Privacy Policy

Individuate.me is operated by 4xxi Software Ltd. (“we”, “us”, “our”), registered in England and Wales. For the purposes of UK data protection law, we are the data controller.

Registered address: 23 Leyborne Park, Kew Gardens, TW9 3HB, Richmond, United Kingdom

Contact: [email protected]

Individuate.me is an AI-powered dream interpretation tool. Users describe their dreams through chat-based sessions, and our system uses artificial intelligence to analyse dream content through the lens of Jungian psychology, identifying symbols, archetypes, and psychological themes.

Important: Individuate.me is not a psychological, therapeutic, clinical, or diagnostic tool. It does not provide professional advice of any kind. See our Terms of Service for details.

Account data. We operate our own accounts. When you register with an email address and password, we store your email address, your name (if you provide one), a cryptographic hash of your password (never the password itself), and whether your email address has been verified. If you choose to sign in with Google instead, Google sends us your name, email address and profile picture. This data is used for account management and to associate your dream analyses with your account.

Session and security data. When you sign in, we store a session record containing a session token, the IP address and browser user agent the session was created from, and its expiry time. We also keep short-lived records of one-time email verification codes and password-reset links, and rate-limiting counters that protect the sign-in endpoints from abuse.

Dream content. When you use our dream interpretation features, we store the text of your dream descriptions, your messages during analysis sessions, emotional assessments, identified symbols and characters, and AI-generated interpretations. After each interpretation, we automatically extract and store psychological themes, recurring motifs, and character archetypes from your dream using AI classification. This data may contain sensitive personal information, as dreams can reflect deeply personal thoughts and experiences.

Transaction data.We store your credit balance and records of credit purchases and usage, together with the Stripe customer and payment identifiers for each purchase, for accounting purposes. Payment card details are entered on Stripe's own checkout page and processed by Stripe; we never receive or store them.

AI usage data. For each AI request, we log the model used, token counts, estimated cost, and processing duration. This data is used for billing accuracy, cost monitoring, and service improvement. It does not include the content of your dreams or messages.

Application logs.We collect server-side and client-side application logs for error diagnosis, security, and performance monitoring. These logs include timestamps, severity levels, and structured diagnostic metadata. Logs are sent to our own self-hosted log aggregation service — no log data is sent to external third-party services. Application logs do not contain dream content, chat messages, or other personal data.

Analytics.We use Umami, a privacy-friendly, self-hosted analytics service. Umami does not use cookies, does not collect personal data, and does not track individual users across sessions. Analytics data is aggregated and anonymous. We host Umami on our own servers — no data is sent to third-party analytics providers.

Marketing attribution.When you arrive at our website via a marketing link (e.g. from an email campaign or advertisement), we store the UTM parameters from the URL (source, medium, campaign, content, and term) along with the referring website address in your browser's localStorage. This data is transferred to your account record when you sign up, and is then removed from localStorage. We use this data solely to understand which marketing channels bring users to our service. It is not shared with third parties and is not used for cross-site tracking.

Voluntary correspondence. If you contact us by email, we process the personal data you provide for the purpose of responding to your enquiry.

We use only cookies that are strictly necessary for the website to function. We do not use marketing, advertising, analytics, or third-party tracking cookies.

You can block cookies via your browser settings, but blocking essential cookies may prevent you from signing in or using the application.

We process personal data on the following lawful bases under UK GDPR:

• Contract performance(Article 6(1)(b)): processing your dream content through AI models to generate interpretations, classify themes and archetypes, and provide cross-dream pattern analysis — these are the core services you purchase credits for.
• Legal obligation (Article 6(1)(c)): keeping records of the payments you make to us for as long as accounting and tax law requires.
• Legitimate interests (Article 6(1)(f)): session and rate-limiting data for website security and abuse prevention; application logs for error diagnosis and performance monitoring; anonymous analytics for service improvement; AI usage metrics for billing accuracy and cost monitoring; marketing attribution data to understand which channels bring users to the service.
• Consent (Article 6(1)(a)): if you voluntarily contact us, your correspondence is processed on the basis of your consent.

We do not sell, rent, or share your personal data with third parties for marketing purposes. Your dream content is never used for advertising.

Our core service relies on artificial intelligence to analyse and interpret your dreams. When you use our dream interpretation features, the following data is sent to our AI providers:

• The text of your dream descriptions
• Your messages and responses during analysis sessions
• Contextual conversation history necessary for coherent interpretation
• Dream content for automatic classification (extracting themes, motifs, and archetypes after each interpretation)
• Previously interpreted dream data when you use cross-dream pattern analysis features

We currently use:

• OpenAI(US-based) — Large Language Models for dream analysis. This is the default provider.
• OpenRouter(US-based) — an API gateway that routes requests to other model providers, including Anthropic and Google, where we have selected one of their models.
• Azure OpenAI(Microsoft) or a model we host ourselves — alternatives we may select for individual features.

Which model runs each feature is a configuration setting we control and can change without changing the code. We will update this Privacy Policy if the categories of provider that receive your dream content change.

We do not send your identity or contact information to AI providers. Only the content necessary for dream analysis is transmitted.

We do not use your data to train AI models. Our agreements with AI providers specify that data submitted via API is not used for model training. Your data is processed solely to generate a response to your request and is not retained by the AI provider beyond what is necessary for abuse monitoring and legal compliance.

We may change AI providers in the future. This Privacy Policy will be updated to reflect any such changes.

We may share your personal data with the following third parties:

• AI providers(OpenAI, OpenRouter and the model providers it routes to, or Azure OpenAI; primarily USA) — receive dream content and conversation data for analysis. Your data is not used to train AI models.
• Google— only if you choose to sign in with Google. Google authenticates you and returns your name, email address and profile picture.
• Our email provider— receives your email address and the content of account emails (verification codes, password-reset links) in order to deliver them.
• Stripe(USA) — payment processor. Receives payment card details and transaction information for credit purchases. Stripe acts as an independent data controller and is subject to its own privacy policy.
• Service providers acting as processors who provide IT and system administration services.
• Professional advisers including lawyers, auditors, and insurers, where required.

Your data may be processed outside the United Kingdom or European Economic Area. In particular, AI providers (OpenAI, Anthropic) and Stripe are based in the United States. Transfers to these providers are made under Standard Contractual Clauses or equivalent safeguards approved under UK GDPR. Where providers are certified under the UK Extension to the EU-US Data Privacy Framework, that certification may also apply.

We have implemented measures to secure your personal data from accidental loss and from unauthorised access, use, alteration, and disclosure. These measures include encryption, firewalls, access controls, and regular security assessments. Passwords are stored only as salted cryptographic hashes and cannot be read by us. Dream content and chat histories are stored with strict access controls that limit each account to its own data.

Your account data, dream content, and analysis results are retained for as long as your account is active, so that you can access your past interpretations. You may request deletion of your account and all associated data at any time by contacting us at [email protected].

Records of payments you make to us (amount, date, Stripe identifiers) are kept for six years after the end of the relevant financial year because accounting and tax law requires it. This retention survives account deletion — the rest of your data is deleted, but the payment record is not.

Application logs are retained in our self-hosted log aggregation service for operational purposes. Analytics data is aggregated and does not contain personal information.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you, including your dream content and AI-generated interpretations.
• Rectify inaccurate personal data.
• Eraseyour personal data (“right to be forgotten”), including your dream content and chat history.
• Restrict processing of your personal data.
• Object to processing based on legitimate interests.
• Data portability where applicable.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Individuate.me is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not use this service.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “last updated” date. Your continued use of the service after any changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests:

Email: [email protected]