dreamlook.ai

GDPR overview

The GDPR is never mentioned on this site: not in the privacy policy, not in the terms, nowhere else. That is silence rather than an explicit refusal. Nothing suggests the operator places itself outside the regulation; it simply never addresses it. There is no Article 27 representative in the EU, no data protection officer, no published or offered data processing agreement, no legal basis for processing, no general retention period and no mention of international transfers. Two elements do exist. The privacy policy grants a right to access, update or delete personal information, exercisable at info@dreamlook.ai. And a dedicated page names fifteen subprocessors with the purpose of each, a level of disclosure rarely seen at this scale. The GDPR compliance flag is set to N because the framework is never described, not because the service declares itself exempt from it.

Who owns the data?

Ownership leans towards the user, but is stated informally rather than in a dedicated clause. For training images, the terms put the burden on the uploader: you warrant that you own the rights to any image you upload, or that you have obtained every permission needed to upload and use it. For trained models, the documentation is explicit that once finetuning is done you can download them and use them for whatever you want, and the models belong to you. For generated images, the collected terms contain no assignment and no licence-back clause, so nothing indicates the operator claims rights over your outputs. It does reserve the right to remove any image that breaches its content policy.

Reuse rights

The privacy policy lists three categories of collected data: site usage, meaning browsing history and pages viewed; device data, meaning IP address, device type and browser; and the images you upload. The stated purposes are delivering the services, improving the site and developing new features, contacting users, and complying with legal obligations. Data may be shared with third-party providers such as hosting and analytics services, contractually limited to providing that service, and with authorities where the law requires it. A cookie banner states that cookies are used so the website runs effectively. On the user's side, reuse needs no permission: the documentation states that trained models can be downloaded and used for whatever you want, and no clause in the terms restricts what you do with the generated images, commercial use included. Two limits apply: your rights over an output can never exceed the rights you hold over the training images, which the terms make your sole responsibility, and the content policy applies throughout. What is left unsaid matters as much: the site never states whether customer data feeds the provider's own model training, and no opt-out from such use is documented anywhere.

Data retention & training

Hosting summary

No hosting country and no region is declared anywhere on the site. What is public is the list of infrastructure subprocessors: Google LLC, for Google Cloud Storage, Firebase and Google Analytics, and Amazon Web Services. Cloudflare is named for CDN, security and performance. None of these entries carries a location, so the storage jurisdiction remains unknown, and the headquarters of a provider says nothing about the region a given bucket sits in. The apex domain resolves to 199.36.158.100, an anycast node operated by Fastly, which is a content delivery point of presence rather than a place where data is stored: no country should be inferred from it. Uploaded images and trained models are deleted after 48 hours by default, which limits exposure but answers nothing about jurisdiction. There is no data processing agreement, no mention of international transfers and no standard contractual clauses. Anyone with a data residency requirement will find nothing here to rely on.