This Privacy Policy explains how DREAM(“DREAM”, “we”, “us”) collects, uses, shares and protects personal data when you use our property-management service at dreammanagement.co.uk (the “Service”). We are the data controller for the account and usage data described below. If you have any questions, contact us at support@dreammanagement.co.uk.
1. Information we collect
We collect the following categories of data:
- Account data — your email address and authentication details. If you sign in with Google, we receive your name, email address and Google account identifier from Google.
- Content you add — the information and files you upload or enter, such as property details, purchase costs, rental statements, invoices, tenancy and tenant details, and compliance certificates (for example gas safety, EICR and EPC documents).
- Billing data — your subscription status, plan and renewal dates, and the billing details you give to our payment processor (Stripe). Card payments are handled by Stripe: we receive confirmation of payment and limited information (such as the card brand and last four digits), but not your full card number.
- Usage & technical data — basic log information and the cookies needed to keep you signed in and operate the Service.
2. How we use your data and our legal bases
Under UK GDPR, we rely on these legal bases:
- To provide the Service — creating your account, storing your records, reading your documents and producing your reports (performance of a contract).
- To read uploaded documents with AI — extracting figures and dates so you can confirm them (performance of a contract).
- To keep the Service secure and prevent misuse (legitimate interests).
- To take payment and manage your subscription — running your free trial, charging your plan and handling cancellations (performance of a contract).
- To contact you about your account and important service changes (contract / legitimate interests).
- To comply with the law where we are legally required to (legal obligation).
3. AI document processing
When you upload an invoice, statement, certificate or tenancy agreement, the file is sent to our AI provider (Mistral AI, based in the EU) purely to extract text and figures which are returned to you for confirmation. We do not use your documents to train AI models.
4. Who we share data with
We do not sell your data. We share it only with the service providers (processors) that run DREAM on our behalf, under contract:
- Supabase — database, authentication and file storage.
- Vercel — application hosting and delivery.
- Mistral AI — document reading, as described above.
- Stripe — subscription billing and card payment processing.
- Google — only if you choose to sign in with Google.
Card payments and subscription billing are handled by Stripe, a regulated payment provider. Stripe processes your payment information under its own privacy policy; we do not receive or store your full card number.
5. International transfers
Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.
6. Data about other people (e.g. tenants)
If you add information about tenants or other third parties, you are responsible for having a lawful basis to do so and, where required, for informing those individuals. For that data you act as the controller and we process it on your behalf to provide the Service.
If your plan lets you invite another person to view your account (for example an accountant), they will be able to see the data in your account until you remove their access. You choose who to invite and can manage or revoke access at any time from Settings.
7. Retention
We keep your data for as long as your account is active. If you close your account or ask us to delete your data, we will delete it within a reasonable period, except where we must retain it to meet a legal obligation — for example, billing and transaction records that we (or Stripe) must keep for tax and accounting purposes.
8. Security
Data is encrypted in transit, access to your records is restricted to your account through row-level security, and uploaded files are stored in access-controlled storage. No system is perfectly secure, but we take reasonable measures to protect your information.
9. Your rights
Under UK GDPR you have the right to:
- access a copy of your personal data;
- correct inaccurate data;
- ask us to delete your data;
- restrict or object to certain processing;
- request portability of your data;
- withdraw consent where processing is based on consent.
To exercise any of these, email support@dreammanagement.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.
10. Cookies & analytics
We use only the essential cookies required to sign you in and keep your session secure. We do not use advertising or third-party tracking cookies. To understand how the site is used we use privacy-friendly, cookieless analytics (provided by Vercel) that count visits in aggregate — it does not set cookies or identify you personally.
11. Children
The Service is intended for users aged 18 and over.
12. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above and, where changes are significant, notify you.
13. Contact
Questions or requests: support@dreammanagement.co.uk.