, without limitation:

(a) CSAM / child sexual exploitation content. Any content depicting a minor and/or sexualising a minor, including photo, video, audio, text, and any computer-generated or AI-generated depictions of minors in sexually explicit conduct or otherwise qualifying as CSAM.

(b) Grooming, sexual solicitations of minors, and sextortion. Any attempts to contact, manipulate, pressure, coerce, threaten, or blackmail a minor for sexual purposes, including requests for sexualised content, arranging sexual meetings, or attempts to move communications to third-party platforms for sexual purposes.

(c) Promotion/facilitation/normalisation. Any content that promotes, justifies, romanticises, rationalises, normalises, or provides instruction for child sexual abuse or exploitation, or otherwise facilitates such conduct.

(d) Child endangerment and exploitation. Any depiction, encouragement, or description of harm to a minor, exploitation of a minor, trafficking-related conduct, or other abusive practices involving minors.

(e) Inappropriate adult–minor interactions. Any interactions or behavioral patterns reasonably indicating sexual intent, exploitation risk, or unsafe conduct toward minors.

4.3. CSAM/CSAE-related violations are treated as severe violations. The Operator may take immediate action.

Article 5. Age Requirements and Age Assurance Measures

5.1. Minimum age (default). The minimum age to use the Service is 13 years. Users under 13 years of age must not use the Service.

5.2. Additional age-related safeguards.

(a) For users under 18, the Operator may apply additional safety measures and/or restrict certain Service features to reduce child-safety risks.

(b) Where a user is below the legally defined age for valid digital consent in the relevant jurisdiction (and consent is relied upon as a legal basis for processing), the Operator may require parental or legal guardian consent or restrict access to certain features, in accordance with applicable law and the Service’s contractual documentation (including the Terms of Use and Privacy Policy).

5.3. Age verification and compliance enforcement. The Operator may implement age-screening tools and other risk-based measures to assess compliance with age restrictions and to address instances of suspected use of the Service by individuals below the minimum age.

5.4. Where the Operator has information or a reasonable suspicion that a user is below the minimum age, the Operator may restrict the user’s account, require additional age verification, or suspend or terminate the user’s access to the Service.

Article 6. Moderation, Detection, and Enforcement Process

6.1. The Operator applies a layered child-safety approach which may include:

(a) automated detection signals and filters (including AI-assisted tools);

(b) human moderator review by trained personnel;

(c) escalation procedures for high-severity cases (including suspected CSAM or indications of immediate danger);

(d) ongoing improvement of moderation processes and tools.

6.2. Target internal handling time (SLA). The Operator aims to review user reports/flags and take action within 24 hours as an internal target. High-severity child-safety matters are prioritized where practicable.

6.3. Confidentiality of communications. Where the Service includes communications functionality (e.g., messaging), the Operator designs and applies moderation measures with due regard to applicable privacy and data protection requirements.

Article 7. Reporting and Notice-and-Action Procedure

7.1. Reporting channels. Any person may report suspected violations of this Policy and/or suspected illegal content via:

(a) in-Service reporting tools (if available); and/or

(b) the child-safety contact email listed in the Document Particulars; and/or

(c) the notice-and-action contact email listed in the Document Particulars.

7.2. Immediate danger. If a reporting party believes a child is in immediate danger, the reporting party is encouraged to contact local emergency services and/or law enforcement first.

7.3. The Operator supports a notice-and-action process intended to receive and act upon valid notices that identify specific content alleged to be illegal.

7.4. Recommended contents of a notice (to the extent reasonably available). A notice should include:

(a) the location of the content (e.g., URL, post identifier, account identifier, and, where useful, screenshots);

(b) the reasons why the reporting party believes the content is illegal and/or violates this Policy;

(c) a good-faith statement that the information provided is, to the reporting party’s knowledge, accurate;

(d) the reporting party’s contact details, if the reporting party expects feedback (noting that certain child-safety reports may be processed without reporter contact information, as allowed by applicable law and context).

7.5. Acknowledgment and outcome communication. Where contact details are provided, the Operator may acknowledge receipt of a notice and inform the reporting party of the outcome without undue delay, provided such communication is not prohibited by applicable law and does not compromise child-safety measures and/or investigations.

Article 8. Cooperation with Competent Authorities

8.1. The Operator may cooperate with competent authorities (including regulators and law enforcement) in accordance with applicable law, including by:

(a) preserving relevant evidence and technical logs;

(b) responding to lawful requests and/or complying with binding orders or directives;

(c) taking other steps necessary to address credible safety risks.

8.2. Optional CSAM reporting (U.S. context). Where required by applicable law, or where circumstances have a material nexus to the United States and reporting is appropriate, the Operator may submit reports of confirmed CSAM to the National Center for Missing & Exploited Children (CyberTipline) or to the appropriate authority in another region. The Operator may also retain information as necessary to lawfully submit such reports and to support investigations.

Article 9. Data Processing and Retention for Child Safety Purposes

9.1. To support child safety, the Operator may process and retain a limited set of data (including content, notices/reports, account identifiers, timestamps, and technical logs) to the extent necessary for:

(a) investigating and enforcing this Policy and the Service’s Terms of Use;

(b) preventing repeat violations and reducing risk;

(c) preservation of evidence;

(d) legal compliance and responses to lawful requests.

9.2. The Operator applies security measures and access controls on a need-to-know basis and adheres to data minimization and purpose limitation principles.

9.3. Children’s personal data may require enhanced safeguards, including the use of clear, age-appropriate language and additional protective measures commensurate with age and risk.

9.4. Retention periods depend on the nature and severity of the matter and applicable legal requirements. High-severity child-safety incidents may be retained for longer periods to comply with legal obligations and support lawful investigations.

Article 10. Platform Safety Measures

10.1. The Operator maintains and may further develop safety measures intended to reduce risks to children, including, without limitation:

(a) reporting tools and user blocking tools;

(b) limitations on content uploads (including link management) and “friction” mechanisms or activity limits where suspicious patterns are detected;

(c) safety-by-design measures for AI features intended to reduce the risk of generating and/or disseminating child-safety-related prohibited content;

(d) monetization-related measures intended to reduce incentives for abusive or exploitative conduct.

Article 11. Enforcement Measures and Appeals

11.1. If a user violates this Policy, the Operator may take enforcement measures, including (without limitation):

(a) removal of content and/or restriction of its visibility;

(b) temporary restriction of certain features;

(c) suspension of the account or permanent termination of access;

(d) other lawful and proportionate measures aimed at preventing repeat abuse.

11.2. Where applicable and feasible, the Operator may provide the affected user with an explanation of the key reasons for significant restrictive measures, taking into account applicable legal requirements.

11.3. The Operator may take measures addressing abuse of reporting mechanisms and/or repeated abusive or harassing conduct, in accordance with applicable law.

11.4. Appeals and complaints. A user who believes that a child-safety-related moderation decision was made in error may submit an appeal or complaint to the contact designated for appeals/complaints in the Document Particulars.

11.5. Where requirements for internal complaint-handling mechanisms apply, the Operator ensures that complaints are reviewed under human oversight (not solely by automated means).

Article 12. Policy Updates and Contact Details

12.1. Updates. The Operator may amend this Policy in response to changes in legislation, evolving child-safety risks, changes in Service functionality, and/or shifts in enforcement practices.

12.2. Updated versions of this Policy will be published on the flamezy.io website and/or within the Service and will become effective as of the effective date indicated in the updated version of the Policy.

12.3. Contact Details:

(a) child safety inquiries: support@flamezy.io;

(b) illegal content notices / notice-and-action: support@flamezy.io;

(c) user appeals/complaints: support@flamezy.io;

(d) support: support@flamezy.io;

Article 13. Miscellaneous Provisions

13.1. If any provision of this Policy is held to be invalid or unenforceable, the remaining provisions of the Policy shall remain in full force and effect. In the event any provision is determined to be invalid or contrary to law, the validity of the rest of this Policy will not be affected.

13.2. This Policy is issued in English and Russian. In the event of any inconsistency or discrepancy between the English and Russian versions of this Policy, the English version shall prevail.

13.3. Effective date. This Policy takes effect on 23 October 2026 and remains in effect until it is superseded by a new version of the Policy.

Schedule A. Flamezy Child-Safety Operating Standard

This standard explains how the Child Safety Policy applies to Flamezy, including UGC, AI-generated content, Watch Goal, Rewards, marketplace functions and webview/deep-link interfaces. It does not narrow the main Policy prohibitions and must be read with the Terms of Use.

A.1. CSAM/CSAE and AI-generated content

The CSAM/CSAE prohibition applies to real, synthetic, AI-generated, edited, deepfake, cartoon-like or otherwise created material where it sexualises a minor or may qualify as child exploitation. Users must not upload, generate, request, store, distribute or link to such material.

Where AI tools or automated functions are used in Flamezy, the Company may apply safety prompts, filters, output blocks, human review and evidence preservation where a violation is suspected. Attempts to bypass filters or use coded language are treated as serious violations.

A.2. Grooming, sextortion and off-platform migration

Moderation may consider behavioural patterns, not only a single message: repeated adult-minor contact, secrecy requests, pressure, gifts, tokens, Rewards promises, requests to move to another messenger or threats to publish material. Such signals may lead to urgent account restrictions.

Users must not use Rewards, FLAME, EZY, model access, marketplace features or other benefits to pressure, induce or manipulate a minor. Suspected immediate danger to a child should be reported to emergency services and/or competent authorities.

A.3. Age measures and minor-facing features

The default minimum age is 13, and higher limits may apply to certain features. The Company may restrict messaging, link posting, marketplace functions, external wallets, withdrawals, advertising, personalization or other features for users under 18 where necessary to reduce risk.

Where age is reasonably in doubt, the user may be asked for additional information and access may be temporarily limited. Such data are processed with minimization, security and enhanced protection for children’s personal data.

A.4. Reports, SLA and escalation

Child-safety reports may be submitted through in-service tools and support@flamezy.io. CSAM/CSAE, grooming, sextortion and immediate-risk matters are prioritized; the initial response target may be shorter than the general SLA where urgent measures are required.

The Company may temporarily hide content, block a user, preserve technical logs, restrict messaging or escalate a matter to legal/compliance before full review is completed where the child-safety risk is credible or severe.

A.5. Appeals, evidence and confidentiality

A user may appeal to support@flamezy.io, but child safety and evidence preservation remain the priority. The Company may withhold detection logic, signal sources or report materials where disclosure could enable circumvention, endanger a child or interfere with an investigation.

Access to child-safety materials is limited to authorized personnel on a need-to-know basis. High-risk materials may be retained longer than ordinary user data where needed for legal obligations, repeat-offender detection, cooperation with authorities or user protection.