Deep Dream Generator

GDPR overview

There is no GDPR mention at all. A full-text search across every page collected, including the terms, the privacy policy, the community guidelines and the support page, returns not a single occurrence of GDPR or General Data Protection Regulation. No legal basis is cited, no data subject rights are listed as such, no data protection officer is appointed and no Article 27 representative is named, the latter being moot since Aifnet Ltd. is established in Sofia and therefore inside the European Union. What does exist is thinner but real: the privacy policy names a data controller with its VAT and registration numbers, account and data deletion can be requested by email or through a dedicated page, and a cookie settings panel appears sitewide. Against that, the terms require consent to transfer and store data in the United States. No processing agreement, no subprocessor list and no retention periods are published.

Who owns the data?

Under the Terms of Use you keep whatever rights you hold in the images, videos and music you create or edit, and the operator states that it does not claim intellectual property in generated or edited content. In exchange you grant Deep Dream Generator a non-exclusive, worldwide, royalty-free and fully paid licence to store, process, display, reproduce and use that content in order to operate, improve, promote and maintain the service; the terms specify that this licence transfers no ownership. One condition sits elsewhere: the pricing FAQ makes commercial use dependent on an active paid subscription or energy pack at the moment of creation. Aifnet Ltd. is the named data controller.

Reuse rights

You may reuse your own creations without asking permission. The terms allow you to use, reproduce, modify, distribute and sell what you make, subject to third-party rights such as trademark, publicity and privacy, and downloads carry no watermark. The pricing page adds one condition that the homepage does not repeat: images and videos qualify for commercial use if they were produced while a paid subscription was active or with energy bought in a pack. On the vendor side, the platform collects account details, prompts and generated content, IP addresses, cookies and billing metadata such as card brand and last four digits; full card numbers are never received. IP data feeds geographic advertising and audience measurement, third parties including Google set their own cookies, and Stripe processes payments. Email addresses are neither sold nor rented, uploads stay private until you choose to publish them, and account deletion can be requested by email or through a dedicated page. Nothing on the site states whether user content is used to train models.

Data retention & training

Hosting summary

Hosting is described only through a consent clause, never through a hosting commitment. The Terms of Use ask users to agree to the processing, transfer and storage of their information in and to the United States and other countries, warning explicitly that local protections may be weaker there. Beyond that sentence no country is named, no region is declared and no data centre is identified. The privacy policy lists categories of recipients such as infrastructure, hosting, storage, analytics, moderation, email and support providers, without naming any of them; Stripe is the only third party named anywhere, and only for payments. There is no trust or security page, no residency option and no choice of region. As a technical indication rather than a vendor statement, the domain resolves to an address geolocated in the United States. The company itself is established in Sofia, Bulgaria, so a European operator is routing personal data to American infrastructure under a consent clause rather than a documented framework.