Privacy Policy
Privacy Policy of Dreamdrive, operated by Synthetic White AB. Version 1.6, effective 15 October 2026.
1. Who is responsible
The controller of personal data processed through Dreamdrive is Synthetic White AB, a Swedish limited company, company registration number 559519-7665, Sjöormsstigen 4, 135 52 Tyresö, Sweden. Email: info@dreamdrive.ai. We have not appointed a data protection officer because the law does not require one for our size and activities; the email address above reaches the people responsible for privacy.
Where you use Dreamdrive for business purposes and your records contain personal data about other people (for example client names or an approver’s name), you are the controller of that data and we are your processor under the Data Processing Agreement. This policy describes what we do as a controller.
2. What this policy covers
This policy covers the Dreamdrive Chrome extension, the API it talks to, the website at www.dreamdrive.ai (including the waiting list and cheat-sheet sign-ups), public Project summary pages at share links, and our support correspondence. It does not cover the AI platforms you connect, which have their own privacy policies.
3. What personal data we process
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, name, profile picture URL, sign-in method, account creation date, plan | You, via Google sign-in or the email code sign-in |
| Captures | Prompt, negative prompt, model, settings, reference links, result image URLs on the platform’s own network, page URL and title, timestamps, platform name, how each field was obtained; small thumbnails (up to 512 pixels) when thumbnail storage is enabled | The extension, reading pages on platforms you connect, or files you import |
| Stored result files | The result images and videos themselves, fetched from the platform’s own network after a capture (up to 95 MB each; 2 GB per account on Free, 50 GB on Pro and during the trial), plus files you import | The platform’s content network, fetched by the extension or our servers at your capture; files you import |
| Imported file metadata | Embedded metadata read from image files you import (PNG text, EXIF, XMP, ComfyUI or Automatic1111 workflow data), a note of whether C2PA Content Credentials are present, file size and type | Files you choose on your computer |
| Projects and workflow | Project names, optional client names, notes, ratings, status, approver name you type in, approval time, platform plan declarations you make | You |
| Share links | Share token, title, which fields are included, creation and revocation time, view count | Generated when you create a share link |
| Usage events | Event names with small counts or codes, the extension version, a random install identifier and, once you sign in, your Account. The events are: install, update and uninstall; sign-in and sign-out; the tour (start, steps, finish or skip); a platform connected or disconnected (its name); a capture saved or failed on a platform (its name and a short reason code); a file stored or not stored (a reason code); hover-save, right-click save, import, drag and drop onto a platform (that site’s host name and whether it worked), star, bulk action, project created, Sync (how many items it handled); upgrade, checkout and plan changes; the light or dark theme; which setting you changed (its name, not your content); invite links copied and codes used. Never prompts, notes, client names, page addresses or image addresses. | The extension and the website while you use them |
| Diagnostic reports and debugging traces | Diagnostic reports contain error codes and technical details (the extension version, the platform, the page path); never your prompts, images or page content. Detailed debugging traces are only recorded for accounts that opt in to testing, and are kept for 14 days. | The extension, when something goes wrong (diagnostic reports, from everyone); debugging traces only from accounts that opted in to testing |
| Uninstall question | When you remove the extension, Chrome opens a page asking why. If you answer: the reason you clicked, the extension version and how many days it was installed; and only if you choose to type them, a note and an email address for a reply | You, on www.dreamdrive.ai/goodbye/ |
| Invites | Your invite code, who invited whom, when the invite was used and rewarded, the storage granted, and, to stop abuse, whether the invite was made from the same browser installation as the inviter’s and your Google account identifier | The extension, when you share or use an invite |
| Server logs | IP address, user agent, requested URL, time, response status | Our servers when you use the Service |
| Billing data | Stripe customer ID, subscription status, plan, period dates, invoice history, country for tax; the last four digits and brand of your card as shown by Stripe. Full card details never reach us. | Stripe, when you subscribe |
| Support and correspondence | Emails you send us and our replies | You |
| Website visitors | A daily-rotating hash of IP address and user agent (the IP address itself is never stored), pages viewed, how long each page was visible on screen and how far down it was scrolled, clicks on named buttons (such as install, waiting list, pricing, the theme switch), referrer, campaign tags in the link, country and city, the name of the network the visit came from (the organisation that registered the IP address range, such as a broadband provider, a mobile operator, a university or a company that runs its own network, as looked up by Cloudflare at the moment of the visit), device type, browser and language. A random id for each page view lets the time and scroll be added to it; it lives only in that page’s memory. No cookies, no cross-site tracking, no persistent identifier | Your browser when you visit www.dreamdrive.ai |
| Waiting list and cheat sheet | Email address, time of sign-up, which list | You, via the forms on the website |
| Product news and service emails | Your email address, whether you receive product news (on by default for account holders, off with one click), which newsletters were sent to you, whether each was delivered or bounced, any spam complaint, when you unsubscribed and, where open and click measurement is switched on in our email provider, whether you opened it and clicked a link | Our records and our email provider (Resend) |
| Data on your device | Sign-in token, settings, capture queue and cached captures in the extension’s local storage; theme preference on the website; if you switch on "Save to your computer", full-size copies of your captured files in your Downloads folder or a folder you pick | Stored locally by the extension or website; not sent to us except as described above |
We do not ask for and do not knowingly process special categories of data (such as health, religion or political opinions). If a prompt you write contains such information, it is stored as part of your capture like any other text; please avoid putting sensitive personal data in prompts you record.
4. Why we process it and on what legal basis
| Purpose | Data | Legal basis (GDPR Article 6) |
|---|---|---|
| Creating and running your account, signing you in, syncing your captures between the extension and your library | Account data, captures, projects, data on your device | Performance of a contract (6(1)(b)) |
| Providing paid plans, trials and billing | Account data, billing data | Performance of a contract (6(1)(b)); legal obligation for bookkeeping and tax (6(1)(c)) |
| Showing Project summaries at share links you create | Captures and projects you include; view count | Performance of a contract (6(1)(b)) |
| Sending sign-in codes, receipts and service notices (for example about price or terms changes) | Account data | Performance of a contract (6(1)(b)); legal obligation where notice is required by law (6(1)(c)) |
| Keeping the Service secure, preventing abuse, debugging | Server logs, usage events, diagnostic reports; debugging traces for accounts that opted in to testing | Legitimate interest (6(1)(f)) in running a secure, working service |
| Understanding which features are used so we can improve the product, and noticing quickly when capture stops working on a platform | Usage events (names, counts and reason codes, not prompt content) | Legitimate interest (6(1)(f)) in improving the Service; you may object (section 12) |
| Running invites and granting invite storage; stopping invite abuse | Invite data | Performance of a contract (6(1)(b)); legitimate interest (6(1)(f)) in preventing abuse |
| Learning why people remove the extension, and replying if you asked us to | Uninstall answers | Legitimate interest (6(1)(f)); consent (6(1)(a)) for the optional email address |
| Measuring website traffic | Website visitor data (cookieless, daily-rotating hash) | Legitimate interest (6(1)(f)); the method is designed so that individuals cannot be re-identified after the day ends |
| Seeing which organisations take an interest in Dreamdrive (for example a studio or agency whose own network shows up several times), so we know who to talk to | The network name of website visits, counted per organisation | Legitimate interest (6(1)(f)) in understanding business interest; we never try to find out who a person is, network names are only looked at as totals per organisation, and most visits show only a broadband or mobile provider. You may object (section 12) |
| Occasional product news to account holders about Dreamdrive (new features, changes to plans), and measuring whether those emails arrive and are read | Email address, product news preference and email events | Legitimate interest (6(1)(f)) in telling existing customers about the service they use, as allowed for similar products under the Swedish Marketing Act; you can opt out with one click in any of them, in Dreamdrive → Account, or by emailing us |
| Essential service announcements (account, terms, security) | Email address | Performance of a contract (6(1)(b)); legal obligation where notice is required (6(1)(c)) |
| Sending you the waiting-list and cheat-sheet emails you asked for | Email address | Consent (6(1)(a)); you can withdraw at any time via the unsubscribe link or by emailing us |
| Answering your support requests | Support correspondence, account data | Performance of a contract (6(1)(b)) or legitimate interest (6(1)(f)) in answering questions |
| Complying with the law and defending legal claims | Whatever is relevant | Legal obligation (6(1)(c)); legitimate interest (6(1)(f)) |
5. What we do not do
- We do not sell personal data, and we do not share it with advertisers or data brokers.
- We do not use your prompts, images, notes or client names to train machine-learning models, and we do not use them for any purpose other than providing the Service to you.
- We do not profile you and we make no decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Article 22). Plan limits are applied mechanically according to your plan, which is not a decision about you as a person.
- We do not read pages on platforms you have not connected, and we do not record other people’s work.
- We do not use advertising or cross-site tracking technologies on our website or in the extension.
6. How long we keep it
| Category | Retention |
|---|---|
| Account data, captures, projects, share links, platform plan declarations | For as long as your account exists. Deleted within 30 days after you ask us to delete your account, and removed from backups within 90 days. Free accounts not signed into for 24 months may be deleted after 30 days’ email notice. |
| Captures you delete individually | Deleted at once from the live database; removed from backups within 90 days. |
| Thumbnails and stored result files in storage | Deleted with the capture they belong to, on the same schedule. Copies on your own computer are yours and are not touched. |
| Usage events | Up to 24 months, then deleted or aggregated so that they no longer relate to an individual. |
| Diagnostic reports | 90 days, then deleted. |
| Debugging traces (testing accounts only) | 14 days, then deleted. |
| Server logs | Up to 30 days; Cloudflare’s own edge logs follow Cloudflare’s short retention. |
| Billing records | Seven years after the end of the financial year, as required by the Swedish Bookkeeping Act. |
| Website visitor analytics | The hash rotates daily and cannot be linked back to you after that; the resulting page-view statistics (including read time, scroll depth and the network name) are kept for up to 25 months. |
| Uninstall answers | Up to 25 months. An email address you typed in is deleted once we have replied, and within 90 days at the latest. |
| Invite data | For as long as both Accounts exist; deleted with the Account. |
| Waiting list and cheat sheet emails | Until you unsubscribe, or 24 months after the list’s purpose has ended, whichever is first. |
| Newsletter send records and email events | Up to 24 months. Addresses that bounced or complained are kept on a do-not-send list for as long as needed to honour it. |
| Support correspondence | Up to 24 months after the matter is closed, unless needed longer for a legal claim. |
| Sign-in codes | Codes expire within minutes and are deleted after use or expiry. |
7. Who receives it
7.1 Our staff
People working for Synthetic White AB who run the Service and give support can see customer records: email, plan, usage counts and capture metadata. Access is limited to the owner’s Google account and the staff who need it, and is bound by confidentiality.
7.2 Processors (subprocessors)
We use the following companies to run the Service. They act on our instructions and may not use the data for their own purposes. The full list with details is kept at Subprocessors.
| Company | What they do for us | Data location | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. (USA) | Hosting of the API and website (Workers and Pages), database (D1), thumbnail storage (R2), key-value storage, network security | Data stored in the EU (D1 with EU jurisdiction, R2 EU bucket); Cloudflare’s global network terminates connections | Cloudflare Data Processing Addendum; EU Standard Contractual Clauses; Cloudflare is certified under the EU-US Data Privacy Framework |
| Resend, Inc. (USA) | Sending sign-in codes and service emails | USA and EU | Data Processing Agreement; EU Standard Contractual Clauses |
7.3 Independent controllers
| Company | Role | Notes |
|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA) | Payment processing | Stripe is an independent controller for processing your payment, fraud prevention and its own legal duties. Card details go directly to Stripe. See Stripe’s privacy policy at stripe.com/privacy. |
| Google Ireland Limited / Google LLC | Google sign-in | Only if you choose to sign in with Google. Google tells us your email, name and profile picture and processes the sign-in under Google’s privacy policy. We do not receive your Google password and we request no other Google data. |
| The AI platforms you connect | The source of your captures | The extension reads what the platform shows you. We do not send anything to the platform. The platform’s own privacy policy governs what it does with your account there. |
7.4 People you share with
Anyone who has a share link you created can see the Project summary it points to, including any prompts, client names and approver names in it, until you revoke it.
7.5 Authorities and legal
We disclose data where the law requires it, to respond to a valid legal request, or to protect our rights, our users or the public. We may also disclose data to professional advisers under confidentiality, and to a successor if the Service is sold or merged (we would tell you first).
8. International transfers
Your data is stored in the European Union. Cloudflare and Resend are US companies, so there is a possibility of access from or transfer to the United States (for example for support or network operations). For those cases we rely on the European Commission’s Standard Contractual Clauses included in each company’s data processing agreement and, where the company is certified, on the EU-US Data Privacy Framework. You can ask us for a copy of the relevant clauses at info@dreamdrive.ai. Stripe makes its own transfer arrangements as an independent controller.
9. A possible future feature: AI prompt assistant
Dreamdrive has an optional prompt assistant that is currently switched off. If we enable it, it would send the text of a prompt you choose to a third-party model provider (one of OpenAI, Google, DeepSeek, Groq or OpenRouter) to suggest improvements. It would be opt-in, explained in the product before first use, and would never run without your action. We would update this policy and the Subprocessors list before enabling it, and we would configure the provider so that your text is not used to train its models wherever the provider offers that option.
10. Security
We protect data with TLS for every connection, encrypted storage of API keys (AES-GCM), access restricted to the owner’s Google account for administration, verification of Stripe webhook signatures, security headers on the website, and the isolation that Cloudflare’s platform provides. Plain-language detail is in the Security Overview. No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that is likely to put your rights at risk, we will tell you and the supervisory authority as the law requires.
11. Children
Dreamdrive is not intended for people under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, email info@dreamdrive.ai and we will delete it.
12. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy.
- Rectify inaccurate or incomplete data. You can edit most of your records in the product.
- Erase your data ("right to be forgotten"), subject to legal retention duties such as bookkeeping.
- Restrict processing in certain situations, for example while a dispute about accuracy is resolved.
- Portability: receive the data you gave us in a structured, machine-readable format. You can download your captures as CSV and JSON, and the images, from the product.
- Object to processing based on legitimate interest, including usage analytics. We will stop unless we have compelling grounds.
- Withdraw consent at any time where processing is based on consent (waiting list and cheat-sheet emails). Withdrawal does not affect what was done before.
- Complain to a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy@imy.se, www.imy.se. If you live in another EU or EEA country, you can complain to the authority there.
To exercise a right, email info@dreamdrive.ai from the address on your account, or tell us how to verify that you are the account holder. We answer within one month; for complex requests we may extend by up to two further months and will tell you why. Exercising your rights is free unless a request is clearly unfounded or excessive.
13. Cookies and local storage
Our website sets no cookies. Website analytics use a daily-rotating hash instead of a cookie. The website stores your light or dark theme preference in your browser’s local storage, which is not a cookie and is not used for tracking. The extension stores your sign-in token, settings and cached captures in Chrome’s extension storage on your device. Details are in the Cookie and Local Storage Notice.
14. Changes to this policy
We will update this policy when our processing changes, for example before enabling the prompt assistant or adding a subprocessor. The version and date at the top will change. For material changes we will email account holders in advance.
15. Contact
Synthetic White AB, Sjöormsstigen 4, 135 52 Tyresö, Sweden. Email: info@dreamdrive.ai.