Privacy policy

1. Data controller

The data controller is Andreas Glyptis, Patras, Greece.

For privacy matters or to exercise a right, contact customers@oneirima.com.

2. Data we process

Account and identity

• Email address, encrypted password and technical sign-in information.
• Date of birth, used to confirm adulthood and calculate the internal type number used by the exploration process.
• A random internal identifier that separates account identity from content.

Dreams and explorations

• Your dream narrative and any corrections.
• Your responses, conversation, recognitions and final synthesis.
• Internal operational results needed for continuity and quality.

Voice

If you choose voice narration, the temporary audio file is transcribed into text. It is kept temporarily in private storage and deleted when the 24-hour retention period ends.

Payments and contact

• Payment amount, transaction identifiers, currency and balance movements.
• The subject and content of messages you send to support.
• Necessary technical security, error and access-control records.

3. Why we use the data

• To create and protect your account.
• To store your dream and provide the conversation and synthesis you request.
• To transcribe voice narration when you choose this feature.
• To process payments, account balance and charges for successful responses.
• To respond to support requests and requests concerning your rights.
• For security, prevention of misuse, error diagnosis and reliable operation.
• For internal quality review using material that has passed through a separate anonymisation process.

Weekly newsletter

Confirming your email activates a subscription to Oneirima’s new articles. The newsletter is sent every Sunday at 18:00, Greece time, only when there are new articles. We use your email, subscription preference and necessary send receipts. Dream or conversation content is not used.

You can unsubscribe and subscribe again in Account settings. Every newsletter includes an unsubscribe link. Unsubscribing does not affect your account or necessary operational notices. The preference and delivery records are removed when the account is deleted.

4. Legal bases

Depending on the feature, processing is based on:

• performance of our contract when we provide the account and exploration;
• compliance with legal obligations, particularly those concerning transactions and tax records;
• legitimate interests in security, fraud prevention, support and reliability, where these interests are not overridden by your rights;
• your consent, where the law requires explicit consent.

Your narrative may include information you choose to share about health, relationships, religion or other personal matters. Share only what you want to be used for the exploration.

5. Artificial intelligence

The dream text and the necessary part of the conversation are sent to OpenAI services to produce and check responses, support safety functions and, where applicable, anonymise study material. Application requests are sent with response storage disabled. OpenAI states that API data is not used to train models by default, but may be securely retained for up to 30 days to provide the service and monitor misuse, unless a longer period is required by law.

The response is generated automatically, but it does not make a decision that has legal or similarly significant effects on you.

6. Providers that process data

• Supabase: account authentication and private temporary audio storage.
• Neon: application databases.
• Vercel: hosting and operation of the application.
• OpenAI: response generation and checking, transcription and anonymisation.
• Stripe: secure payment processing. Oneirima does not store full card details.
• Resend: operational email, the weekly newsletter and support messages.
• Google Ads and Meta: optional measurement of registrations and purchases, only if you consent.

Providers receive only the data needed for the particular function and are bound by their respective data-protection terms.

7. Transfers outside the European Economic Area

Some providers may process data outside the EEA. In these cases, available lawful safeguards are used, such as an adequacy decision or approved Standard Contractual Clauses, together with appropriate technical and organisational measures.

8. Security and separation

• Dream and conversation content is stored in encrypted form.
• Account identity is separated from content through a random internal identifier.
• Database connections and keys remain only in the protected server environment.
• Privileged actions are logged without dream or conversation text.

No system can guarantee absolute security. We apply measures appropriate to the sensitivity of the content and regularly review its protection.

9. Retention periods

• Temporary narrative before account creation: up to 24 hours after the last action.
• Temporary audio file: up to 24 hours.
• Account, dreams and conversations: while the account remains open or until you request deletion.
• Unconfirmed account: a reminder is sent 24 hours after signup. If the email is not confirmed within 7 days of sending the reminder, the account and its content are automatically deleted.
• Inactive account: deletion after two years of inactivity, following notices one month and 48 hours beforehand.
• Transaction and tax records: for as long as applicable law requires.
• Limited deletion and security records: for as long as needed to prevent deletion from being reversed by an older backup and to protect the system.

10. Anonymised study material

Completed material may be reviewed for internal quality purposes only after a separate anonymisation check. Direct identifiers are removed and the anonymised package is stored separately under a new code that does not contain the account identifier. If safe anonymisation is not possible, the material is not transferred.

Truly anonymous data from which a person cannot reasonably be identified is not personal data.

11. Cookies and local storage

Technically necessary cookies and local storage are used for sign-in, security, temporary narrative recovery, language choice and operation of the installable application. Only if you choose “Yes” are Google Ads and the Meta Pixel enabled to measure whether a visit led to a registration or purchase and, for a purchase, its amount and currency. Your dream, conversation, email and anything else you write are not sent. You can change your choice at any time.

With the same choice, we store the first available indication of your visit’s origin on your device for up to 30 days: source category, medium and campaign code where available, with capture and consent times. If you register while this choice is active, that indication is linked to your signup and retained for the lifetime of the account or until you request its deletion. For this purpose we do not store search terms, full page addresses, dream content or advertising click identifiers. Where there is insufficient evidence, the source remains unknown. Choosing “No” stops measurement and removes our attribution and pending-event data from your device. Random event identifiers used to prevent duplicate measurement are retained on the device for up to 30 days.

Change measurement choice

12. Your rights

Depending on the circumstances, you may request:

• access to and a copy of your data;
• correction of inaccurate data;
• deletion or restriction of processing;
• portability of data you provided;
• objection to processing based on legitimate interests;
• withdrawal of consent, without affecting earlier lawful processing.

In your personal space you can already export your human-readable data and delete selected dreams or your entire account. For any other request, write to customers@oneirima.com.

13. Complaints

If you believe the processing infringes your rights, you may complain to the Hellenic Data Protection Authority or the competent supervisory authority in the country where you live or work.

14. Changes to this policy

This policy may be updated when the service or the law changes. The effective date appears at the beginning of the page. Clear notice of a material change will be provided through the application or by email, where appropriate.