Project Reverie — Privacy Policy
Last updated: 22 April 2026 Effective: 22 April 2026
1. About this Policy
This Privacy Policy explains how OM Connect Sdn Bhd (Company No. 1017397-U) ("Project Reverie", "we", "us") collects, uses, discloses, and protects personal data when you use Project Reverie (the "Service").
We are the data controller (under GDPR terminology) and the data user (under Malaysian PDPA) of the personal data we collect about you.
This Policy should be read together with our Terms of Service, Acceptable Use Policy, and Content & IP Policy.
2. What personal data we collect
2.1 Information you give us
- Account information: name, email address, password (stored hashed), and optional profile details.
- Billing information: billing name, billing address, payment method details (processed by our payment processor; we do not store full card numbers), purchase history.
- Organisation information: if you create a team account, your company name, role, and team member details you provide.
- Communications: messages you send us via support, feedback, or surveys.
- Content you submit: prompts, uploaded images, uploaded audio, uploaded video, and any personal data contained in those Inputs.
2.2 Information we collect automatically
- Usage data: features used, Credits consumed, generations submitted, timestamps, Outputs produced.
- Device and technical data: IP address, browser type, operating system, device identifiers, referring URLs.
- Cookies and similar technologies: see Section 9.
2.3 Information from third parties
- Payment processors: transaction status, last four digits of payment instrument.
- Social login providers (if used): name, email, and public profile data, only as permitted by those providers and as you authorise.
2.4 Sensitive personal data
Our Service is not designed to process sensitive personal data (as defined under PDPA — including data on health, political opinions, religious beliefs, or criminal records). You must not submit such data as Inputs unless it relates to yourself and you expressly consent to our processing. If you upload images containing other individuals, you represent that you have the necessary rights and consents to do so.
3. How we use your personal data
We use your personal data for the following purposes, each with a lawful basis:
| Purpose | Lawful Basis |
|---|---|
| Create and manage your account | Performance of contract |
| Provide the Service (process Inputs, deliver Outputs) | Performance of contract |
| Process payments and manage Credits | Performance of contract; legal obligation (tax, accounting) |
| Send transactional emails (receipts, account notices) | Performance of contract |
| Provide customer support | Performance of contract; legitimate interest |
| Moderate content and investigate abuse | Legitimate interest; legal obligation |
| Improve the Service (analytics, product development) | Legitimate interest |
| Send marketing communications | Consent (you can withdraw any time) |
| Comply with law and respond to lawful requests | Legal obligation |
| Prevent fraud and secure the Service | Legitimate interest; legal obligation |
| Enforce our Terms and defend legal claims | Legitimate interest |
4. Who we share your personal data with
We do not sell your personal data. We share it with:
4.1 Service providers (data processors)
- AI Model providers: ByteDance Pte Ltd / BytePlus (for the Seedance, Seedream, and other Model families) — your Inputs and associated metadata are transmitted to their infrastructure to generate Outputs. Data is processed in the Asia Pacific region (including Singapore and Malaysia).
- Cloud hosting and storage: BytePlus infrastructure (the same provider as the AI Models above).
- Authentication: Firebase, for sign-in and account session management.
- Payment processing, email, and other operational services: handled by appropriate third-party service providers under standard data-processing terms.
- Content moderation services: to scan Inputs and Outputs for policy violations.
We require all processors to handle your data under contractual protections and only for the purposes we specify.
4.2 Team and organisation accounts
If you are part of a team account, your account Administrator can see your usage, Credit consumption, and Outputs generated within that team's workspace.
4.3 Legal and safety
We may disclose personal data when we believe in good faith it is necessary to:
(a) comply with applicable law, legal process, or lawful government requests;
(b) enforce the Agreements, including investigating potential violations;
(c) detect, prevent, or address fraud, security, or technical issues;
(d) protect the rights, property, or safety of Project Reverie, our users, or others.
4.4 Business transfers
If Project Reverie is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to continued protection under this Policy.
5. Cross-border data transfers
Your personal data and Inputs may be transferred to and processed in countries outside Malaysia, including Singapore and other Asia-Pacific regions where our Model providers and infrastructure are located.
When we transfer personal data outside Malaysia, we rely on one or more of the following legal bases under the PDPA:
(a) your consent to the transfer;
(b) transfer is necessary for performance of a contract between you and us;
(c) we have taken reasonable steps to ensure the data will not be processed in a manner that would violate the PDPA;
(d) the recipient is subject to law, rules of conduct, or contract substantially similar to the PDPA.
We maintain contractual protections with overseas processors to this effect.
6. How long we retain your personal data
| Data Category | Retention Period |
|---|---|
| Account data | While your account is active, plus 90 days after closure |
| Inputs (prompts, uploaded media) | 30 days after generation, or until you delete, whichever is earlier |
| Outputs | Stored in your account until you delete; deleted 90 days after account closure |
| Billing and transaction records | 7 years (tax and accounting law) |
| Moderation logs and abuse records | Up to 2 years for safety and legal defence |
| Marketing communications consent records | Until consent is withdrawn, plus 2 years |
| Backups | Rotated and overwritten on a regular schedule, typically within 30 days |
After the applicable period, we delete or anonymise the data unless we are legally required to keep it.
7. Your rights
Under the PDPA and, where applicable, other privacy laws, you have the following rights:
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you. |
| Correction | Ask us to correct inaccurate or incomplete data. |
| Withdraw consent | Withdraw consent for any processing based on consent (e.g., marketing). |
| Limit processing | Ask us to stop or limit processing for direct marketing or certain other purposes. |
| Portability | Request a copy of data you have provided to us in a structured, machine-readable format. |
| Deletion | Ask us to delete your personal data, subject to exceptions (e.g., records we must legally retain). |
| Object | Object to processing based on our legitimate interests. |
| Complain | Lodge a complaint with the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, JPDP) at www.pdp.gov.my. |
To exercise any of these rights, contact us at [email protected]. We will respond within 21 days as required by the PDPA. We may ask you to verify your identity before we act on a request.
8. How we protect your personal data
We implement technical and organisational measures appropriate to the risk, including:
- Encryption in transit (TLS 1.2+) and at rest for sensitive data;
- Access controls and role-based permissions for our staff;
- Regular security reviews of our stack and our processors;
- Staff training on data protection;
- Incident response procedures and logging;
- Processor agreements with contractual data protection obligations.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and, where required, the relevant regulator without undue delay.
9. Cookies and tracking
We use cookies and similar technologies for:
(a) Strictly necessary operation of the Service (login sessions, security);
(b) Functional preferences (language, UI settings);
(c) Analytics to understand how the Service is used;
(d) Performance monitoring.
You can manage cookies through your browser settings. Disabling necessary cookies may prevent the Service from working correctly. We do not use cookies for cross-site advertising.
10. Marketing
We may send you marketing emails about new features, tips, or promotions if you opt in. You can unsubscribe at any time using the link in each email or by updating your account settings. Transactional emails (receipts, account notices, security alerts) are not marketing and you cannot opt out of them while you have an active account.
11. Children
The Service is not directed to children under 18. We do not knowingly collect personal data from children. If we learn that a child has provided us personal data, we will delete it. If you believe a child has given us data, please contact us at [email protected].
12. Third-party sites
The Service may contain links to third-party sites. We are not responsible for their privacy practices. Review their policies before providing any data to them.
13. Data Protection Officer
Our data protection contact is:
Privacy Lead, OM Connect Sdn Bhd Email: [email protected] Address: C-1-05, Centum @ Oasis Corporate Park, No. 2, Jalan PJU 1A/2, Ara Damansara, 47301 Petaling Jaya, Selangor, Malaysia
14. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will notify you by email or in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top reflects the latest revision.
15. Contact us
For privacy questions, requests, or complaints:
Email: [email protected] Postal: OM Connect Sdn Bhd, C-1-05, Centum @ Oasis Corporate Park, No. 2, Jalan PJU 1A/2, Ara Damansara, 47301 Petaling Jaya, Selangor, Malaysia
You may also contact the Personal Data Protection Commissioner (JPDP) at www.pdp.gov.my if you believe your rights under the PDPA have been violated.
End of Privacy Policy.