Dreamlux

GDPR overview

Dreamlux makes an explicit claim: for the purposes of the UK GDPR and the EU GDPR, it is the controller of your personal data. The privacy policy lists legal bases (contract, legitimate interest, consent, legal obligation) and the full set of UK/EEA rights: access, rectification, erasure, restriction and objection, portability, withdrawal of consent and the right to complain. Requests go to one address, service@dreamlux.ai with the subject "Privacy Request", answered free of charge within 30 days; the ICO or a local EEA authority is named as the escalation route. CCPA/CPRA and other US state rights are covered separately, and transfers outside the UK/EEA rely on adequacy decisions, standard contractual clauses with the UK IDTA, or explicit consent. What is missing is just as clear: no EU Article 27 representative, no named DPO and no data processing agreement.

Who owns the data?

The terms of service are explicit: you keep ownership of everything you upload or type, which Dreamlux calls "Your Input". Rights in the generated output are assigned to you provided you stay within the terms, and the site adds an unusually honest caveat — copyright protection for AI-generated material varies by country and Dreamlux makes no representation that your output is protectable in any given jurisdiction. For personal data, Innomatrix Limited names itself the controller under both the UK and the EU GDPR, and a "business" under the CCPA/CPRA. Prompts and uploads are passed to whichever third-party model provider handles a given generation.

Reuse rights

The homepage FAQ states that generated videos may be used commercially and that exports carry no watermark, so you can publish or monetise your own output without asking again, subject to the acceptable use policy. On Dreamlux's side, the privacy policy lists the purposes it claims: running the service, metering credits, payments and fraud prevention, support, enforcing the acceptable use policy, legal obligations, aggregate analytics and marketing emails to existing customers. Prompts and uploads are routed to the provider of the model you pick — ViDu, Flux, the Stable Diffusion family — and those providers are said to be contractually barred from training their general models on that data by default, with an opt-out configured where one exists. Inputs and outputs are screened for prohibited content. Dreamlux states it does not train its own general models on user input unless you explicitly opt in, for example by marking a generation as public in a training programme. It reports no sale of personal data and no cross-context advertising sharing without opt-in. Analytics and marketing cookies are consent-based; the policy in force is dated 17 April 2026.

Data retention & training

Hosting summary

Dreamlux publishes no hosting location. The only geographic information comes from the "International Transfers" section of the privacy policy, which states that the company is based in the United Kingdom and that some of its providers are in the United States, the European Economic Area and elsewhere — an open-ended list rather than a hosting declaration. Transfers outside the UK and EEA are said to rely on adequacy decisions, standard contractual clauses combined with the UK IDTA, or explicit consent, and a copy of the transfer safeguards can be requested from service@dreamlux.ai. No storage region can be chosen and no data residency option is offered. Technically, the front end is served behind Cloudflare (AS13335, anycast), which says nothing about where data actually rests: that is an observation made during collection, not a statement by the site. In short, a UK-based controller, an unquantified spread of providers, and no verifiable answer to the question of where uploads and generated files physically sit.