Privacy Policy

Dreamkrate is the controller of personal data used to operate the Services, manage accounts and billing, prevent abuse, and improve the product. If your employer, client, or another organization provides your Dreamkrate workspace, that organization may separately control the content and account data it manages. Its administrator may access, manage, export, or delete workspace content and may remove your access.

This Policy does not govern third-party websites or services you choose to access, including content sources you import from or destinations where you publish an output. Those third parties apply their own privacy notices.

Please do not submit sensitive personal data that is not needed for a feature. If you provide personal data about another person—including their face, image, voice, or likeness—you must have a valid legal basis, give any required notices, and obtain all required permissions.

We may aggregate or de-identify information so that it no longer reasonably identifies you. We may use that information for analytics, security, capacity planning, and product improvement. We do not attempt to re-identify properly de-identified information except to test our de-identification safeguards.

• Generation processing. Providers may receive prompts, source files, model settings, signed file links, outputs, technical identifiers, and moderation context needed to complete or secure a request.
• Dreamkrate model training. Dreamkrate does not currently operate a foundation model and does not use your content to train a Dreamkrate-owned foundation model.
• Provider practices. AI providers process submitted content under our arrangements with them and their applicable policies. Retention and model-improvement rules can vary by provider, account type, and feature.
• Voice cloning. We store the submitted reference recording in Dreamkrate storage and ElevenLabs stores or derives the voice model used for later synthesis. Deleting a Dreamkrate voice requests deletion of its ElevenLabs voice and removes the Dreamkrate reference recording from active storage, subject to technical failures, backups, legal retention, and the provider’s deletion process.
• Moderation. Prompts, inputs, or outputs may be assessed by automated systems and, when necessary, authorized personnel to investigate safety, fraud, abuse, legal, or support issues.

We use vendors to operate Dreamkrate. The provider used for a generation depends on the model or feature you select, and providers may change as the Services evolve.

Vendors may use their affiliates and subprocessors. Some model names displayed in Dreamkrate identify the model creator even when Dreamkrate connects through a separate API or infrastructure provider.

• Your team. Workspace members can access content and information according to their role. Owners and administrators may manage members, billing, API keys, shared assets, and workspace content.
• At your direction. If you create a public share link, publish an output, connect a third-party service, invite a member, or ask us to send data elsewhere, the selected data will be disclosed as you direct. Anyone with a public share link may be able to view the shared material.
• Legal and safety reasons. We may disclose information when reasonably necessary to comply with law or lawful process; protect the rights, safety, and property of Dreamkrate, users, providers, or the public; investigate fraud or security incidents; or enforce our agreements.
• Business changes. We may disclose or transfer information in connection with financing, due diligence, a merger, acquisition, reorganization, insolvency, or sale of assets, subject to appropriate confidentiality and legal safeguards.
• Professional advisers. Lawyers, auditors, insurers, accountants, and other advisers may receive information where necessary and subject to professional or contractual duties.

We do not sell personal data for money.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, satisfy legal and accounting obligations, prevent fraud and abuse, resolve disputes, maintain security, and enforce our agreements. The period depends on the data’s nature, sensitivity, context, and applicable legal requirements.

After we verify and process a deletion request:

• Your authentication account and directly identifying profile information will be deleted or anonymized from active Dreamkrate systems, unless retention is required or permitted by law.
• Personal workspaces and content controlled solely by you will be scheduled for deletion. Content in a team workspace may remain under that team’s control if other members or an organization continue to use the workspace.
• Active API keys and sessions associated only with the deleted account will be revoked. Public share links associated with content being deleted will be disabled where technically linked to that content.
• Where supported, we will delete stored voice reference files and request deletion of associated provider-side voice models. Provider systems and backups may take additional time to complete deletion.
• Unused trial, subscription, promotional, and top-up credits associated with a deleted workspace are forfeited, except where applicable law requires otherwise.
• Some records may remain. These can include generation logs, workflow events, moderation and abuse-prevention records, transaction records, invoices, subscription history, billing information, refund and dispute records, security logs, legal requests, and an audit record showing that the account was deleted. We retain these only where reasonably necessary for legal compliance, fraud prevention, accounting, dispute resolution, security, audits, and enforcing our agreements.
• Where practical, retained records will be minimized, anonymized, pseudonymized, or separated from your active profile. Deletion from encrypted backups occurs through the normal backup lifecycle unless earlier deletion is technically feasible and required by law.

If an organization controls your workspace, ask its administrator to delete workspace content. Deleting your Dreamkrate login may remove your access without deleting data that the organization lawfully retains.

Dreamkrate uses cookies, browser storage, pixels, and similar technologies to keep you signed in, secure sessions, remember interface preferences, route authentication, prevent abuse, measure performance, and understand use of the website. Current technologies include authentication cookies, a short-lived risk-session cookie, interface preference cookies, analytics technologies, and payment providers’ security and fraud-prevention technologies.

Dreamkrate and its providers may process personal data in the European Economic Area, the United States, and other countries where they operate. These countries may have privacy laws different from those where you live. Where required, we use an approved transfer mechanism such as an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful safeguard. You may contact us to ask about the safeguards relevant to your data.

We use technical and organizational measures designed to protect personal data, including authenticated access, team-based authorization, hashed API keys and risk identifiers, signed private file links, role-based permissions, logging, rate limits, and provider security controls. No online system is completely secure. You are responsible for using a strong password, protecting credentials and API keys, limiting team access, and promptly notifying us of suspected unauthorized use.

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of personal data; restrict or object to certain processing; withdraw consent; appeal a refusal; and complain to a data-protection authority. You may also have rights to know the categories and sources of data we collect and the parties to whom it is disclosed, and to opt out of certain targeted advertising, sale, or sharing as those terms are defined by applicable law.

To exercise a right, email privacy@dreamkrate.com. We may need to verify your identity and authority. You may use an authorized agent where local law permits. Rights are not absolute; for example, we may retain transaction or security records when legally permitted or required. We will not discriminate against you for exercising a privacy right.

EEA and UK users may complain to their local supervisory authority. We encourage you to contact us first so we can try to resolve the issue.

We use automated signals from Dreamkrate, fraud-prevention services, payment providers, model providers, and other security services to assess suspicious registration, payment, account, API, and content activity. Signals can include device linkage, email reputation, IP risk, bot or proxy indicators, payment patterns, content-safety results, and prior abuse. These systems may limit trial credits, block a registration or prompt, require additional review, suspend access, or flag an account for investigation. You may ask us to review a decision by contacting us, subject to measures needed to prevent revealing or weakening our security systems.

The Services are not directed to anyone under 18, and users must not create an account for a child or upload a child’s voice for cloning. If you believe a minor has provided personal data to Dreamkrate in violation of this Policy, contact us so we can investigate and take appropriate action.

We may update this Policy to reflect changes to the Services, providers, law, or our practices. We will post the updated version and change the “Last updated” date. If a change materially affects your rights or how we use personal data, we will provide additional notice where required, such as by email or an in-product message.

For privacy questions, rights requests, or account-deletion requests, email privacy@dreamkrate.com. Please do not send passwords, payment-card numbers, government IDs, or sensitive source files by email unless we specifically ask for them through a secure channel.