Privacy Policy

Last updated: April 23, 2026

This Privacy Policy explains how MyDream Labs LLC ("we", "us", "our"), operating MyDream.video (the "Service"), collects, uses, discloses, and protects personal information.

Local Representatives

EEA representative: Data Protection Representative Limited (trading as DataRep) ("DataRep"), The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland.
UK representative: Data Protection Representative Limited (trading as DataRep) ("DataRep"), 107-111 Fleet Street, London, EC4A 2AB, United Kingdom.
Data protection requests to our representative: you may send an email to DataRep at [email protected] quoting `<MyDream.video>` in the subject line, use the online webform at https://www.datarep.com/data-request/, or send postal correspondence addressed to `DataRep` and clearly referring to `MyDream.video`.
General customer, product, billing, or support questions should be sent to [email protected] or [email protected] rather than to DataRep.
Switzerland representative: We do not currently offer the Service in Switzerland, and we have not currently appointed a representative in Switzerland under the Swiss FADP.

1. Scope and Service

MyDream.video is an adult-only consumer entertainment service for generating personalized dream videos from your own photos. It is not directed to children and is not a medical, financial, employment, or professional advice service.

As of the date shown with this Policy, the Service is not offered to users located in or accessing the Service from the following countries and regions:

Austria
Belgium
Bulgaria
Croatia
Cyprus
Czech Republic
Denmark
Estonia
Finland
France
Germany
Greece
Hungary
Iceland
Ireland
Italy
Latvia
Liechtenstein
Lithuania
Luxembourg
Malta
Netherlands
Norway
Poland
Portugal
Romania
Slovakia
Slovenia
Spain
Sweden
United Kingdom
Switzerland

Users located in those countries or regions may see limited informational pages or geoblocked responses, and we may deny account creation, purchases, uploads, or other access until launch readiness is complete there.

We have appointed DataRep as our EEA and UK data protection representative ahead of any broader launch-readiness work in those regions. That appointment does not by itself mean that the Service is currently available there.

2. Information We Collect

We may collect the following categories of information:

Account and authentication information: name, email address, login identifiers, authentication state, and related account metadata.
Legal confirmation records: timestamps, legal version, user identifier, and records of your explicit in-product confirmation that you are at least 18 years old and accepted the current Terms of Use and Privacy Policy.
User content: photos, prompts, dream requests, template selections, and generated videos.
Payment and transaction information: payment status, purchase channel, processor identifiers, store transaction references, refund/chargeback status, and limited billing metadata. We do not store full payment card numbers.
Device, network, and usage information: IP address, browser, device identifiers, operating system, app version, crash/error context, and product interaction events.
Analytics and attribution information: referrer, landing page, locale, campaign parameters, click IDs, anonymous IDs, install attribution, deferred deep link metadata, and similar measurement data.
Support and communications: messages you send to us and records of support or legal requests.

3. Sources of Information

We collect information:

directly from you;
from your device or browser when you use the website or app;
from service providers that help us authenticate users, process payments, measure product usage, detect abuse, and deliver app store purchases;
from attribution and analytics partners when you arrive via campaign links, installs, or deep links.

4. How We Use Information

We use personal information to:

provide, operate, secure, and improve the Service;
authenticate users and manage accounts;
process payments, grant credits, reconcile refunds, and prevent fraud or abuse;
generate videos from your uploaded content and store them for a limited period;
understand product usage, conversion funnels, and attribution performance;
communicate with you about support, legal, product, or security matters;
enforce our Terms, investigate violations, and respond to legal requests;
comply with legal obligations and defend legal claims.

5. Legal Bases (EEA/UK/Switzerland Where Applicable)

Where required by applicable law, we rely on one or more of the following legal bases:

Contract: to provide the Service you request.
Legitimate interests: service security, fraud prevention, abuse detection, troubleshooting, product improvement, and basic business operations.
Consent: where required for optional analytics, attribution, cookies, similar technologies, or certain communications.
Legal obligation: where required by tax, accounting, consumer, platform, intellectual property, or other laws.

6. How We Share Information

We do not sell personal information for money.

In the current release, we do not use personal information for third-party retargeting, ad audiences, or cross-context behavioral advertising.

We may disclose personal information to:

Clerk (authentication and account services)
Stripe (web payment processing)
Apple App Store and Google Play (in-app purchase verification and platform payment records)
Google Cloud, Google Cloud Storage, Vertex AI, and related Google APIs (storage and video generation infrastructure)
PostHog (product analytics)
AppsFlyer (mobile attribution and deep linking)
Sentry (error monitoring)
Cloudflare (security and CDN)
Railway (infrastructure and hosting)
professional advisers, auditors, insurers, or acquirers where reasonably necessary
courts, regulators, law enforcement, rights holders, and legal authorities where required by law or legal process

We may also disclose relevant account, usage, payment, and content records where necessary to respond to valid legal requests, valid DMCA notices, subpoenas, court orders, or to establish, exercise, or defend legal claims.

7. International Transfers

Your information may be processed in countries outside your own, including the United States.

Where required by law, we rely on appropriate transfer mechanisms such as adequacy decisions, the EU-U.S. Data Privacy Framework and UK extension where available, Standard Contractual Clauses, the UK Addendum or IDTA, or other lawful safeguards adopted by our service providers.

8. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Uploaded photos and generated videos: removed from user-facing access and active processing systems within 7 days after upload.
Raw attribution and click-ID data: up to 90 days.
Identifiable analytics event data: up to 12 months, after which we may delete, aggregate, or de-identify it.
Security and application logs: up to 30 days, unless needed longer for investigation.
Error and crash telemetry: up to 90 days.
Legal confirmation records: account lifetime plus up to 6 years afterward for audit, dispute, and compliance purposes.
Billing, tax, and payment reconciliation records: up to 7 years or longer if required by law.

If you delete your account, we delete your account profile, project history, uploaded photos, and generated videos from the product and active storage systems, subject to the retention periods and legal exceptions described above.

We may preserve or disclose limited records before the standard retention period ends where necessary for security, fraud prevention, payment reconciliation, valid DMCA notices, court orders, subpoenas, or other legal obligations.

Final deletion from storage layers, replicas, caches, and backups may take additional time because of asynchronous lifecycle processing and provider retention schedules.

9. Cookies, Similar Technologies, and Privacy Choices

We use cookies, local storage, and similar technologies on the web to:

keep the Service working;
remember your analytics preferences;
understand traffic and product usage;
measure attribution and conversion performance.

In the EEA, UK, and Switzerland, we request consent before enabling optional analytics and similar measurement technologies.

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to disable optional web analytics and similar tracking in supported browsers.

You can manage optional analytics through the "Privacy choices" or cookie settings entry points on our website and web app. You can also use browser controls to clear cookies or local storage.

10. Your Privacy Rights

Depending on your location, you may have rights to:

know whether we process your personal information;
access, correct, or delete personal information;
receive a portable copy of certain personal information;
object to, restrict, or withdraw consent for certain processing;
appeal a denied privacy request where applicable;
complain to a supervisory or regulatory authority.

To exercise rights, contact [email protected]. For general support, contact [email protected]. We may request information needed to verify your identity before completing a request.

If you can still access the app, you can also request account deletion from the Profile screen or through our public delete-account page.

11. US State Privacy Disclosures

If you live in a US state with an applicable privacy law, you may have rights such as access, correction, deletion, portability, and appeal.

Because the current release does not use personal information for third-party retargeting or cross-context behavioral advertising, we do not currently offer a separate "Do Not Sell or Share" flow for advertising uses. We do, however, honor Global Privacy Control for optional web analytics and similar tracking in supported browsers.

If our practices change, we will update this Policy and provide any additional disclosures or opt-out mechanisms required by law.

12. Adults Only

The Service is intended only for adults who are at least 18 years old. We do not knowingly permit minors to use the Service.

If we learn that a person under 18 has provided us personal information, we may suspend or terminate the account and delete the information where appropriate.

13. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No security measure is perfect, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version and update the legal version/date published with the Service.

15. English Language Version

This Policy is currently published in English only. If we provide a translation, the English version controls to the extent permitted by law.

16. Contact

Privacy requests and appeals: [email protected]
Support: [email protected]
Mail: MyDream Labs LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States
EEA representative: DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland
UK representative: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom
Representative webform and email: https://www.datarep.com/data-request/ and [email protected], quoting `<MyDream.video>` in the subject line