DREA-IMPrivacy policy

Who we are

DREA-IM is operated by A-IKIRA (“we”, “us”). For anything you enter into your workspace, we act as the processor and you are the controller — you decide what goes in and who you message. For your own account details and how we run the service, we are the controller. Reach us at support@drea-im.com.

What we collect

• Account details. Your name, email address and password (stored as a hash by our authentication provider), or the name and email your Google or other sign-in provider returns if you sign in that way. Also your time zone, your avatar image if you set one, and the workspaces you belong to and your role in each.
• Workspace content. Everything you and your team create or upload: brand profile and tone of voice, drafted and published posts and captions, images you upload or generate, campaigns and broadcasts, message templates, contact and subscriber lists you import, chat conversations and files you attach to them, saved prompts and assistants, and automation settings.
• Connected account credentials. When you connect Facebook, Instagram, X, LinkedIn or TikTok, we store the access and refresh tokens those platforms issue, plus the account’s name and id. For messaging we store the Telegram bot token or WhatsApp Cloud API access token you provide. These are held in separate secrets tables and encrypted at rest (see below).
• Message and post content. Messages sent from your workspace, and messages your contacts send to your connected WhatsApp number or Telegram bot — including the sender’s display name, phone number or Telegram id, and the text or media they send. Your WhatsApp and Telegram contacts’ data reaches us because you chose to connect that account; you are responsible for having a lawful basis and their consent.
• Usage counts. Per workspace we record counts: AI input and output tokens by model, images generated, posts published, messages sent. We use these for plan limits and to understand cost. We also keep an activity log of automation outcomes (for example “post published”, “send failed”) so your team can see what the product did.
• Technical logs. Our hosting and database providers record ordinary server logs (IP address, request path, timestamp, error traces) to run and secure the service.

What we do not collect

• No advertising or cross-site tracking cookies, no ad pixels, no third-party analytics or session-replay scripts.
• No payment card details — we never see or store them.
• We do not buy personal data about you, and we do not sell or rent your data to anyone.
• We do not use your workspace content to train our own models.

How we use it

• Running the product. Signing you in, keeping your workspace separate from everyone else’s, scheduling and publishing your posts, delivering and receiving your messages, showing your inbox, calendar, analytics and usage.
• AI generation. When you ask DREA-IM to draft, rewrite, reply, summarise or generate an image, we send the relevant prompt and context — which can include your brand profile, the post or conversation you are working on, and files you attached — to the AI provider you are using: Anthropic, OpenAI or xAI. If you turn on web search in chat, your search query is run as a tool call through the model provider. Nothing is sent to an AI provider unless a feature you used needs it.
• Sending on your behalf. Publishing posts and sending messages through Meta (Facebook, Instagram and the WhatsApp Cloud API), Telegram, X, LinkedIn and TikTok, using the credentials for the accounts you connected.
• Account email. Sending the emails the service needs: sign-in confirmation, password resets and workspace invitations.
• Support, security and limits. Answering your questions, investigating faults and abuse, and applying plan allowances.

Who else processes it (sub-processors)

We keep the list short. Each of these only receives what it needs for its job:

• Supabase — the Postgres database, file storage and authentication, including the account emails described above. This is where your workspace data lives.
• Resend — delivery of those account emails (confirmation and password reset). It receives your email address and the contents of that message, nothing else.
• Vercel — application hosting; it serves every page and processes requests in transit.
• Anthropic, OpenAI and xAI — AI text and image generation, as described above. They receive only the prompt and context for the generation you asked for.
• Meta Platforms, Telegram, X, LinkedIn and TikTok — the platforms you connect. They receive the posts and messages you send through them, and they send us the messages and results they return. Their own privacy policies govern what they then do with it.

If we add or change a sub-processor we will update this list and the “last updated” date above. We do not otherwise share your data, except where we are legally required to, or to protect the service and its users from abuse.

Tokens and encryption

Access tokens for your connected social, WhatsApp and Telegram accounts are encrypted at rest with AES-256-GCM using a key held only in our server environment, and stored in tables the application’s normal database access cannot read. They are decrypted only at the moment a publish, send or refresh needs them, and are never shown back to you in full or sent to a browser. All traffic to and from DREA-IM is over HTTPS. Access to your workspace data is enforced in the database itself with row-level security, so one workspace cannot read another’s.

No system is perfect. If we become aware of a breach affecting your personal data we will tell affected customers promptly and describe what happened and what we are doing about it.

Cookies

We use a small number of first-party cookies and nothing else. There is no advertising or cross-site tracking of any kind. The cookies are: your authentication session (set by our authentication provider, so you stay signed in), the workspace you last had open, your light or dark theme choice, your email address if you asked us to remember it on the sign-in screen, and a short-lived marker during a support session if you ask our team to look at your workspace with you. Clearing them signs you out; nothing else breaks.

How long we keep it

Workspace content stays until you or your workspace admin deletes it, or until the workspace is deleted. Most objects — posts, campaigns, conversations, contacts, assistants, prompts, training sources — can be deleted from inside the app at any time, and deleting them removes them from our database.

When a workspace is deleted, its content, connected-account records and stored tokens are deleted with it. Ordinary server and database backups may retain copies for a short rolling window (typically up to 30 days) before they age out. Usage counts and activity entries may be kept in aggregate form for accounting and capacity planning. Disconnecting a social, WhatsApp or Telegram account deletes the stored token for it.

Your rights

Depending on where you live you may have the right to access your data, get a copy of it, correct it, restrict or object to our processing of it, and have it deleted. Almost all of this you do yourself, without asking us: read and edit everything in your workspace, download your workspace’s data as JSON from Settings → Profile, download a chat conversation as Markdown or plain text, disconnect any social account or messaging channel, delete individual items, remove members, transfer a workspace to a new owner, and delete a whole workspace or your entire account from Settings. Those deletions happen immediately and cannot be undone.

For anything else — a correction you cannot make yourself, or a request we have to handle by hand — email support@drea-im.com from the address on your account. We will confirm your identity, answer within 30 days, and tell you if we need longer. You can also complain to your local data protection authority. Step-by-step deletion instructions are on the data deletion page.

Children

DREA-IM is a business tool for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, tell us at support@drea-im.com and we will delete it.

International transfers

DREA-IM is a cloud service and our providers operate globally, so your data may be processed in countries other than your own, including the United States. Where data leaves the UK or the European Economic Area we rely on the receiving provider’s standard contractual clauses or an equivalent safeguard, together with the encryption and access controls described above. Tell us at support@drea-im.com if you need the specific region your workspace is hosted in.

Changes to this policy

When we change this policy we update the “last updated” date at the top of this page. For a change that materially affects your rights or what we do with your data, we will also tell you in the app or by email to your account address before it takes effect, so you have the chance to object or close your account.

Contact

A-IKIRA, operator of DREA-IM. Privacy questions, requests and complaints: support@drea-im.com.