DreamFace

GDPR overview

The privacy policy carries a dedicated "European Union / European Economic Area (GDPR)" section in which New Port LLC names itself the data controller. It lists the rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to a supervisory authority, exercised at legal@newportai.com. Transfers outside the EEA are said to rely on the European Commission's standard contractual clauses, adequacy decisions or explicit consent. The policy was updated on 8 June 2026 and the terms took effect on 20 April 2026; CCPA/CPRA, Brazil's LGPD, Singapore's PDPA, Turkish law 6698, Mexico and Illinois BIPA/CUBI are covered too. Two gaps remain: no Article 27 EU representative is designated, and no hosting country or region is named while Chinese and American subprocessors are.

Who owns the data?

New Port LLC names itself the data controller for the personal data processed through DreamFace under the GDPR. That role reverses for business use: when a Business Customer works through the API or an enterprise plan, the customer is the controller and New Port LLC acts as its processor, under a separate Data Processing Addendum that prevails over the privacy policy wherever the two conflict. Content created by a user stays stored in that user's account and can be deleted on request. The policy adds that biometric information is never sold and never shared for personalized advertising.

Reuse rights

Content generated with DreamFace may be used commercially, according to the site's own FAQ. On the publisher's side, personal data serves service delivery, billing, service and algorithm improvement, research and development, communications, content moderation, security and fraud prevention, and legal obligations. Content a user designates as private through the in-app controls is excluded from generative model training, as is the content of enterprise and API customers beyond what delivering the service requires. Biometric information is never used to train a model, never used for personalized advertising and never sold. Explicit in-app consent is required before a reference image or voice is sent to a third-party model. The publisher states it does not sell personal data nor share it for cross-context behavioral advertising without consent, honors the Global Privacy Control signal as an opt-out where the law requires it, and publishes a public summary of its training datasets under California's AB 2013.

Data retention & training

Hosting summary

The privacy policy names the infrastructure but not the jurisdiction. Hosting relies on Alibaba Cloud, Amazon Web Services and data centers operated by the publisher itself, yet no hosting country and no region is ever stated. International transfers are acknowledged and presented as covered by standard contractual clauses, adequacy decisions or explicit consent. Regional deployments are mentioned only as a possibility for enterprise customers with localization requirements, under a separate written agreement. On the security side, the policy claims encryption at rest and in transit and logically segregated biometric storage with restricted access controls, while support, engineering and moderation teams are described as distributed worldwide and reaching data remotely under access control. One contextual fact the site does not state: the domain's IP address resolves in Frankfurt, Germany, on AS45102 Alibaba (US) Technology, which is a DNS observation rather than a declaration by the publisher. For anyone under a data-residency obligation, the absence of a named hosting country, combined with Chinese and American subprocessors, is the point to raise before committing.