Last updated 8 October 2026
Privacy policy
What DreamX collects, why, and who else touches it.
01Who we are
DreamX is an independent creative studio producing film, photography and brand campaigns, and building the software that runs them. This policy covers dreamxprod.com and the workspaces behind it: the client portal, the talent workspace and the command centre.
Questions, requests and complaints: dreamxproduction@gmail.com.
02What we collect
Account details you give us — your name, email address, the organisation you belong to, and for crew, the craft, location, rates and portfolio links you submit when you apply.
Project material — briefs, shoot plans, footage, stills, documents and the comments and approvals recorded against them.
Messages you send through the portal or the workspace, and the record of who read them.
Billing details for retainers and invoices. Card numbers are entered on Stripe's own pages and never reach our servers.
Technical information every website receives: your IP address, browser and the pages you open, used to keep the service working and secure.
03Why we hold it
To do the work you hired us for, and to show it to you for approval.
To run the account — sign you in, send the codes and notices that keep a project moving, raise invoices and take payment.
To keep the service secure and to meet our legal and tax obligations.
We do not sell personal information, and we do not use your project material to advertise to you.
04Who processes it for us
Supabase — database, authentication and file storage. The system of record.
Vercel — hosting for the website and the workspaces. Railway — the media worker.
Mux — video hosting, encoding and playback for everything you watch in the portal.
Resend — the email we send: sign-in codes, review requests, delivery notices.
Stripe — retainers, invoices and card payments.
Google — sign in with Google, and Google Calendar when a person connects one.
Anthropic and AssemblyAI — transcription and drafting inside the content tools, applied to material you have given us.
Twilio — text messages, where a project has them switched on.
Meta, TikTok and LinkedIn — only when an account is deliberately connected in order to publish to it.
Each receives only what it needs to perform that function, and none of them is permitted to use it for their own purposes.
05Google user data
If you sign in with Google we receive your name, email address and profile picture, and use them only to identify your account.
If you connect Google Calendar, we request two permissions. The first reads your free/busy times — the periods you are occupied, never the titles, guests or contents of your events — so that we do not book you when you are not available. The second creates and updates the DreamX bookings we place on your calendar, and touches no other event.
Those busy periods are stored as unlabelled blocks of time against your profile. Disconnecting the calendar deletes them and revokes our access.
DreamX's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
06How long we keep it
Project material stays for as long as we work together, and afterwards for as long as we may need it to answer a question about the work or to meet a legal obligation.
Delivery links expire on a schedule set per package, and the file behind an expired link can no longer be reached with it.
Ask us to delete your account and we will, except where we are required to retain something — invoices, for instance, which tax rules oblige us to keep.
07Your rights
Write to dreamxproduction@gmail.com to see what we hold about you, correct it, export it, or have it deleted. You can also object to a particular use of it, or withdraw a consent you previously gave — disconnecting a calendar, for example.
We answer within 30 days. If you are in the UK or the EU and are not satisfied with our answer, you may complain to your data protection authority.
08Security and location
Access is controlled per account and enforced in the database, not only in the interface: a client sees their own projects, crew see the assignments they were given, and neither sees the other's. Files are served through links that expire.
Our processors operate in the United States and elsewhere, so your information may be processed outside the country you live in.
The service is not directed at children, and we do not knowingly collect information from anyone under 16.
09Changes
When this policy changes we update the date at the top. If a change materially affects how we use your information, we will tell the people it affects rather than relying on you to notice.