How Dreamodus governs personal information

The person in charge of the protection of personal information at Dreamodus is our Privacy Officer. Under Québec law that role belongs to the person exercising the highest authority in the enterprise unless delegated in writing; at Dreamodus it is held by that person. The Privacy Officer approves the policies on this page, answers requests and complaints, and decides on any assessment described in section 5.

Contact: privacy@dreamodus.software, subject line “Privacy request” or “Privacy complaint”.

We hold one kind of personal information: the licence record that lets us issue and administer a FleetMouse licence. It is described category by category in the Privacy Policy, section 4. In short: an email address, the licence key we issued, a licensing identity minted on each activated machine, that machine’s display name, its operating-system family, first-seen and last-seen timestamps, and — if you bought seats — a payment reference and seat counts. We do not hold card numbers.

We do not receive, and therefore do not hold, anything the software sees or does on your computers: no screenshots, keystrokes, clipboard contents, window titles, or activity logs. Those stay on your equipment, or pass directly between machines you control.

The licence record is kept on one server, rented from a hosting provider established in the European Union and located in the United States, under a written data processing agreement that restricts the provider to our instructions. That arrangement was assessed before we relied on it (section 5). The email we send about a licence — a key, a sign-in link for your customer account, a notice — is carried by an email provider in the United States under a written agreement of the same kind. Support correspondence is kept in our mailbox.

We keep personal information only as long as the purpose it was collected for requires, or as long as the law requires, and then we destroy it or make it non-identifying. The framework:

• Licence records (email, key, activations) are kept for the life of the licence relationship. A released activation stays as a released row so the same key can be administered and so a seat cannot be double-counted. After the relationship ends — the licence is refunded in full, revoked, or you ask us to close it — the record is kept only as long as needed to complete accounting, to answer a dispute or legal demand, and to prevent a second free trial being issued to the same address, and is then destroyed or made non-identifying.
• Purchase records (payment reference, event, seat counts) are kept for the period tax and accounting law requires — in British Columbia, generally seven years from the end of the relevant tax year — and then destroyed.
• Infrastructure logs at the server (connecting address, path, status) are rotated automatically and overwritten; five files of about ten megabytes each are the most that exist at any time.
• Support correspondence is kept as long as reasonably required to complete the request and for a short period afterwards in case it resumes, and then deleted.
• Machine display names can be renamed or blanked by you at any time from the software, without asking us.

Destruction means deleting the row from the licence database and any backup that contains it as backups age out, or replacing the identifying fields so the row can no longer be linked to a person.

Dreamodus is a small company, and the roles below are held by few people. They are still roles, and they are assigned.

• The Privacy Officer is accountable for every stage of the information’s life: deciding what is collected and why, approving this page and the Privacy Policy, answering access, correction, deletion and complaint requests within the statutory time, conducting or approving assessments, and deciding what happens after an incident.
• The people who operate the licence server are the only people with access to the licence record. They may use it only to issue and administer licences, to keep the service secure, and to answer a request the Privacy Officer has approved. They do not export it, share it, or use it for any other purpose.
• The hosting provider stores the record on our behalf under a written agreement. It may not use the information for its own purposes, must protect its confidentiality, must tell us without delay of any breach or attempted breach, and must allow us to verify that it is meeting those terms.
• The email provider carries the messages we send you under a written agreement with the same restrictions, and reports only whether a message was delivered.
• Everyone at Dreamodus who handles a customer message treats what it contains as confidential and passes any privacy request to the Privacy Officer the day it arrives.

Nobody at Dreamodus, and no provider we use, has access to what the software sees on your computers. That information never reaches us.

Before we start any project that involves collecting, using, or sharing personal information — a new category of collection, a new service provider, a new channel for delivering licence keys, a new place where information is stored — the Privacy Officer assesses it first: what information, why, how sensitive it is, what could go wrong, what protects against that, and, if the information will leave Québec or Canada, what the law of the destination allows. The assessment is kept on file. The Privacy Policy and this page are updated in the same change as the project, never afterwards.

Two such assessments exist today: the assessment of storing the licence record with our hosting provider in the United States, completed 7 September 2026, and the assessment of sending licence email through an email provider in the United States, completed 8 September 2026. Each is reviewed at least once a year.

If personal information under our control is lost, stolen, or accessed without authorisation, the Privacy Officer records what happened, assesses whether it creates a real risk of significant harm to anyone, and, where it does, reports it to the Office of the Privacy Commissioner of Canada and tells the people affected as PIPEDA requires — and to the Commission d’accès à l’information and to the Information and Privacy Commissioner for British Columbia where their rules or guidance call for it, and to a European or UK authority where the GDPR applies. We keep a record of every incident, whether or not it was reportable, for at least two years. If a licence key is disclosed, we revoke and re-issue it.

If you think we have handled your personal information wrongly, write to the Privacy Officer at privacy@dreamodus.software with “Privacy complaint” in the subject line. Say what happened and what you would like us to do. We acknowledge the complaint, look into it, and answer in writing within 30 days, telling you what we found and what we changed. If we need longer, we tell you why before the 30 days run out. There is no fee.

You do not have to complain to us first. At any time you may go to the regulator that applies to you: the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, the Information and Privacy Commissioner for British Columbia, your national data protection authority in the European Economic Area, or the Information Commissioner’s Office in the United Kingdom. The Privacy Policy, section 21, lists them.

The Privacy Officer reviews this page at least once a year and whenever the software, our providers, or the law changes. A change is published here with a new “Last updated” date, and a material change is also sent to the email on the licence. The version that applies is the one in force when the information was handled.