Privacy Policy

Last updated September 22, 2026 (version draft-2026-09-22). This is the first version of this policy. [Dream's legal entity name and address to be added before general sign-up opens.]

1. Who we are and our role

Dream provides the Command Center. For the data the Command Center reads from your Salesforce orgs and produces for you, we act for our customer (a "processor" or "service provider"): the customer decides what we process and why. For account, billing and contact information, and for this website, we decide how data is used (a "controller"). This policy covers both and says which is which.

2. What we collect

• Account data (we are the controller): names, work email addresses, roles and sign-in activity of the people using the Command Center; company name; plan and billing contacts; messages you send us.
• Salesforce org data (we act for our customer): configuration and usage counts read through a read-only connection, and the results we produce from them: scores, findings, alerts and lists of affected items. Those lists can include the names, usernames and email addresses of our customer's Salesforce users. We do not read the contents of business records in Salesforce, and we do not want or knowingly process patient or other health information.
• Technical data: basic server logs of requests to the Command Center, used to run and secure it.
• Cookies: one session cookie that keeps you signed in, and a security token for forms. We use no advertising or analytics cookies, so there is no cookie banner. Emails we send may include a standard open-tracking pixel added by our email provider.

3. Why we use it

• To provide the Command Center: run reviews and checks, show results, send the alerts and emails you ask for, and create tickets in tools you connect (contract).
• To keep it secure and working, investigate problems and prevent abuse (legitimate interests).
• To create anonymous benchmarks and improve the product from Aggregated Data that identifies no one (legitimate interests; benchmarks only when you opt in).
• To bill, support you and meet legal duties (contract, legal obligation).

We do not sell personal information or use it for advertising.

4. AI

The executive brief is written by an AI model (currently Google's Gemini) from a fact sheet of scores and counts with no names, org identifiers or personal data. Under the terms of the service we currently use, the provider may use that fact sheet to improve its models; because it contains no personal data or Customer identifiers, nothing identifiable is shared.

5. Who we share it with

We use these providers to run the service, each bound to protect the data and use it only for us:

We will update this list before adding a provider that handles personal data. Jira, ServiceNow, Slack and Microsoft Teams are tools our customers connect and control; they are not our providers. We may also disclose information when the law requires it, or to a buyer of our business under the same protections.

6. Where it is stored

The Command Center and its providers store data in the United States. If you are outside the United States, including in Canada, your information is transferred there and may be accessible to authorities under United States law. We protect it with the same safeguards wherever it is.

7. How long we keep it

• While your account is active. We keep your Org Health Index history, findings, alerts and issue history for as long as your account is active, so you can see trends. Lists of affected items (for example the users or fields behind a finding), raw monitoring results and the activity log are kept for 2 years, then removed.
• Free accounts. On the Free plan, the lists of affected items are deleted as soon as a review is scored, except the one behind your most severe finding. The Salesforce connection is revoked when the review finishes, or, if you keep the 7-day monitoring trial you are offered when you connect, when the trial ends or you stop it. A Free account nobody has signed in to for 12 months is deleted; we email its owner 30 days and 7 days before.
• Sign-ups that are never activated. An account whose owner never sets a password is deleted after 30 days.
• After a paid account ends. We keep your data for 90 days so you can come back or ask for an export, then delete it. Copies in platform backups are removed as those backups expire.
• Salesforce connections. We revoke a stored connection as soon as you disconnect an org or your account ends, and automatically when it has not been used for 180 days. An org whose reading is paused at your request stays connected, unused, until reading resumes or you remove the connected app.
• On request. You can ask us to delete your account and its data at any time, and an account owner can delete the account from the Profile page.

8. How we protect it

Connections are encrypted; Salesforce connection tokens and integration secrets are stored encrypted and never shown back; access inside an account is by role; our staff access customer data only to provide support. No system is perfectly secure; if a breach affects your information we will tell you without undue delay.

9. Your rights

Depending on where you live (for example under Canada's PIPEDA and Quebec's Law 25, the EU and UK GDPR, or California's CCPA/CPRA), you can ask to see, correct, export or delete your personal information, object to or limit some uses, and withdraw consent. For data we process for a customer, we will pass your request to that customer and help them answer it. We answer within 30 days and will not treat you differently for asking. You can also complain to your privacy regulator.

10. Children

The Command Center is for businesses and is not meant for anyone under 18.

11. Changes

We will post updates here with a new date, and tell account owners by email or in the Command Center about material changes.

12. Contact

Privacy questions and requests: tom@dream.cloud. [A dedicated privacy@dream.cloud address and a named privacy officer to be set up.]