Privacy Policy

DreamLabs Private Limited (UEN 202642436W) operates DreamBench at dreambench.ai. Our registered office is 21 Simei Street 4, #12-39, Double Bay Residences, Singapore 528717. Our Data Protection Officer handles privacy questions and requests at [email protected]. Use the subject “Privacy”.

This policy explains how we handle personal data when you use DreamBench or contact us. Our Terms of Use govern use of the Service.

1. Information we collect

• Registration: your name and email address.
• Projects and generated content: prompts, scripts, uploaded images, audio, video, other project materials, and generated plans and media. These may contain personal data about you or other people.
• Transactions and service activity: subscription, credit, payment-status, and generation records needed to operate the Service. Stripe processes payment details; we also process the account, billing, usage, device, and security information needed to operate and protect the Service.
• Analytics information: activity and measurement data collected through PostHog, our product analytics. Depending on your choices, this includes page and event information, device/browser information, IP addresses, and cookie or other identifiers. Section 7 explains your choices.
• Communications and choices: information you send in support messages, feedback, complaints, or privacy requests, and records of applicable consent and opt-out choices.

Information comes from you, people who upload content about you, and relevant service providers. We describe recipients and their roles in section 3. The name and email fields used at registration do not describe all data processed through projects, transactions, or tracking.

Do not upload unnecessary sensitive information such as identification numbers, payment credentials, or medical records. Our Terms require appropriate permission for use of real people’s likenesses or voices.

2. How and why we use information

We use personal data to provide accounts and generations, store and deliver projects, administer subscriptions and credits, answer requests, protect the Service, investigate unlawful activity and abuse, maintain reliability, send essential notices, and meet applicable legal obligations. Product analytics is described in section 7; we do not use personal data for advertising.

Under Singapore’s PDPA, we obtain consent where required or rely on a specific lawful exception only where its conditions are met. Accepting our Terms is not blanket consent to optional processing.

Where EU or UK GDPR applies and we act as controller, our grounds are:

A contract with an uploader is not automatically a lawful basis for everyone depicted. Processing sensitive categories requires any additional legal condition that applies.

We determine our own account, billing, and operational purposes. When processing personal data solely on a business customer’s instructions, we act as its processor/data intermediary, or subprocessor, under the applicable written agreement. That customer’s notice governs its purposes. Contact [email protected] to arrange any required processing agreement before that processing begins.

3. AI processing and service providers

To fulfill a generation, the relevant planning, image, video, audio, and other providers receive the prompts, reference media, generated content, and request information needed for their function.

Our training policy. We do not use customer prompts, uploads, or Outputs to train or fine-tune AI models. If we introduce an optional training program, we will seek separate opt-in permission before using content for that purpose. Agreeing to our Terms or purchasing a plan is not that permission.

Provider practices. Providers’ content use, retention, safety review, and any human access depend on the API service and contractual settings. The provider-specific conditions are listed below.

OpenRouter forwards requests to underlying model providers. Their practices can differ, including whether they retain Inputs or Outputs or use them for training or improvement. The applicable API and model terms govern each route. We select providers and settings intended to limit retention and model-improvement use, but practices vary by provider and model.

Providers used by DreamBench

Some providers process data on our instructions; others have independent responsibilities, such as payment-fraud prevention. Their applicable roles are identified above. We update this section when providers change and give additional notice or an opportunity to object where required by law or a customer agreement.

4. Project privacy and other disclosures

Projects are private by default. We do not currently offer public project links, a public gallery, team collaboration, or project-sharing features. Generating content does not authorize us to publish it. We do not use private projects in public showcases or advertising without separate permission.

We permit access to content only for relevant service delivery, support, security, complaint handling, or legal purposes. Private projects still require processing by the providers involved in delivering the Service.

We may disclose relevant information to advisers bound by confidentiality, parties to a business transaction with appropriate safeguards, or competent authorities where lawfully required or justified. Complaint handling may require sharing necessary notice or response details with another party, with notice where appropriate and lawful.

Analytics is described in section 7. We do not sell personal data, and we do not share it for advertising.

5. Overseas processing

We are based in Singapore. Providers and their subprocessors may process personal data outside Singapore and outside your country of residence. The relevant processing locations and arrangements are described in section 3 and below. Where Singapore law requires, overseas recipients must provide a standard of protection comparable to the PDPA through appropriate arrangements. Where EU/UK transfer rules apply, restricted transfers require an applicable lawful mechanism and any necessary supplementary safeguards.

The countries involved can vary by provider and request. We use contractual, technical, or other safeguards required by applicable law and can provide further information on request. Contact [email protected] for information about applicable safeguards and copies where required, subject to appropriate confidentiality protections.

6. Retention and security

We keep personal data for the purposes explained in this policy, applicable legal obligations, and justified claims. When no longer needed for a lawful purpose, we delete or genuinely anonymize it. Valid rights requests may require earlier deletion, subject to applicable exceptions.

We retain the minimum information needed to respect marketing opt-outs. Legal holds do not authorize unrelated use of retained content. Contact [email protected] to request deletion. If you have a subscription, we cancel it before closing your account; financial records required by law may remain after closure.

We use encryption to help protect personal data. No system is entirely secure. We assess incidents and notify customers, authorities, or affected people as required by applicable law.

7. Analytics, cookies, and marketing

We use PostHog to understand how the Service is used and to improve it. We do not use advertising tags or pixels. The events, identifiers, retention, and any optional replay features depend on the current PostHog configuration and your choices.

In the EU, the EEA, the UK, and Switzerland, and wherever we cannot tell where you are, analytics cookies are used only after you accept them in the cookie banner. Until you choose, and if you reject them, analytics in your browser stays anonymous, without cookies or anything stored on your device. Elsewhere, analytics cookies are on by default and you can turn them off. Essential cookies, which keep you signed in, protect your account, and remember your language, are always on. Refusing analytics does not prevent core service use. Separately, our servers record account events, such as a sign-up, a purchase, or a finished generation, to operate and improve the Service; this does not use cookies.

You can change your choice at any time under “Privacy choices” in the site footer or the account menu. If your browser sends Do Not Track, we do not run analytics for you. If it sends Global Privacy Control, we treat it as rejecting analytics cookies and as a request to opt out of any sale or sharing of your personal data; analytics in your browser then stays anonymous, as above.

We are not currently sending marketing emails. If we introduce them, we will provide the required notice, obtain consent where required, and provide an unsubscribe option in each marketing email. Necessary billing, account, and security notices may continue after a marketing opt-out.

8. Your rights, account decisions, and children

Contact [email protected] with the subject “Privacy” to request access, correction, deletion, withdrawal of consent, or information about our data use. Rights depend on applicable law and may have exceptions; some records must be retained. We use proportionate identity verification. For Singapore access requests, if we cannot respond within 30 days, we will tell you in writing within that period when we can respond.

Where applicable, EEA/UK residents may also have rights to portability, restriction, objection, and safeguards for certain automated decisions. The ordinary GDPR response period is one month, subject to lawful extensions and notice. You may complain to your competent supervisory authority or the UK ICO. US residents may have additional state-law rights, including applicable opt-outs, authorized-agent requests, and appeals. We provide any additional representative, appeal, or regional request information required for the relevant jurisdiction.

Accounts may be suspended for illegal activity under our Terms. Contact [email protected] to challenge a decision or explain an error. We may use automated tools to flag suspected abuse or security risks, with human review or an opportunity to contact support where required by law.

Accounts are for adults aged 18 and over. Our Terms prohibit real-child depictions. If a child nevertheless provides data, or their information appears in prohibited uploads, contact us. We will assess and remove or restrict it as appropriate, while preserving information where legally required. Do not resend suspected child sexual abuse material to prove a report.

9. Changes and contact

We will explain material policy changes and obtain consent where required before new uses begin. A policy update alone does not authorize a different use of existing data.

Data Protection Officer: [email protected] (also our support address)
DreamLabs Private Limited (UEN 202642436W)
21 Simei Street 4, #12-39, Double Bay Residences, Singapore 528717

You may also contact Singapore’s Personal Data Protection Commission.