DreamHouse AI

GDPR overview

DreamHouse AI never claims GDPR compliance anywhere on the site. That is silence rather than a refusal, and it is the reason this entry records no compliance claim. The publisher, Mr Bojli Kft, is established in Hungary and therefore inside the EU; the policy says only that Mr Bojli Kft is based in Hungary, and that data belonging to users located elsewhere is transferred there. The regulation is invoked exactly once, as the legal basis for the Facebook pixel under Article 6(1)(f), legitimate interest. There is no data subject rights section at all, no access, rectification, erasure, portability, objection or complaint route to a supervisory authority, no DPO, no Article 27 representative and no general legal basis. The policy itself is dated 15 September 2023, is written in MoodBoardly's name for moodboardly.com, and still cites the Privacy Shield, invalid since 2020.

Who owns the data?

The terms, last updated in December 2024, are explicit: as between you and DreamHouse AI, you keep all right, title and interest in your User Content, and the publisher states it never obtains any ownership over your content. In exchange you grant Mr Bojli Kft a royalty-free, sublicensable license to display, host, copy, store and use that content, limited to what is necessary to provide the service, and you warrant that you hold the rights to what you upload. One clause reaches further: the license over User Content included in a Design shared with third parties is perpetual. The terms say nothing about who owns the images the AI generates.

Reuse rights

On the publisher's side, the privacy policy published on the site lists identifiers and contact details, precise geolocation from mobile devices, payment data, account and profile data, device data, online activity tracked through Google Analytics, the photos you upload (categorized as Design images) and inferred preferences. The stated purposes go well beyond running the service: direct marketing, interest-based advertising, compliance, and a broad clause covering testing, research, analysis and product development, with anonymization and aggregation allowed. Named recipients are Paddle for payments, AWIN, Papperjam and CJ Affiliate for affiliate tracking, Google Analytics and Google AdWords remarketing, and the Facebook pixel with Custom Audiences, including advanced matching that sends phone numbers, email addresses and Facebook identifiers in encrypted form. Data may also change hands in a merger, sale or bankruptcy, and the publisher does not respond to Do Not Track signals. Nothing states whether uploaded photos are used to train AI models.

Data retention & training

Hosting summary

No hosting country and no infrastructure provider is declared in the site's documents. The only geographic indications are that the publisher, Mr Bojli Kft, is based in Hungary, and that data belonging to users located outside Hungary may be transferred there, which is a statement about transfers rather than about where servers sit. Two technical observations, made outside the published documents and not to be confused with a declaration, complete the picture: gallery and blog images are served from Google Firebase Storage, and the site is served behind Cloudflare, also the domain's registrar, on an anycast address that identifies a CDN node rather than an origin server. There is no trust or security page, and no certification such as SOC 2 or ISO 27001 is claimed. Security is described in general terms with a disclaimer: the policy states that the Internet cannot be guaranteed to be 100% secure, that the publisher cannot warrant the security of information provided to it, and that it accepts no liability for unintentional disclosure. Governing law is Hungarian.