Privacy Policy

DDream ("DDream", "we", "us", or "our") provides the ddream.ai website and related applications, features, and services (collectively, the "Services"). This Privacy Policy explains what personal information we collect, how we use and share it, and what choices you have. By using the Services, you acknowledge this Policy. If you do not agree, please do not use the Services.

This Policy does not apply to third-party websites, models, or services that we link to or that the Services rely on (including OpenAI, Google, and other AI providers). Those services are governed by their own privacy policies.

1. Information We Collect

1.1 Information you provide.

• Account information: email, password (hashed), display name, and any profile details you choose to add.
• Billing information: when you purchase credits or subscriptions, our payment processors (e.g., Stripe) collect your payment-method details. We receive transaction records and limited card metadata; we do not store full card numbers.
• User Content: prompts, instructions, uploaded images and reference files, generated outputs, spec-board entries, ratings, and any other content you submit to or generate through the Services.
• Communications: messages, feedback, and information you send to us by email, chat, or support form.
• Survey or promotional responses you choose to provide.

1.2 Information collected automatically.

• Device and technical data: IP address, browser type and version, user agent, device identifiers, operating system, screen size, language, and time zone.
• Usage data: pages and features accessed, requests made, generation parameters, click and navigation paths, timestamps, referring URLs, and error logs.
• Approximate location derived from IP address (country, region, or city level).
• Cookies and similar technologies: we use cookies, local storage, and similar technologies to authenticate sessions, remember preferences, measure usage, and improve the Services. You can manage cookies through your browser settings; disabling some cookies may break parts of the Services.

1.3 Information from third parties. If you sign in with a third-party account (e.g., Google, Apple), we receive the profile information you authorize that provider to share. We may also receive analytics, fraud-prevention, and security signals from service providers.

1.4 Biometric and facial information. The Services allow you to upload images. If you upload an image that contains a face, the Services and our underlying AI providers will process facial features as part of generation. We do not use this information to identify individuals, build a facial-recognition database, or sell biometric data. We retain uploaded images only as long as needed to provide and improve the Services and as described in Section 5. By uploading an image of a person, you represent and warrant that you have obtained any consent required by law from that person, including any written consent required under the Illinois Biometric Information Privacy Act (BIPA) or similar laws. If you do not have such consent, do not upload images of identifiable individuals.

2. How We Use Information

We use personal information for the following purposes:

• To create and manage your account, authenticate logins, and provide the Services;
• To process payments, manage subscriptions, issue credits, and prevent fraudulent transactions;
• To generate, deliver, store, and display the outputs you request;
• To operate, maintain, secure, monitor, debug, and improve the Services;
• To train, fine-tune, evaluate, and improve our and our service providers' AI models, including using your prompts, uploads, and generated outputs as training and evaluation data (subject to opt-out rights where required by applicable law — contact our contact page);
• To develop new features, products, and services;
• To enforce our Terms of Service and detect, investigate, and prevent abuse, fraud, security incidents, and policy violations, including by reviewing User Content;
• To communicate with you about your account, transactions, support requests, product updates, and (with your consent where required) marketing;
• To comply with legal obligations, respond to lawful requests, and protect our rights, our users, and the public;
• To carry out internal research, analytics, and business operations, including in aggregated or de-identified form;
• For any other purpose disclosed at the time of collection or to which you consent.

Legal bases (EEA / UK / Switzerland users). Where the GDPR or equivalent law applies, we rely on the following legal bases: (a) performance of a contract with you (account, payments, generation); (b) our legitimate interests in operating, securing, and improving the Services and developing AI models, balanced against your rights; (c) compliance with legal obligations; (d) your consent where required (e.g., optional cookies, marketing); and (e) protection of vital interests in rare cases.

3. How We Share Information

We share personal information only as described below.

• Service providers and processors: hosting (AWS), payment processors (Stripe), email and notification providers, analytics providers, error-monitoring services, customer-support tools, and AI model providers (including OpenAI and Google) that process Input to generate Output. These providers are bound by contract to use the data only on our behalf.
• AI providers: when you use the Services, your prompts, uploaded images, and other Input are transmitted to the underlying AI model provider for processing. Their use of that data is governed by their own terms and privacy policies, which we encourage you to review.
• Affiliates and successors: we may share information with current and future affiliates, subsidiaries, and parent entities, and in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction.
• Legal and safety: we may disclose information when we believe in good faith that disclosure is necessary to comply with law, legal process, lawful government request, or to enforce our Terms; to detect or prevent fraud, abuse, or security issues; or to protect the rights, property, or safety of DDream, our users, or the public.
• With your consent or at your direction.
• Aggregated or de-identified data that cannot reasonably be used to identify you may be shared for any purpose.

We do not sell your personal information for monetary consideration. Some of the activities described above (such as analytics or advertising-related cookies) may be considered "sharing" or "selling" under certain U.S. state privacy laws. Where applicable, you may exercise the opt-out rights described in Section 7.

4. International Transfers

We are based in the United States, and our service providers may be located in the U.S. and other countries. By using the Services, you understand that your personal information will be transferred to and processed in countries that may have different data-protection laws than your country. Where required (for example, for transfers from the EEA, UK, or Switzerland), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent mechanisms.

5. Data Retention

We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, enforce our agreements, train and evaluate our AI systems, and otherwise pursue our legitimate interests. Specific retention periods depend on the type of data and the purpose for which it was collected. After your account is deleted or becomes inactive, we may retain certain information in archived or de-identified form, including derivatives incorporated into trained model weights, which by their nature cannot be individually deleted.

6. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information. However, no method of transmission over the internet or storage system is fully secure, and we cannot guarantee the absolute security of your information. You are responsible for maintaining a strong password, securing your account credentials, and notifying us promptly of any unauthorized access.

7. Your Choices and Rights

7.1 Account controls. You can update profile information, change your password, and manage notification preferences from your account settings. You may delete your account by contacting our contact page.

7.2 Cookies. Most browsers allow you to refuse or delete cookies through their settings. Some features of the Services may not function properly without cookies.

7.3 EEA / UK / Swiss residents. Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to processing of your personal information; to data portability; to withdraw consent (where processing is based on consent); and to lodge a complaint with your local data-protection authority.

7.4 California and other U.S. state residents. Depending on your state of residence (including under the CCPA/CPRA), you may have the right to: (a) know what personal information we collect, use, and share; (b) request access to and deletion of your personal information; (c) correct inaccurate personal information; (d) opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising; and (e) not be discriminated against for exercising these rights. To exercise these rights, contact our contact page. We will verify your identity before responding.

7.5 AI training opt-out. You may request that your prompts, uploads, and outputs be excluded from future model training by emailing our contact page. Opt-out applies prospectively and does not affect data already incorporated into trained models.

7.6 Authorized agents. Where allowed by law, you may use an authorized agent to submit requests on your behalf, subject to identity verification.

We will respond to verifiable requests within the timeframe required by applicable law. We may decline requests where an exception applies (for example, where retention is required by law or necessary to defend legal claims).

8. Children

The Services are not intended for and may not be used by individuals under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it. If you believe a minor has provided us personal information, please contact our contact page.

9. Third-Party Links and Services

The Services may contain links to third-party websites, integrations, or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to read their privacy policies.

10. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date and, where appropriate, by email or in-product notice. Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

11. Contact Us

Questions, requests, or concerns? Reach us via our contact page.

DDream — California, USA