Last Updated: September 2, 2026
Welcome to Drevial. We are committed to protecting your privacy and handling your personal information with care and respect. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you use our dream interpretation service (“Service”). Please read this policy carefully.
The data controller for the personal data described in this policy is:
We collect information that you provide directly to us when you use our Service, including:
A dream you describe may reveal information about your health, sexual life, religious or philosophical beliefs, or other matters that data protection law treats as special categories of personal data. We do not ask for this information, but we cannot interpret your dream without processing whatever you choose to include.
By submitting a dream you give your explicit consent to our processing of any such information for the sole purpose of producing your interpretation (Article 9(2)(a) GDPR). You can withdraw this consent at any time by asking us to delete your report, after which we stop processing it.
Under the GDPR we must have a legal basis for each purpose we process your personal data for. These are:
We do not use your dream content to train any AI model, and we do not sell it or share it for advertising.
Your interpretation is written by a large language model operated by OpenAI (the OpenAI API). To produce it, we send OpenAI the dream text and questionnaire answers you provide, together with your first name so the report can address you. The same service screens submissions for content we cannot process (for example, indications of self-harm) before an interpretation is generated. If you purchase a Premium report, your follow-up question and the report itself are sent to OpenAI to produce the answer.
OpenAI processes this data as our processor under its API business terms. According to OpenAI's API data usage policy, content sent through the API is not used to train OpenAI's models, and may be retained for a limited period (currently stated by OpenAI as up to 30 days) for abuse monitoring before being deleted. We do not use your dream content to train any model of our own.
The interpretation is generated automatically, but it is a reflection for your personal use only. It produces no decision with legal or similarly significant effects on you.
We implement robust security measures designed to protect your personal information from unauthorized access, use, or disclosure. This includes encryption of data during transmission and at rest, access controls, and regular security reviews. While we strive to use commercially acceptable means to protect your information, no method of transmission over the Internet or electronic storage is 100% secure.
We do not sell, trade or rent your personal information or dream content. We share it only with the following service providers, who process it on our behalf and under our instructions, and only to the extent needed for the purpose stated:
Legal requirements: We may disclose data if required by law, court order or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.
The Service is hosted in the European Union (Google Cloud, europe-west4 region in the Netherlands). Some of the providers above process data in the United States, in particular OpenAI, Stripe, Resend, Meta and TikTok. Where personal data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses and, for providers certified under the EU-U.S. Data Privacy Framework, on that framework, so that your data keeps an equivalent level of protection. You can ask us for details of the safeguard that applies to a given provider.
We keep personal data only for as long as needed for the purpose it was collected for, and then delete or anonymise it:
We use strictly necessary cookies and similar storage to keep you signed in, secure payments, protect the site from abuse and remember your cookie choice. These need no consent.
Marketing pixels (Meta and TikTok) are loaded only after you accept them in the cookie banner. Google Analytics runs in consent mode: until you accept analytics cookies it sets no cookies and sends only anonymous, cookieless signals; full measurement starts only after your consent. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer. Withdrawing consent stops further tracking; it does not erase data already collected, which you can ask us or the provider concerned to delete.
If you arrive through a referral link, one of those strictly necessary cookies holds the referral code and the time you clicked — nothing that identifies you — and is deleted as soon as it is used, or after 30 days.
Anyone can share a referral link, and creators can apply to our partner programme to be paid for the subscribers they bring. This section covers both.
If you arrive through someone's link. We store the referral code and the time of the click in a first-party cookie that identifies nobody and is never shared. If you go on to create an account we record, once and permanently, which code brought you, so that both sides can be credited. You can decline simply by not using the link.
What partners can see. A partner is shown that a customer converted and what it earned them — never who. Referred customers appear under a one-way pseudonym that cannot be turned back into your name, your email or your account identifier, and we keep no table that would allow it.
If you are a partner. We collect the name or channel you give us, where you post, your country, anything you write in your application, and the payout details you provide so that we can pay you. We process this to enter into and perform our agreement with you (Art. 6(1)(b) GDPR) and to meet our accounting obligations (Art. 6(1)(c)).
Payout records. A commission is a payment to a third party, so its record is a financial one and is kept for the statutory period even after an account is closed. Deleting your account removes the link between those rows and you; the amounts and the dates remain.
Under the GDPR and similar laws you have the right to:
To exercise any of these rights, email us at hello@drevial.com from the address you used with the Service. We will respond within one month, and may ask you to verify your identity first. Exercising your rights is free of charge.
Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected such information, we will take steps to delete it.
We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the “Last Updated” date. We encourage you to review this policy periodically.
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: hello@drevial.com