Privacy Policy

1. Data Controller

DreamCorp SAS, registered at {{ADDRESS — siège social à renseigner}}, SIRET {{SIRET — à renseigner}}, is the controller of personal data collected through dreamcorp.ai.

For any data protection request, contact privacy@dreamcorp.ai.

2. Data We Collect

We collect the following categories of personal data:

• Account data: name, email, hashed password, profile picture if provided.
• Business data: company name, description, category, country, VAT ID.
• Usage data: actions taken on the Platform, credit consumption, agent activity logs, IP address, browser type.
• Payment data: processed by Stripe. We do not store full card numbers — only last 4 digits for receipts.
• CRM data: contacts, leads, deals you create inside the Platform.
• Communications: emails and support messages you send us.

3. Legal Basis

Each processing operation relies on one of the following GDPR legal bases:

• Contract performance (Art. 6(1)(b)) — to provide the Platform you subscribed to.
• Legal obligation (Art. 6(1)(c)) — to keep invoices and fiscal records.
• Legitimate interest (Art. 6(1)(f)) — security monitoring, fraud prevention, product improvement.
• Consent (Art. 6(1)(a)) — optional marketing emails, when applicable.

4. How We Use Your Data

• To provide and operate the Platform and its AI agents.
• To process payments and generate invoices.
• To send transactional emails (receipts, alerts, daily CEO reports).
• To detect fraud and abusive behavior.
• To improve the Platform and develop new features.
• To comply with legal and tax obligations.

5. Sub-processors

We share the strict minimum of data with the following trusted sub-processors:

• Stripe Payments Europe, Ltd. (IE) — payment processing and Connect payouts.
• Anthropic PBC (US) — AI agent capabilities, under DPA with EU SCCs.
• OpenAI Ireland Ltd. (IE) — fallback AI capabilities.
• Resend Inc. (US) — transactional email delivery, under EU SCCs.
• Vercel Inc. (US) — hosting and CDN, under EU SCCs.
• Sentry (Functional Software, Inc., US) — error monitoring, under EU SCCs.
• Our PostgreSQL database provider — encrypted storage of structured data.

6. International Transfers

Some sub-processors are located outside the EEA (United States). Transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission and additional safeguards as required by the Schrems II ruling.

7. Data Retention

• Account data: for the duration of your subscription + 3 years after closure.
• Invoices and fiscal records: 10 years (legal obligation).
• Server logs: 12 months maximum.
• CRM data: kept while your company is active; deleted 90 days after you delete the company or close your account, unless you export them first.

8. Your Rights

Under GDPR you have the right to access, rectify, delete, restrict, object to, and port your personal data, as well as to withdraw consent and lodge a complaint with your data protection authority (in France: CNIL, www.cnil.fr).

To exercise these rights, contact privacy@dreamcorp.ai. We respond within 30 days.

9. Security

We implement encryption in transit (TLS 1.2+), hashed passwords (bcrypt), row-level tenancy, audit logs, access controls, and isolated database roles. No system is perfectly secure, but we take reasonable precautions and will notify you of any breach affecting your data within 72 hours, as required by law.

10. Cookies

We use strictly necessary cookies for authentication and session management. We do not use advertising or cross-site tracking cookies. We do not need a consent banner for essential cookies.

11. Children

The Platform is not intended for users under 18. We do not knowingly collect data from minors.

12. Changes

We may update this policy. Material changes are communicated via the Platform or email at least 30 days before taking effect.

13. Contact

For any privacy request: privacy@dreamcorp.ai. For other legal questions: contact@dreamcorp.ai.