Privacy Policy

1. What we collect

• Waitlist: the email address you give before launch and your language; used only to tell you when Dreamiz opens, with a launch offer. Ask us to delete it at any time.
• Account: email address, password (stored hashed by our authentication provider), language, the date you confirmed your email.
• Consent records: the version of the terms you accepted, the date, and your confirmation that you are 18 or older.
• Your photos: the face photos you upload ("likeness photos") and the reference photos you attach to a dream.
• Your content: dream texts, drafts, the images we generate for you, and which images you marked as favourites or deleted.
• Billing: your plan, purchases, credit history and the Stripe customer reference. Card details are handled by Stripe only; we never see them.
• Technical and anti-abuse data: your IP address is turned into a keyed hash (it cannot be read back) to limit sign-ups and requests; security logs.
• Emails we send you, and whether you opted out of offers.
• Analytics: if enabled, our own simple page-view events, and a random identifier cookie only if you consented where consent is required.

2. Face photos and likeness

Your face photos are the most sensitive data we handle. We use them for one purpose: generating the images you ask for. We do not extract, compute or store face templates or face geometry ourselves, and we do not use photos to identify anyone.

The AI providers listed below receive your photos to generate the image, and may process them in ways that could be considered biometric processing in some places. You give your explicit consent when you upload photos (the consent box), and you can withdraw it at any time by deleting your photos or your account.

We do not use your photos or generated images to train models.

3. Why we use it, and the legal basis

• To provide the service you ask for (contract): account, generation, billing, support.
• Your consent: face photos, optional analytics cookie, offers by email where consent is required.
• Our legitimate interests: security, anti-abuse, content safety checks, keeping the service working.
• Legal obligations: accounting and tax records, answering authorities.

4. Who receives your data (processors)

• kie.ai: image generation. To generate, your photos are placed on a temporary public link that the provider keeps for about 24 hours.
• OpenAI: image generation and the content safety check of your text and our images.
• Google (Gemini): image generation.
• Stripe: payments and subscriptions.
• Supabase: database, sign-in and file storage (your photos and images).
• Vercel: hosting of the website.
• Resend: sending our emails.
• Cloudflare: the human-check on sign-up (Turnstile) and email forwarding for support.
• Telegram: internal alerts for our team, which contain technical identifiers only, never your photos, texts or email.
• Some of these providers are in the United States. Transfers outside the EU rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) where the provider is certified, or on standard contractual clauses.

5. How long we keep it

• Photos and creations you delete disappear from the app at once, and their files are removed from our storage 30 days later.
• If you delete your account, your photos, creations, drafts and account data are removed right away. Your subscription is cancelled first.
• Uploads that were never used and unfinished drafts are removed automatically after a few days.
• Billing records (amounts, dates, credits) are kept for 10 years as accounting law requires, without your name or email. Stripe keeps its own invoices.
• Anti-abuse counters are kept for a short time and then deleted.
• The AI providers apply their own retention (for example about 24 hours on the temporary link described above).

6. Your rights

You can ask to access, correct, export or delete your data, to object to or limit some uses, and to withdraw consent. You can delete your account yourself in Settings. For other requests write to support@dreamiz.ai (or support@dreamiz.ai). You can also complain to your data protection authority (in France: the CNIL). Residents of California and other US states have equivalent rights, including to know, delete and opt out of sale; we do not sell personal data.

7. AI-generated images

All images are generated by artificial intelligence. Each image carries a machine-readable AI marker in its metadata, and images that depict a public figure also show a visible AI-generated label. They show a picture, not a real event.

8. Cookies

We use cookies that the site needs to work: your sign-in session, your language and your light or dark theme. Analytics, if turned on, use a separate identifier cookie only when consent is required and given.

9. Children

Dreamiz is for people aged 18 and over. We do not knowingly collect data from minors; if you think a minor has an account, write to us and we will delete it.

10. Changes

We will update this policy when the service changes, and tell you about important changes in the app or by email.