DreamWild

DreamWild Privacy Policy

Effective 12 November 2026.

Privacy Policy URL:

https://dreamwild.ai/privacy

DreamWild is supplied by Genesis Vanguard Pty Ltd (ACN 675 551 783) (ABN 45 675 551 783), trading as DreamWild Labs, 388 George Street, Sydney NSW 2000, Australia. “We”, “us” and “our” refer to that company. Our privacy contact is support@dreamwild.ai, and our full contact details are under “Contact us” at the end of this policy. This policy covers DreamWild's website, accounts, creative studio, payments and connected publishing features.

Our role and this policy

We handle information to operate the website, manage accounts and payments, provide creative tools, respond to requests and protect the service. This policy explains those activities and the choices and rights available to you. It is an explanation of our practices, not consent to unrelated uses or a waiver of your rights.

We decide how information is handled for our account, transaction, security and business administration. Where a business customer provides personal information for processing solely on its instructions, we handle it under the agreed Data Processing Addendum and those instructions.

We apply the privacy laws that govern each activity. Australian law includes the Privacy Act and Australian Privacy Principles where they apply. Other laws may apply because of your location, the people represented in content or the nature of the processing. We do not rely on your acceptance of this policy to override those laws.

Information we collect

Account information includes your email address, DreamWild account identifier, profile information and access-related communications. You can use an emailed sign-in link or Google sign-in. Google sign-in requests email, profile and OpenID permissions. We receive Google's account identifier, verified email address, name and picture URL if supplied. We use them to create or identify your account and authenticate access.

The sign-in connection can retain the returned access token, ID token, refresh token if Google supplies one, granted-scope and expiry information, and account timestamps. We do not request offline access in this basic sign-in flow. Stored access and refresh tokens are encrypted by the authentication service; the ID token is retained as part of the protected account record.

Google sign-in can link to an existing DreamWild account with the same verified email address only when both providers' verification checks pass. An existing verified account can also explicitly connect Google. Sign-in sessions expire after seven days without an automatic sliding extension. That expiry does not erase the underlying account and connection records.

Google sign-in does not connect a YouTube channel or authorise uploads. The separate YouTube connection and publishing information is described below. Neither sign-in method asks you to send your Google password to DreamWild.

Creative information includes prompts, scripts, reference images, voice or other audio you supply, uploaded media, project settings, generated images, recordings, video, captions, output history and associated job records. It can include information about you and other people. A generated statement or depiction can itself contain personal information, even if it is inaccurate or synthetic.

If you request publishing, we also keep your selected completed asset and version, destination, metadata, visibility, publishing consent, schedule and delivery state. This records the instructions you gave; it is not permission for broader publishing or generation.

If you turn on the end card when you download a film, the file you download ends with a short card showing your creator handle and your creator link. We make that copy for the download and may keep it for a limited time to serve later downloads; the film stored in your project does not change. If you turn on a watch page for a film, anyone with its link can watch the film at dreamwild.ai with its title, style and poster, “Made with DreamWild”, and your creator handle and link if you are an active creator, and search engines may index the page while it is on. We keep the page's record, including its link, the film and whether the page is on, until your account is permanently deleted; a page you turn off stops showing the film. We may take down a watch page that breaks our Terms, and we record when and why. Anyone you share a film with can see, keep and pass on what the end card or the watch page shows.

Billing information includes plan and subscription details, payment and invoice identifiers, payment status, credits, approved quotes, transactions and consent records. Stripe collects payment-method details through its payment interface. We receive information needed to administer the transaction; we do not ask you to email full card details or security codes. If you answer the optional question about why you are cancelling, we keep your answer and any note you add with your account, use them to understand and improve DreamWild, and delete them with your account. Please do not put sensitive information in a note. Where the GDPR or UK GDPR applies, our basis is our legitimate interest in understanding why customers leave, and you can object by emailing support@dreamwild.ai. We may ask how you heard about DreamWild. If you answer, we keep your answer and any words you add with your account, together with the source and any creator code recorded for your latest checkout; a later answer replaces the earlier one. We also record where each checkout you start came from, including any creator code, and keep those records for about 120 days. We use them to understand how people find DreamWild and to improve our marketing, and we delete your answer with your account. Where the GDPR or UK GDPR applies, our basis is our legitimate interest in understanding how customers find us, and you can object by emailing support@dreamwild.ai.

Affiliate information applies if you join the DreamWild Affiliate Program. It includes your handle and link; the clicks, sign-ups, referred payments, commission and payouts recorded against your link; your payout method and payout details, such as a PayPal or Wise account or a USDT wallet address; the tax information we ask for, such as your ABN or a supplier statement, your country and tax forms; and the identity and traffic information you give us when we check your account or your promotion. When someone opens an affiliate link, we record which link they opened, when, and a one-way code derived from their network address. If they create an account, we may keep that record on it. For fraud checks, we compare an affiliate's account, login email and name with the payment details of the customers credited to them, using one-way codes of the email and name and the card fingerprint our payment processor provides, never full card numbers. We also keep the card fingerprint of every customer's payments, so we can check whether a customer credited to an affiliate has paid before on another account. We delete it when the account is deleted. You can enter your payout details in your account yourself: a PayPal email address; a Wise email address and the account holder's name; or a USDT network and wallet address. We store them encrypted under a secret key held by our billing system, show them back to you only in part, ask you to sign in again before you change them, and record when they change. We use them to pay you and for the checks described in this paragraph, and we delete them when your account is permanently deleted.

Technical information can include IP address, browser and device information, session identifiers, timestamps, request and error logs, security signals, and records of how an operation or support issue occurred. Necessary cookies and local or session storage support sign-in, return navigation, billing retries and preferences you request. Optional tracking is explained below. A cookie-free analytics product can still process technical information.

Support and legal-request information includes your message, relevant account or order information, attachments you choose to send, and information needed to verify an entitlement or investigate a complaint. We ask for proportionate verification, rather than collecting identity documents by default.

We collect information from you, your use of the service, authorised account users, payment and infrastructure providers, the links you submit, Meta when you connect an Instagram or Facebook account, and people who submit a relevant support, rights or safety report. We do not need every category for every customer.

Why we handle information

We use necessary account and technical information to create and secure accounts, authenticate access, route requests and provide the functions you request. Creative information is processed to generate, edit, store, retrieve and deliver your projects and outputs. We may also use creative information, de-identified where practicable, to analyse and improve DreamWild.

We may combine information about how DreamWild is used across many accounts into aggregated statistics, such as which formats, hooks, video lengths and styles customers make, keep and schedule for publishing, and we may publish, share and commercialise those statistics. We make them so that no one is identified or reasonably identifiable from them, and we take reasonable measures to keep them that way. We publicly commit to keep them deidentified and not to try to re-identify anyone from them, except solely to test whether our deidentification works, and any contract under which we give them to another business requires that business to meet the same conditions. We never build them from information we receive from YouTube API Services, information we receive from Instagram or Facebook through a connected account, or material from links you submit. Where the GDPR or UK GDPR applies, our basis for creating them is legitimate interests, which are our interests in understanding how DreamWild is used and in publishing and selling insight into what works in short video; you can object at any time by emailing support@dreamwild.ai, and we will leave your information out of statistics we create after that.

We use billing and approval records to take authorised payments, provide allowances, quote and reconcile work, correct errors, process refunds and keep records required by law. We use relevant information to investigate abuse, protect other users, resolve disputes, respond to lawful requests and establish or defend legal claims.

If you are an affiliate, we use affiliate information to run the Affiliate Program: to credit referrals; to calculate, hold, pay and take back commission; to verify your identity and payout account before we pay you; to meet tax, record-keeping and sanctions obligations; and to detect and prevent self-referral, fraud and abuse.

We use proportionate operational information to understand reliability and improve the service. Using a private project to supply or debug that project is different from using it to train a shared model or promote the product. Those additional uses are addressed separately below.

We use service email for sign-in and responding to you, and to communicate necessary security or service information. We send marketing emails, including reminders about a checkout you started and did not finish, where you agreed to them when you gave us your email (for example, by continuing after a notice that says so) or where the law otherwise allows. If you enter your email at checkout and do not complete the purchase, we keep it only to send those reminders and delete it when they end, when you complete the purchase or create an account, or when you unsubscribe. Every marketing email includes an unsubscribe link; we stop marketing within five business days after an unsubscribe request. We do not use your Google sign-in details for marketing. Necessary account and security messages remain separate.

If you do not provide information needed for a particular function, we may not be able to provide that function. We will explain that consequence where it is not obvious. Optional information and optional marketing permissions are not required merely to exercise a privacy right.

Google and YouTube data

DreamWild uses YouTube API Services for its optional publishing and channel analytics features. You choose whether to connect a channel through Google's permission screen. The youtube.force-ssl permission allows us to upload your selected video, verify channel and video state, and complete authorised metadata and visibility changes. The yt-analytics.readonly permission lets us show views, watch time, subscriber gains and losses, and aggregate video performance for the dates you select. Existing publishing connections can reconnect to add analytics permission. These permissions are separate from Google sign-in. We do not request monetary analytics, Gmail, Drive or contacts access, or read the text of YouTube comments through these features.

Competitor Intel also uses YouTube API Services, with DreamWild's own API key rather than your Google permission, to show public information about YouTube channels and videos you choose. We store the channels you track and the public details of up to 500 recent videos for each tracked channel, refresh them at least weekly and delete anything not refreshed within 30 days. We do not combine figures across channels.

Our YouTube data notice is at: https://dreamwild.ai/youtube-data/

When you submit a YouTube link, we may read the video's public details, such as its title, description and thumbnail, through YouTube API Services with DreamWild's own API key, to use in your project. We refresh or delete those details within 30 days.

Analytics reports are cached in memory for up to five minutes for the connected account, channel and date range. They are not written to a persistent analytics store. Stopping use of a channel, reconnecting, or requesting YouTube data removal clears the relevant cache. Reports from an older connection cannot refill it after those changes. Recent reporting dates may be unavailable or delayed by YouTube.

Google describes this permission as allowing an app to view, edit and permanently delete YouTube videos, ratings, comments and captions. DreamWild's publishing feature uses it for the stated upload, read-back and update actions; it does not delete your YouTube videos, rate videos or read, post or delete comments. The broader permission is needed for the video-update operation, even though these other actions are not offered.

Before using the YouTube feature, you must agree to this Privacy Policy. A new use of Google or YouTube data outside your existing permission requires an updated explanation and fresh consent before it starts.

We receive the connected channel's identifier and name, access and refresh credentials, and upload, processing and delivery information. We store each connection's channel identifier, channel name and credentials; for each upload, the YouTube video identifier, its visibility, processing and delivery status, and any thumbnail we read for the thumbnail controls; and the schedules you approve or your rules create. We also keep your channel's name, picture, handle and public subscriber and video counts, refreshed at least every 30 days, to show your channel in DreamWild. Stored YouTube credentials and resumable-upload session addresses are encrypted and bound to the relevant customer and destination. Google receives the finished video and the approved title, description, privacy, audience and synthetic-media settings. Our configured Cloudflare services store and process the records needed to perform, reconcile and show these actions.

Connecting does not approve publication. DreamWild uploads a video to YouTube only when you approve its schedule or when it matches an automatic publishing rule you have activated. You can review each video and its publishing details before approving a schedule, or explicitly enable an automatic publishing rule. An automatic rule records your chosen channel, completed-video selection, metadata settings and schedule, and your permission to publish matching future completed videos without individual review. Creating a rule leaves it inactive. You can pause it; an upload already sent to YouTube may still finish.

DreamWild's use of information received from Google APIs, and its transfer to another app, adheres to the Google API Services User Data Policy and its Limited Use requirements. We do not sell it, use it for advertising or credit/lending decisions, or use it to train shared or general-purpose models. We ask for your explicit consent before transferring Google user data in a merger, acquisition or sale of assets. Our staff view it only with your agreement, for security, to comply with law or in a permitted aggregated form for internal operations. Service providers receive it only for the requested features and other uses expressly permitted by that policy.

The Google API Services User Data Policy is at:

https://developers.google.com/terms/api-services-user-data-policy

The YouTube delivery service sends Google the selected video and approved metadata, and Cloudflare hosts the connection and delivery records. It does not route YouTube grants, channel data or provider receipts to AI generation services.

Google's own handling is described in its Privacy Policy:

https://www.google.com/policies/privacy/

Use of the YouTube feature is also subject to the YouTube Terms of Service:

https://www.youtube.com/t/terms

Stop using a channel or remove YouTube data

“Stop using channel” stops publishing through that connection and starts the cleanup of its stored Google credential. We check whether the same Google authorisation is still needed by your other verified, active connections. If it is, their access continues and only the stopped connection's credentials are removed; if it is not, we ask Google to revoke it. Stopping one connection does not remove your other YouTube data or pause unrelated connections. Uploads already sent may still finish, and stopping does not delete videos already on YouTube. The stopped connection's data, provider details and the credentials held for its cleanup are deleted within seven days of your request.

To withdraw DreamWild's Google access and remove your YouTube data, open “AutoPilot” in the studio, choose “Manage channel” and use “Revoke Google access and remove YouTube data”, or use your Google Account settings. The removal covers every channel and workspace in your DreamWild account. It cancels future publishing work, promptly asks Google to revoke each authorisation DreamWild still holds, including those of channels you stopped using, and deletes your YouTube connections, credentials, publishing schedules and delivery records within seven days of your request. Retries do not extend that deadline. The app reports the status of the removal; a request already sent to Google may still finish. If Google does not confirm a revocation, local deletion still goes ahead and the app shows that revocation is unconfirmed, with a link to your Google permissions. Revoking a Google authorisation can affect other DreamWild connections authorised with the same Google account, including connections outside your DreamWild account.

After removal, we keep only minimal internal request references and the time of removal, which stop an old upload request from starting again. They contain no Google credential, YouTube channel identifier, video identifier, title or description. Cleanup receipts report the result without naming a channel or Google account.

Your DreamWild projects, source media and videos already uploaded to YouTube remain after YouTube-data removal. Stop billing separately if you also want to cancel a subscription. Manage or delete a video held by YouTube through YouTube's own controls.

You can also revoke DreamWild's Google access in your Google account settings. Revocation can affect other DreamWild connections authorised through the same Google grant:

https://security.google.com/settings/security/permissions

We check connected authorisations and channel details daily. If you revoke access in Google Account settings, an invalid permission detected by those checks stops further authorised use and triggers local cleanup. We refresh or delete stored YouTube data within 30 days. If a connection's channel details cannot be refreshed for 30 days, we stop using it and delete its channel identifier and name. We delete an upload's YouTube details (video identifier, visibility, processing status and any thumbnail we read) 30 days after we last confirmed the upload with YouTube. Expired or partly removed provider history is not presented as a newly verified publication.

You can delete your account yourself under Account, Profile, Delete Account, confirmed with a code we email you, or by contacting support@dreamwild.ai. Deleting your account also starts the YouTube-data removal described above, which cannot be undone. To delete only some information, contact support@dreamwild.ai; sign-out or session expiry does not delete anything.

How we use, process and share Google and YouTube information

This section brings together what DreamWild receives through YouTube API Services, how we use and process it, and who receives it inside and outside DreamWild. “Who receives information” below covers everything else.

What we receive. Through the channel connection you authorise on Google's permission screen, we receive your channel's identifier, name, handle, picture and public subscriber and video counts; the access and refresh credentials Google issues; for each video we upload for you, its YouTube video identifier, visibility, processing and delivery status and any thumbnail we read; and, when you open Stats, your channel's analytics reports. Through DreamWild's own API key, without your Google permission, we read public information about YouTube channels and videos: the channels you track in Competitor Intel and their recent videos; the title, description, channel and thumbnail of a YouTube link you add to a project; and public Shorts that match your idea when you ask the studio to research topics.

How we use and process it. We use the information from your connection only to show you your channel, upload the videos you approve with the details you approve, check and show each upload's status, set the thumbnails you choose, show your analytics and email you when an upload is waiting for you to make it public. We use public information to show it to you and to make the project you ask for: the public title and description of a YouTube link you add, and the titles and view counts of public Shorts found for your idea, are sent to the AI service that writes your script or your topic ideas. We store and process this information on our cloud hosting provider's servers, encrypt stored YouTube credentials, keep analytics reports in memory for up to five minutes, and refresh or delete stored YouTube information on the schedule described above. We never send your Google credentials, your channel's analytics or other information we receive through your Google permission to an AI service. We do not sell information we receive through YouTube API Services or use it for advertising, and we never use it for training, as described under “AI providers and content processing”.

Inside DreamWild. Only the staff and contractors who need it to run, support or secure DreamWild can access this information, each bound by confidentiality obligations and only for that purpose. They view information we receive through your Google permission only as described in “Google and YouTube data” above. No other DreamWild customer can see your connected channels, publishing records or analytics.

Outside DreamWild, by category:

Links you submit

When you submit a link, we retrieve what your project needs from it: the video or audio, its public details (such as its title and the creator's caption and handle), or both. We use link retrieval services for this: they receive the link you submit and return the file and its public details to us. We keep them with your project and use them only to make and deliver it. We send the details and parts an operation needs to the AI provider that performs it, such as the title and caption to the provider that writes your script. We never use material from links for training, in our marketing or as a reusable element. We delete the video, audio and image files we retrieved 30 days after we deliver the latest video for that project, or sooner when you delete the project or your account. The link and a record of when we retrieved it stay with the project and are deleted with it.

A link a customer submits can show you or contain your personal information. If it does, we process your image, voice and other information in it only to make that customer's project; where the GDPR or UK GDPR applies, our basis is legitimate interests. We do not use it to train models, in our marketing or to identify you. You can object or ask us to remove it by emailing support@dreamwild.ai, and we remove it within 48 hours of a valid request.

Instagram messages

When you comment on or message @dreamwild.studio, we receive your Instagram username, your Instagram-scoped ID, your comment or message, and any email address you choose to send us. We use them only to reply to you and, if you ask, to send what you requested. We keep them for as long as the conversation is useful to answering you and delete them within seven days of your request to support@dreamwild.ai.

Instagram and Facebook connections

If you connect a Facebook Page and the Instagram professional account linked to it, Meta gives us an access token for them, and the Page's and account's identifier, name, username and profile picture. For each post we publish, we receive its media identifier, link and status. We use them only to show you where a video will be posted, to publish the videos you choose to post when you choose to post them, and to show you the result. Connecting an account never posts anything on its own. To publish a video, we give Meta a private link to that video's file, which stops working within a few hours, with the caption and settings you approved.

We store access tokens encrypted. We do not read your followers, messages, comments or insights. We never sell information we receive through a connected account, use it for advertising, send it to AI providers or use it for training.

“Stop Using This Account” in DreamWild deletes the token at once. You can also remove DreamWild in your Facebook settings (Settings and privacy, Business integrations) or your Instagram settings (Apps and websites), or email support@dreamwild.ai. When Meta tells us you removed DreamWild, we delete the token and your publishing records within 7 days and give you a confirmation code with a page where you can check the deletion's status:

https://dreamwild.ai/data-deletion

Deleting your DreamWild account starts the same deletion at once, without waiting for the 30-day restore period. None of this deletes posts already published; manage or delete them in Instagram or Facebook. Meta's own handling is described in its Privacy Policy:

https://www.facebook.com/privacy/policy

AI providers and content processing

DreamWild uses third-party AI services. Depending on the operation, relevant prompts, text, voice selections, reference images, generated stills or other media may be sent to the provider needed to perform it. Processing is not limited to text, and does not necessarily occur in Australia.

For creative operations, we use OpenAI for selected script-related processing, Inworld for narration and selected fal image/video routes and their model partners. Content is sent only to the provider needed for the chosen operation.

Provider processing can include service delivery, security and abuse monitoring, and retention required by its agreed service terms or law. Providers and account settings differ.

We do not use the content licence in our Terms as permission to sell Your Content or publish private projects in advertising. Unless you turn off “Help improve DreamWild” in Account Settings, we use Your Content and the Output generated for you, including any personal information they contain, to train, tune and improve DreamWild's own models, styles and tools, as our Terms describe; once you turn it off, we stop adding your new Content and Output to that training. We never sell them; never use material from links you submit, information we receive from YouTube API Services or information we receive from Instagram or Facebook through a connected account for that training; and never offer a model trained on your content to anyone outside DreamWild. We will obtain separate permission before naming you or showcasing a private project in marketing. Unless you opt out, we may show Output that you have published publicly in our marketing, without naming you, other than Output that contains material from a link or shows a real, identifiable person other than you.

Do not upload material you are not authorised to submit. Highly sensitive information, confidential records, identifiable images and voices require the necessary permissions and safeguards. A biometric template can be sensitive information regardless of whether it is used for identification. We do not create voiceprints or voice clones from audio you upload.

Photos of real people. You can upload a photo of yourself, or of someone who gave you permission, to make a video. Everyone shown must be 18 or over, and before your first upload you confirm both with a permission box. We keep a record of that tick with your account: the wording you saw and the time. Before we make a video, we ask OpenAI to check your photo for sexual content, and our video providers run their own checks on what they receive. We give the video provider a one-way code derived from your account identifier, so it can trace abuse to an account without receiving the identifier itself. If a check flags your photo, we keep a record of the flag with your account: the time, the project and the category. Repeated flags, or a single flag involving children, can pause uploads on the account until a person has reviewed it. If you appear in content made with DreamWild without your permission, email support@dreamwild.ai with a link or description, and we will remove it from our service, including copies we hold, within 48 hours of a valid request. We may give relevant information to the police, the eSafety Commissioner or another authority.

Copyright and other complaints

When you send a notice, counter-notice or other complaint about content, we keep its contents, your name and contact details, the material concerned and what we did. We use them to handle the complaint, to meet our obligations under the EU Digital Services Act and US copyright law, to keep repeat-infringer records and to establish or defend legal claims. Where the GDPR or UK GDPR applies, our basis is legal obligation for the first two purposes and legitimate interests for the others.

The account holder receives a copy of a copyright or trade mark notice with your name or organisation and the email address you gave, never your telephone number or postal address, and you may act through an authorised agent or lawyer instead. For any other complaint, including about your image, voice or privacy, we do not tell the account holder who you are unless you agree or the law requires it. The person who sent a notice receives a counter-notice in full, including its sender's name, address and telephone number, because US law requires it. We may disclose an account holder's identity when a valid subpoena or court order requires it, including a subpoena under 17 U.S.C. 512(h). Where a recipient is in another country, we send the information because it is necessary for legal claims. We keep these records for 3 years after our last action on the complaint.

Who receives information

We disclose information only as reasonably needed for the purposes explained here, including to providers of hosting, databases, storage, authentication delivery, payment processing, AI generation, support and security. Providers should receive the information necessary for their role, rather than unrelated account content. Where we engage a provider to act on our instructions, appropriate contractual and security arrangements are required.

We use Cloudflare for hosting, storage and security, Amazon Web Services (AWS) for hosting the tool we use to answer Instagram comments and messages, Stripe for payment processing, Resend for service-email delivery, link retrieval services for the links you submit, and Google for optional sign-in, YouTube integration and incoming support email. When optional measurement is on, Meta Platforms, Google and Microsoft provide advertising measurement, ad delivery and website analytics, and we use PostHog to understand visits, signup and checkout completion, successful video creation, downloads and repeat use. We use PostHog's US Cloud region. The AI providers above receive the content needed for their selected operations. Some suppliers, including payment services, also act independently for fraud prevention or legal obligations; they are not all processors for every activity.

For the Affiliate Program, we share payout and tax details with our payout providers, such as PayPal, Wise and the USDT network and wallet services we use, and with tax authorities where the law requires.

If you sign up or buy through a creator's link on or after 12 November 2026, we tell that creator when your first payment is made and may show them your first name, so they know which friend joined. We never show them your surname, email address, payment details or what you make.

Authorised people may access relevant information for support, administration, security or legal obligations, limited to the permitted purpose. Google-data access is subject to the more specific restrictions above. Your connected-channel and publishing information is not shared with unrelated DreamWild customer accounts. DreamWild has no shared workspaces or collaborators, so only you can see your projects, connected channels and publishing records in DreamWild.

We may disclose proportionate information to professional advisers, insurers, courts, regulators or law enforcement where there is a lawful basis. We may also disclose information reasonably needed to investigate a serious threat or defend a claim. An allegation alone does not justify handing a complainant an entire account or an unrelated person's information.

In a genuine business sale or reorganisation, relevant information may be disclosed subject to confidentiality and safeguards, and transferred to a successor that takes responsibility for the service. We will notify affected users where required. This is not permission for unrelated resale of personal information.

Website notifications, cookies and optional tracking

If you requested a launch notification, we use that address for the requested message and relevant consent administration. A launch-list entry is not a subscription or consent to unrelated marketing. Each launch email includes an unsubscribe link, and you can also email support@dreamwild.ai. We stop those messages within five business days and may retain a limited suppression record to honour your choice. When someone joins the launch list after accepting optional measurement, our server sends Meta a one-way hash of the email address, with the IP address, browser information and Meta identifiers, and sends Google the analytics identifier, to measure signups from our advertising. It sends nothing for an address already on the list.

Necessary browser storage supports sign-in, return navigation, billing retries and preferences you request. Some records persist until replaced or cleared. Browser settings can remove or block storage, although blocking required storage may prevent the requested function from working.

If you open an affiliate's link, a referral cookie records that link for 90 days so the affiliate can be credited if you sign up or buy. In the European Union, the European Economic Area, the United Kingdom and Switzerland, and wherever we cannot tell your country, we set it only after you choose Accept in our cookie bar. Our Cookie Notice lists it. We also work with Trybe (jointrybe.com), a creator marketplace. Our site loads Trybe's measurement script, which sets its own cookie for up to a year and records your visits; when you arrive from a Trybe creator's link we also keep a cookie for 7 days. If you then buy, and you did not open a DreamWild affiliate link after that Trybe link, we tell Trybe the order number, the amount and your email address (Trybe stores the email only in hashed form) so Trybe can credit the creator who referred you; otherwise Trybe is not told about your purchase. In the EU, EEA, UK and Switzerland none of this happens until you accept cookies.

Cloudflare Web Analytics collects page-view and performance information on the website without setting its own analytics cookie. A cookie-free tool can still process technical information.

Our public pages ask for your choice in a cookie bar. With optional measurement on, PostHog receives page visits, interactions, browser and device information, random identifiers, and the campaign tags and ad click identifiers in the page address. It also records masked sessions and heatmaps on public marketing and resource pages. Inputs and text are masked, and sign-in forms, payment forms, tool-editor content and uploaded media are blocked from those recordings. Tool editors do not produce heatmaps.

In the studio and account area, PostHog receives sanitised page visits, performance measurements and selected usage events. If you choose Accept, it also receives clicks on buttons and links and may record sessions as masked outlines: all text and inputs are masked, and images, video, editors, prompts, scripts, uploaded media, sign-in forms and payment forms are blocked from those recordings. These pages produce no heatmaps. With optional measurement on, an internal account identifier connects activity such as account creation, confirmed payments and refunds, generation outcomes, your first finished video and completed video delivery, and the campaign that first brought you to DreamWild. We do not send PostHog your email address, passwords, sign-in codes, payment-card details, prompts, scripts, uploaded media or unfiltered error messages.

Meta Pixel and Google Analytics 4 run on marketing pages. In the studio and account area, they may load only to record a completed sign-up, a checkout start or a purchase, and they record no page visits there. With optional measurement on, our server also tells Meta and Google when you create an account, start a checkout, buy a plan or credits, or start a subscription, and tells Google when you finish your first video. We use this to measure, optimise and deliver our advertising, including showing our ads to people who have visited or used DreamWild and to people like them. Meta receives one-way hashes of your email address, your DreamWild account ID and your country, with the page address, your IP address, browser information and Meta identifiers, and Google receives its analytics identifiers, the same account ID hash and the page address. A purchase or subscription also carries details such as its price, currency, plan and our estimate of its value over a year, and Meta also receives one-way hashes of the billing name, city, state, postcode and country you give at checkout. Our server sets the Meta identifiers on dreamwild.ai for up to 90 days, noting when it first saw an ad click identifier. We keep these identifiers with your account, refreshed when you start a checkout, together with any ad click identifier in the page address, such as gclid or ttclid. If a report does not reach Meta or Google at first, our server keeps it and tries again for up to 7 days for Meta or 3 days for Google, and deletes its contents once it is delivered or that time has passed. Meta and Google can also collect information about your activity over time and across other websites and apps, and they use what they receive under their own terms and privacy policies. Where the GDPR or UK GDPR applies, we and Meta are joint controllers only for collecting this information and sending it to Meta, under Meta's Controller Addendum, and Meta alone is responsible for what it does with it after that. Microsoft Clarity also runs on marketing pages, beside PostHog, and records them with all text masked. Legal notices are not measured. In the European Union, the European Economic Area, the United Kingdom and Switzerland, these optional tools do not load and our server sends nothing unless you choose Accept; everywhere else, judged by the country our hosting provider detects for your connection, Meta Pixel, Google Analytics 4, PostHog and these server reports are on unless you choose Reject or your browser sends a Global Privacy Control signal. We treat a Global Privacy Control signal as Reject, even if you chose Accept; we do not respond to other "Do Not Track" signals. If you accepted an earlier notice, we ask for a refreshed choice. Existing rejections remain in place. You can also limit ads based on your activity in your Meta and Google ad settings.

You can change your choice through Cookie Settings or use the privacy choices and opt-out options described under "Your choices and rights" and "Additional information for California residents" in this policy. Reject stops future optional capture and clears the related browser identifiers. It does not erase previously collected records automatically.

PostHog session recordings are retained for 30 days. An account-deletion request stops account-linked product tracking. After the existing 30-day restore period, our deletion process requests removal of the associated PostHog person profile, events and recordings. PostHog processes that removal asynchronously. You can also contact support@dreamwild.ai about access or deletion of your data. The existing retention periods for required billing, tax, security and legal records remain unchanged. Our Cookie Notice explains the browser storage:

https://dreamwild.ai/cookies

We do not transfer Google user data, including sign-in details, to advertising platforms, data brokers or information resellers. Third-party sign-in, payment and embedded-media services also handle information under their own notices.

Automated decisions

Decisions made by our systems alone include whether a requested paid operation can start, using your account identifier, plan, payment status and credit balance. Automated account/project checks also decide whether a publishing instruction is eligible to proceed. Automated affiliate checks can hold a commission or a payout while a person reviews it; a person reviews before we cancel commission for a reason other than a refund or chargeback.

Our systems also decide alone:

A system also does things substantially and directly related to decisions a person makes, such as preparing the flags, notices and account records a person reviews before restricting or closing an account.

A person decides every account closure for repeat infringement.

For any decision listed in this section, you can email support@dreamwild.ai to ask a person to review it, tell us your point of view and contest the decision.

Overseas handling

Information can be processed outside Australia, including in the United States. Most of the providers named in this policy are located in the United States. Our hosting and security provider can also process a request in a data centre in another country where its network operates, usually one near you, and providers that serve customers in Europe can handle their information through their entities in Ireland or elsewhere in the European Union. Contact support@dreamwild.ai for information about providers and transfer arrangements relevant to your use.

For overseas disclosures subject to Australian law, we take the required steps concerning the recipient and handling. We do not treat accepting this policy as consent to give up protections or accountability that the law requires.

Where European, UK or another transfer regime applies, we use the required transfer mechanism and safeguards. Information about the applicable arrangements is available through support@dreamwild.ai.

Retention, versions and deletion

We retain information for the purposes for which it is needed, including providing the account and requested project history, reconciling authorised charges, meeting record-keeping obligations, handling disputes and maintaining proportionate security records. Retention depends on the category and a lawful purpose; it is not an unlimited right to keep everything because it might be useful.

The product stores project versions, including superseded media and metadata. Cancelling a subscription does not delete that history. After a subscription ends, we may delete its projects and stored media once thirty days have passed. A deletion request therefore needs to address the versions and related copies, not only the latest screen or download. Delete your account in Account settings, or contact support@dreamwild.ai for an account, content or privacy deletion request.

A request to delete a project or particular information does not necessarily close your account or cancel your subscription. We clarify the scope of your request and explain the action taken, any remaining information and any lawful reason for retaining it.

Deleting your account

When you delete your account, we sign you out on every device and lock the account at once. Your subscription is cancelled immediately and your remaining credits are removed, with no refund except where the law requires one (if you are in the EU or UK and within your withdrawal period, your right to withdraw is unaffected).

For 30 days you can restore the account by signing in again. Restoring brings back your projects, media and settings; it does not bring back your subscription, credits or YouTube connections.

Your YouTube data does not wait for those 30 days. When you delete your account, we start the removal described under “Stop using a channel or remove YouTube data” at once: we ask Google to revoke DreamWild's access and delete your YouTube connections, credentials, publishing schedules and delivery records within seven days of your request. Videos already uploaded to YouTube are not deleted; manage or delete them through YouTube.

After those 30 days we permanently delete your projects and their stored media and versions, your settings, your studio channels, any remaining publishing records, your watch pages, your payout details and your sign-in details, and we ask Stripe to delete your customer record once any open payment dispute is resolved. We keep the following under your account number only, without your email address: our billing, credit, refund and withdrawal records, and the Terms and checkout acceptances you gave, for 7 years (10 years for EU VAT records once we are registered for EU VAT); and a record of your deletion request and what you confirmed, for 7 years. Stripe keeps its own invoices and payment records under its legal obligations. Copies of deleted information in our backups are overwritten within 30 days and are not used in the meantime.

To stop a free offer being claimed again with the same email address, and to enforce an account closure for breaking our Terms, we keep a secret-keyed hash of a deleted account's email address, and of the same address without dots or "+" tags, for 3 years. It is not linked to your old account, cannot be turned back into the address without our key, and is used only to check a new sign-up or a free-offer claim against it. We rely on our legitimate interest in preventing abuse of our offers and Terms.

We will assess and act on a request within the applicable legal timeframe. If information must be retained, we will explain the relevant category and reason where lawful, restrict other use as appropriate, and retain it only for the justified period. Legal, transaction and security records may have a different retention period from creative content. We will not require you to abandon an existing legal claim in order to request deletion.

Backup, recovery and provider copies require separate deletion handling. We restrict retained information to its justified purpose and explain any material limitation affecting a request. We do not promise immediate erasure from every supplier system.

Moving a project to Trash provides a thirty-day recovery period. After that period, it becomes unavailable through ordinary project access and cannot be restored through Trash. Archived file/version records and the stored media objects remain; the thirty-day expiry does not physically erase them. Deleting your account erases them, as described under Deleting your account.

Security and incidents

We use measures appropriate to the information and risks, including access controls and safeguards for service operation. Security responsibilities include selecting suitable providers and managing access, credentials, backups and incidents.

No internet service can eliminate all risk. That fact does not remove our duty to take reasonable or legally required precautions. If a security incident triggers a notification obligation, we will assess and notify the affected people and authorities as required by the applicable law. We will not delay a required notification solely until every detail of an investigation is complete.

Your choices and rights

Contact support@dreamwild.ai to request access or correction, ask about processing, complain, or exercise another applicable right. Depending on the law and circumstances, you may also have rights to deletion, restriction, portability, objection, withdrawal of consent, or an explanation or review of a significant automated decision. These rights can have lawful limits; we will explain any refusal or limitation and available complaint route.

Withdrawing consent does not undo processing that was lawful before withdrawal. It may mean we cannot continue a function that genuinely needs that consent, but it does not authorise an unrelated penalty. Where information concerns another person's business-controlled account, we may need to coordinate with that controller without abandoning an obligation we owe directly to you.

Where Australian Privacy Principles apply, we handle access and correction within a reasonable period and any more specific period the law requires. European and other rights requests have their own applicable deadlines. We may verify identity or authority proportionately, and will not automatically restart a legal clock by making an unnecessary verification request.

Email support@dreamwild.ai with the privacy issue and outcome you seek. We acknowledge a complaint within 5 business days, verify identity or authority proportionately, investigate, and give a written outcome within 30 days explaining action taken or any limitation. Applicable legal response deadlines remain available. You can ask for internal review or complain to a competent regulator where permitted. Australian regulator information is available at:

https://www.oaic.gov.au/privacy/privacy-complaints

EU/EEA residents may contact their competent supervisory authority; UK residents may contact the Information Commissioner's Office. We will provide additional representative details if and when the applicable regime requires an appointed representative.

Additional information for California residents

This section applies if you live in California and the California Consumer Privacy Act applies to us.

In the last 12 months we collected these categories of personal information: identifiers (such as your email address, DreamWild account ID, IP address and the browser identifiers described above); commercial information (your plan, purchases and credits, and the reasons you give when you cancel); internet activity on DreamWild (pages visited and interactions); general location (your country, from your IP address); and audio, visual and similar information you upload or create. We collect them from you, your device and the providers named in this policy, for the purposes this policy describes, and keep them for the periods under "Retention, versions and deletion".

We do not sell personal information for money. When optional measurement is on, we share identifiers, commercial information and internet activity with Meta Platforms and Google for cross-context behavioural advertising, which California law treats as sharing. We disclose these categories to the service providers named in this policy for business purposes. We do not use sensitive personal information to infer characteristics about you, and we do not knowingly sell or share the personal information of anyone under 16.

You have the right to know what personal information we collect, use, disclose and share, to access, correct and delete it, to opt out of its sharing, and not to be treated differently for using these rights. To opt out of sharing, follow the privacy choices and opt-out options described under "Website notifications, cookies and optional tracking" in this policy: choose Reject in our cookie bar or turn on Global Privacy Control in your browser; each applies to the browser you use, and turning off product analytics in Account Settings applies it to your account on every device. For any other request, email support@dreamwild.ai. We verify a request by confirming control of your account's email address. An authorised agent can act for you with your signed permission; we may still ask you to confirm your identity with us.

Additional European and UK information

Where the GDPR or UK GDPR applies to our own controller activities, the basis depends on the purpose. Account and contracted-service administration may be necessary to perform our contract with you; required tax, accounting or legal disclosures may be necessary for a legal obligation; proportionate security, abuse prevention and business administration may rely on legitimate interests after the required balancing; and optional marketing, tracking or another activity requiring consent relies on valid consent.

A contract with an account holder is not automatically a lawful basis for every person depicted in their uploads. When we act as a processor, the customer must identify the appropriate basis and instructions. Special-category data needs an additional condition where applicable.

You may object to processing based on legitimate interests and to direct marketing where the law provides that right. Where we rely on consent, you can withdraw it through the relevant setting or by contacting us. Details of applicable purposes, provider transfers and safeguards are available through support@dreamwild.ai and any completed DPA.

Children and updates

DreamWild accounts are intended for adults aged 18 and over. Do not create a child's account or submit a child's personal information for an inappropriate purpose. If you believe a child has provided information through an account, contact us so we can investigate and take the legally required steps. An age rule does not excuse misuse of a child's image by an adult account holder.

We may update this policy when our practices or legal requirements change. We will show the effective date and give direct notice of a material change where required or appropriate. A revised page is not retrospective consent to a materially different use. Where a new purpose requires consent or another specific legal basis, we will establish it before that processing starts.

Contact us

If you have a question or a complaint about this policy or our privacy practices, including how we handle information from Google and YouTube, contact us:

Our contact page is at:

https://dreamwild.ai/contact