Dream it Made — Privacy Notice

1 September 2026

1. Scope

This Notice explains how Dream it Made uses personal information when you browse our website, create or upload artwork, use optional AI features, place or receive an order, join our mailing list, contact support or exercise a legal right.

Capitalised content, Order and provider terms used in this Notice have the meanings given in our Customer Terms and Conditions.

2. Controller and contact

The controller is Dream It Made Limited, a private company limited by shares registered in England and Wales under company number 17430260.

Registered office and business/service address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: info@dreamitmade.com

We do not appoint a data protection officer because our present processing does not require one. Privacy questions and requests should be sent to the email above.

3. Information we use

Depending on how you use the service, we may process:

• identity and contact details, including name, email, optional phone number and delivery/billing address;
• order, product, personalisation, preview-approval, delivery, refund and payment-status records;
• Customer Content, including text, Prompts, photographs, Original Uploaded Images, Modified Images, Generated Images and other artwork, together with Preview Image or Production Image links and identifiers;
• gift-recipient name and address where you send an order to another person;
• website/device information, cookie preferences, IP address, browser, security and native ecommerce analytics data;
• marketing choice and consent evidence;
• correspondence, complaint, rights-request, fraud and legal-claim information; and
• information needed to investigate product safety, abuse, intellectual-property or safeguarding concerns.

We do not receive your full card details. Payment and any credit assessment are handled by payment or credit providers available through checkout.

4. Artwork flow

Before transfer, your Original Uploaded Image and any Modified Image are held temporarily in necessary browser storage on the device and browser you are using. Dream it Made does not operate a separate server-side repository for Original Uploaded Images, Modified Images, Preview Images or Production Images.

When you select Use this image, the image you have chosen—whether your Original Uploaded Image or a Modified Image—is held temporarily in necessary browser storage ready for transfer. When you then choose to add it to a product, that selected image is sent to our personalisation Technology Provider to create the product preview and associated production information. If you place an Order, the necessary artwork or Production Image and personalisation information are then made available to the selected Print Provider to manufacture and fulfil the Order.

Through our Technology Providers and Print Providers, we may access personalisation previews, artwork or production links, identifiers and Order records where needed to review Customer Content, release production, provide support, investigate a fault or respond to a rights or legal claim. Dream it Made remains responsible for deciding how and why this information is used to provide and support your Order, even where a provider stores it for us.

Our current personalisation Technology Provider may retain shopper personalisation data for up to six months. Print Providers retain information under their own processor schedules, legal duties and documented instructions. We do not promise deletion from every provider immediately after dispatch where a legitimate Order, tax, safety, fraud, complaint or legal record must remain.

5. Why we use information and our lawful bases

Purpose	Information	Main lawful basis
Create previews, take payment, accept, review, produce, deliver and support an Order	Contact, Order, Customer Content, approval, delivery and payment status	Contract; steps at your request before contract
Provide optional AI and personalisation tools before purchase	Prompts, Customer Content, device and security data	Steps at your request; legitimate interests in providing and securing the service
Review prohibited Customer Content, prevent fraud and protect users/services	Customer Content, Order, device, security and correspondence data	Legitimate interests; legal obligation where applicable
Keep tax, accounting, product-safety and legal records	Order, payment status, delivery, complaint and limited Customer Content evidence	Legal obligation; legitimate interests in establishing or defending claims
Handle complaints, returns, rights requests and disputes	Order, contact, evidence and correspondence	Contract; legal obligation; legitimate interests
Send requested news and offers	Email and consent record	Consent; you may withdraw at any time
Operate consented native analytics and ecommerce-network functions	Device, cookie, interaction and purchase data	Consent where storage/access rules require it; otherwise legitimate interests only where lawful and proportionate

Where we rely on legitimate interests, our interests include operating and securing our ecommerce service, preventing misuse, improving reliability, supporting customers and protecting legal rights. We balance those interests against your rights and do not use this basis for optional email marketing.

6. AI processing

Prompts and relevant inputs pass through our security/infrastructure provider to our AI provider. Dream it Made does not intentionally retain your Prompts or Generated Images in its own application storage. The AI provider does not use API content for model training unless its customer expressly opts in, and Dream it Made has not opted in.

The AI provider may retain content in abuse-monitoring logs for up to 30 days and longer where law, misuse investigation or safety obligations require it. Image or file inputs are scanned by the AI provider for potential child sexual abuse material; flagged content may be retained by the AI provider for manual review and lawful reporting.

Do not include confidential, special-category or other personal information in a prompt or upload unless necessary and you have authority to use it.

7. Who receives information

We share only what is reasonably needed with categories of recipient such as:

• our ecommerce storefront, checkout, hosting and ecommerce-network service provider;
• personalisation and preview Technology Providers;
• AI, moderation, security and infrastructure providers;
• the selected Print Provider for the ordered product;
• payment and credit providers chosen at checkout;
• delivery carriers and fulfilment partners;
• email, support and professional advisers if used; and
• regulators, courts, law enforcement, rights holders or safeguarding bodies where disclosure is legally required or reasonably necessary and lawful.

Some providers act only on our instructions; others, such as a payment, credit or delivery provider, may also be a separate controller for purposes explained in their own notice. An internal current supplier register is maintained and further information can be requested by email.

8. International transfers

Some Technology Providers, Print Providers and other recipients may process personal information outside the UK, including in the United States and European Economic Area. Where the destination or recipient is not covered by UK adequacy regulations, we use or require a recognised safeguard, such as the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses or another lawful mechanism, and assess the protection where required. Contact us if you would like further information about the relevant safeguard or a copy where it is available to you.

9. Retention

We keep information only for as long as reasonably necessary:

• temporary browser copies and draft information: for the active personalisation journey and until they are cleared, replaced or expire through the browser and service controls;
• abandoned personalisation and provider-hosted Customer Content: according to configured provider retention; the current personalisation Technology Provider period may be up to six months;
• Original Uploaded Images, Modified Images, Preview Images and Production Images: no separate Dream it Made server-side repository; provider copies follow the provider schedule, except preservation for an active complaint, chargeback, rights claim, safety issue or legal duty;
• order, approval metadata, transaction and tax records: normally up to six years after the relevant accounting period or relationship, where needed for legal, tax and claims purposes;
• support and complaint records: normally six years where connected to an order or potential claim, shorter where no continuing need exists;
• unsuccessful AI requests/outputs: no Dream it Made application storage; provider abuse logs may be kept up to 30 days as described above;
• newsletter consent: until withdrawal, invalidity or review after two years without engagement; a minimal suppression record may be retained to honour an opt-out; and
• cookie preferences and native analytics: for the period shown in the cookie preference interface and no longer than necessary for the stated purpose.

We securely delete or anonymise information when the relevant period ends, subject to provider deletion cycles and legal holds.

10. Marketing

We send email news and offers only where you actively opt in. The checkbox is not pre-ticked. Buying a product does not subscribe you. You can unsubscribe through any marketing email or by contacting us. Service, safety, recall, complaint and legal messages are not marketing.

We do not use customer artwork or product photographs in marketing without separate, specific and informed permission.

11. Cookies and similar technologies

Our Cookie Policy explains the categories used. Shopify provides our storefront, checkout, native consent tools and native ecommerce analytics. We do not currently intentionally deploy Google Analytics, Meta Pixel or TikTok Pixel. If we introduce additional analytics or advertising technologies in future, we will update the Cookie Policy, this Notice and the relevant consent controls before they are enabled.

When you upload or edit an image, temporary copies and draft information are held in necessary browser storage, which may include IndexedDB, local storage or session storage. This allows the personalisation features of the website to function correctly. The artwork itself is not stored in a cookie, and rejecting optional analytics or advertising technologies does not prevent the artwork handoff to our personalisation Technology Provider.

12. Your rights

Depending on the circumstances, you may ask us to:

• give you access to personal information;
• correct inaccurate information;
• delete information;
• restrict or object to processing;
• provide portable information;
• explain or challenge solely automated decisions with legal or similarly significant effects; or
• withdraw consent without affecting earlier lawful use.

Email info@dreamitmade.com. We may ask for proportionate identity evidence. We normally respond within one month, subject to lawful extensions. Because providers store some information for us, we may need to send the request to them; you should still contact Dream it Made first.

13. Complaints

Send a data-protection complaint to info@dreamitmade.com. We will acknowledge it within 30 days and respond without undue delay. You may also complain to the UK Information Commissioner’s Office at ico.org.uk, although we invite you to contact us first so we can try to resolve it.

14. Security and incidents

We use proportionate technical and organisational measures and select established service providers, but no online system is risk-free. Hosting data with Shopify or another processor does not remove our controller responsibilities. We maintain an incident-escalation process and will notify affected people and the ICO where the law requires it.

15. Children

The service is intended for adults placing orders. A parent or guardian must place an order involving a child’s creation or photograph and ensure the submission is appropriate and authorised. Our products are not marketed as child-specific products.

16. Changes and version

We publish the current version with its effective date. A later notice applies prospectively, but we may email a material change affecting an existing order, your rights or our continuing use of your data. Superseded order-relevant versions are retained internally.

Version 2.2 — 1 September 2026.