Privacy Policy

1. Introduction

Dreamhaze is an app for creating images and videos with artificial intelligence. It is operated by Radiant Labs Limited, a BVI business company incorporated in the British Virgin Islands ("Radiant Labs", "we", "us" or "our").

This Privacy Policy explains how we collect, use, share and protect personal data when you use the Dreamhaze app, our website at dreamhaze.ai and any related services we provide (together, the "Service"). It also explains the choices you have and the rights you may have. Radiant Labs is the controller of the personal data described in this policy.

This policy should be read together with our Terms of Use. Words such as "Inputs", "Outputs" and "twin" have the meanings given to them in the Terms of Use.

2. Information we collect

Information you provide

• Account information. When you sign in with Apple, Apple gives us a unique identifier for your Apple Account and, if you choose to share them when you first sign in, your name and email address. If you use Hide My Email, we receive a private relay address that forwards messages to you. We never receive your Apple Account password.
• Photos and videos. The photos and videos you choose to use, such as selfies for your twin, photos of outfits and reference images or videos. The app receives only the items you select in the iOS photo picker or capture with the camera.
• Prompts and settings. The text you write and the options you choose, such as the model, style, aspect ratio, duration and camera movement.
• Links you paste. When you paste a link to a product page, the app opens that page on your device to find the product image and uses that image as an Input. The store's website receives this request from your device in the same way as when you visit it in a web browser.
• Communications. If you contact us, your email address, the content of your message and anything else you choose to include.

Information created when you use the Service

• Your creations. The images and videos generated for you, and a record of each creation: its prompt and settings, links to its Inputs and results, its status, when it was made and how much of your plan's allowance it used.
• Your twin. The photos you provide for your twin and the reference images generated from them. Section 4 explains how we handle them.
• Subscription and purchase information. When you subscribe through the App Store, Apple sends us details of the purchase, such as the product, transaction identifiers, the purchase and expiry dates, whether the subscription will renew and whether a purchase was refunded. Apple processes your payment, and we never receive your payment card details.
• Usage information. Events that describe how you use the app, for example that you opened the app, started a creation, a creation finished or failed, you saved or shared a result, or you allowed notifications, together with the app version and the time. These events don't contain your photos, videos or prompts.
• Notification tokens. If you allow notifications, a push notification token for your device and, while a creation is in progress, a token for its Live Activity, so we can tell you when your creation is ready.
• Technical information. When the app or our website connects to our servers, our systems and our service providers record technical information such as your IP address, the time and type of each request, and error details.

Information from other sources

• Apple, when you sign in with Apple, and about your App Store purchases and subscriptions.
• Our AI generation provider, which returns your results, their status and the outcome of automated content-safety checks.

Information kept on your device

The app stores your library, your twin's photos and your settings on your device so that it works quickly, and it stores your sign-in session securely in the iOS Keychain. Usage events are held on your device until they are sent to our servers. Deleting the app removes your library and your twin from your device.

3. How we use information

We use personal data for the purposes below. If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, the legal basis for each purpose is shown in brackets, and Section 10 explains these legal bases.

• To provide the Service: to create and maintain your account; to generate the images and videos you ask for; to create and keep your twin; to show your library and restore it when you sign in on another device; and to send the notifications you have asked for. (Performance of our contract with you.)
• To manage subscriptions and usage: to verify purchases with Apple, to apply your plan's features and allowances, and to make sure that a one-time offer, such as a free first video, is claimed only once per Apple Account. (Performance of our contract with you; our legitimate interest in preventing abuse of offers.)
• To keep the Service safe: to detect, investigate and prevent fraud, abuse, security incidents and content that breaks our Terms of Use, including through automated checks of prompts, images and videos. (Our legitimate interests in protecting our users, the public and the Service; compliance with legal obligations.)
• To understand and improve the Service: to use usage and technical information, mostly in aggregated form, to understand which features people use, fix problems and plan improvements. (Our legitimate interest in improving the Service.)
• To communicate with you: to answer your requests and to send important messages about the Service, your account or changes to our terms. We send marketing emails only if you have agreed to receive them, and you can unsubscribe at any time. (Performance of our contract with you; our legitimate interests; your consent for marketing.)
• To meet legal obligations and protect our rights: to comply with applicable law and lawful requests, to enforce our Terms of Use, and to establish, exercise or defend legal claims. (Compliance with legal obligations; our legitimate interests.)

Where we rely on your consent, such as for push notifications or where applicable law treats photos of your face as sensitive data, you can withdraw your consent at any time. Withdrawing consent doesn't affect processing that took place before you withdrew it.

What we don't do

• We don't sell your personal data, and we don't share it for cross-context behavioral advertising or targeted advertising.
• We don't show ads, and we don't use third-party advertising, analytics or tracking tools in the app or on our website. We don't track you across apps and websites owned by other companies.
• We don't use your photos, videos, prompts or creations to train our own artificial intelligence models. Section 5 explains how our AI generation provider may use the content it processes.
• We don't use your photos, videos or creations in our marketing without your permission.
• We don't make decisions about you based solely on automated processing that produce legal or similarly significant effects for you. Automated content-safety checks can stop a creation from being made; if you believe this happened in error, contact us and we will review it.

4. Your face photos and your twin

Your twin is a set of reference images of you, generated from photos you provide, that lets Dreamhaze place you in new scenes and outfits. Because these photos show your face, we handle them with particular care:

• Purpose. We use your photos only to create your twin and the creations you ask for. To do this, we send them to our AI generation provider and, depending on the model used, to that model's developer, as described in Section 5. Under its privacy policy, our AI generation provider analyses facial features in photos only temporarily, to generate the result you asked for, and destroys that information as soon as processing is complete.
• No facial recognition. We don't use your photos to identify or verify you or anyone else, and we don't extract, create or store face templates, face geometry or other biometric identifiers from them. Our Terms of Use don't allow the Service to be used to identify people either.
• Your photos only. Our Terms of Use allow you to create a twin only from photos of yourself.
• Your control. You can delete your twin in the app at any time, which removes it from your device. When you delete your account, we delete the records of your twin from our servers, as described in Section 7.

By creating a twin, you consent to our processing your photos as described in this section.

5. How we share information

We share personal data only as described in this section.

Service providers

We use service providers that process personal data on our behalf and under our instructions to operate the Service:

• Supabase, which hosts our database, authentication and backend functions on servers in the United States.
• Higgsfield, our AI generation provider, which receives your Inputs and prompts, runs each creation or passes it to the selected model, and stores and delivers your Inputs and results through its content delivery network. Under its own terms, Higgsfield may also use the content it processes, including Inputs and results, to train and improve its AI models. For that use, Higgsfield is responsible for the data as an independent controller under its own privacy policy.
• AI model developers. Depending on the model you choose, our AI generation provider may run the model itself or pass your Inputs and prompt to the model's developer to generate the result. These developers include Kuaishou (Kling), ByteDance (Seedance), Alibaba (Wan and Qwen), MiniMax (Hailuo), OpenAI, xAI (Grok), Lightricks (LTX), PixVerse, Recraft and Ideogram. The app shows each model and its developer before you create.
• Apple, for Sign in with Apple, App Store purchases and subscriptions, and push notifications.
• Website hosting and email providers, which host dreamhaze.ai and handle the email we send and receive.

We don't give your name, email address or Apple Account identifier to our AI generation provider or to AI model developers.

Legal, safety and protection

We may disclose information if we believe in good faith that doing so is necessary to comply with applicable law, regulation, legal process or an enforceable governmental request; to enforce our Terms of Use; to detect, prevent or address fraud, security or technical issues; or to protect the rights, property or safety of our users, the public or Radiant Labs. We report apparent child sexual abuse material to the appropriate authorities.

Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy or sale of all or part of our business, personal data may be transferred as part of that transaction. The recipient will be bound by this Privacy Policy or by a policy that gives you equivalent protection.

At your direction

We share information when you ask us to. For example, when you share a creation using the iOS share sheet, the app or service you choose receives it and handles it under its own privacy policy.

Aggregated and de-identified information

We may share aggregated or de-identified information that can't reasonably be used to identify you.

6. International transfers

Radiant Labs is established in the British Virgin Islands. Our servers are located in the United States, and our service providers and AI model developers process data in the United States and in other countries, which may include Singapore, China, Kazakhstan and countries in Europe. These countries may have data protection laws that differ from the laws of the country where you live.

When we transfer personal data from the EEA, the United Kingdom or Switzerland to a country that hasn't been recognised as providing an adequate level of protection, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission and their United Kingdom and Swiss equivalents, or on another lawful transfer mechanism. You can contact us to find out more about these safeguards.

7. How long we keep information

We keep personal data only for as long as we need it for the purposes described in this policy:

• Account information, creation records, twin records, subscription records, usage events and notification tokens are kept while your account exists and are deleted from our database when you delete your account. We also delete notification tokens when you sign out or when Apple tells us that a token is no longer valid.
• Individual creations. Deleting a creation removes it from your library on your device. We keep its record on our servers until you delete your account, so that your plan's usage stays accurate.
• Files held by our AI generation provider. The photos and videos you upload and the results generated for you are stored by our AI generation provider so that they can be delivered to you, and are kept in line with its data retention practices. After you delete your account, these files are no longer associated with you in our systems.
• One-time offers. To make sure a one-time offer, such as a free first video, is claimed only once per Apple Account, we keep a one-way cryptographic hash of your Apple Account identifier for as long as we run the offer. After you delete your account, it is no longer linked to any of your other data.
• Technical logs are kept for up to 90 days, unless we need them for longer to investigate a security incident or abuse.
• Communications with us are kept for as long as we need them to handle your request, and for up to two years afterwards.

We may keep information for longer where the law requires us to, or where we need it to establish, exercise or defend legal claims.

8. How we protect information

We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls that allow only our own backend to access our database, and keys and credentials that are kept on our servers rather than in the app. The app stores your sign-in session in the iOS Keychain.

Your uploaded files and results are stored at long, randomly generated web addresses that we don't publish. Anyone who has the address of a file can open it, so share such addresses only with people you trust.

No method of transmission or storage is completely secure. If we become aware of a security breach that affects your personal data, we will notify you and the relevant authorities where the law requires us to.

9. Your choices

• Notifications. You choose whether to allow notifications, and you can change this at any time in iOS Settings.
• Photos and camera. The iOS photo picker gives the app only the photos and videos you select. You can allow or deny camera access in iOS Settings.
• Your email address. You can use Hide My Email when you sign in with Apple, and you can manage Sign in with Apple for Dreamhaze in your Apple Account settings.
• Your twin and creations. You can delete your twin and individual creations in the app at any time.
• Your account. You can delete your account in the app's Settings. This deletes your account and the associated data on our servers as described in Section 7, and removes your library from the device you use to delete it. Deleting your account doesn't cancel an App Store subscription. To stop being charged, cancel the subscription in your Apple Account's subscription settings.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal data: to access it and receive a copy; to correct it; to delete it; to receive it in a portable format; to restrict or object to its processing; to withdraw your consent; and not to be subject to decisions based solely on automated processing that significantly affect you.

How to exercise your rights

You can delete your account directly in the app. To exercise any other right, email privacy@dreamhaze.ai. To protect your data, we may need to verify your identity before we respond, for example by asking you to write to us from the email address linked to your account or to confirm details of your account. We respond within the period required by applicable law, which is usually one month. We don't charge a fee unless a request is manifestly unfounded or excessive.

EEA, United Kingdom and Switzerland

We process personal data on the following legal bases: the performance of our contract with you, where the processing is necessary to provide the Service you have asked for; our legitimate interests, where they aren't overridden by your interests or fundamental rights and freedoms; your consent; and compliance with our legal obligations. You have the right to object at any time to processing based on our legitimate interests. You also have the right to lodge a complaint with the data protection authority of the country where you live or work, or where you believe an infringement took place.

British Virgin Islands

We process personal data in accordance with the Data Protection Act, 2021 of the Virgin Islands, which gives you rights including the right to access and correct your personal data.

United States

Residents of California and of other states with comprehensive privacy laws, such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon, may have the right to know what personal data we collect and how we use and disclose it; to access, correct and delete it; to receive a copy of it in a portable format; and to opt out of the sale or sharing of personal data, targeted advertising and certain profiling. We don't sell or share personal data, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects.

You can make a request yourself or through an authorised agent. We may ask an authorised agent for proof of their authority and may ask you to verify your identity directly. If we decline your request, you can appeal by replying to our decision. If we deny your appeal, you can contact the Attorney General of your state. We won't discriminate against you for exercising your rights.

Notice to California residents

In the preceding 12 months, we have collected the following categories of personal information and disclosed them for business purposes to the service providers described in Section 5:

We use this information for the purposes described in Section 3 and keep it for the periods described in Section 7. We don't use or disclose sensitive personal information for purposes that would give you the right to limit its use under California law, and we don't collect or use personal information to infer characteristics about you. We don't sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. We don't disclose personal information to third parties for their own direct marketing purposes.

11. Children

The Service is intended only for adults aged 18 or over, and we don't knowingly collect personal data from anyone under 18. Our Terms of Use don't allow photos or videos of anyone under 18 to be uploaded. If you believe that a child has provided us with personal data, contact us at privacy@dreamhaze.ai and we will delete it.

12. Our website

Our website, dreamhaze.ai, doesn't use cookies, analytics, advertising pixels or other tracking technologies, and it serves its fonts, images and videos itself rather than loading them from third parties. The provider that hosts the website processes technical information, such as your IP address, browser type and the pages you request, to deliver the website and keep it secure. Buttons that link to the App Store take you to Apple's website, which is governed by Apple's privacy policy.

13. Third-party services

The Service links to and works with services operated by others, such as the App Store, online stores whose links you paste into the app, and apps you share your creations to. Those services handle your data under their own privacy policies, not this one.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you in the app or by email before they take effect. The "Last updated" date at the top of this page shows when this policy was last revised.

15. Contact us

If you have any questions about this Privacy Policy or how we handle personal data, contact us: