FleetMouse Privacy Policy

Dreamodus Software Inc. (“Dreamodus,” “we,” “us,” or “our”) is a corporation incorporated in British Columbia, Canada. We publish and license FleetMouse (the “Software”) to customers worldwide. This Policy is written for that offer.

We are the organization accountable for the personal information described in section 4. The individual designated to oversee our compliance with this Policy and with applicable privacy law is our Privacy Officer, who may be reached at privacy@dreamodus.software.

1.1 Whose law governs us, and whose law governs you

Canadian privacy law governs Dreamodus, because that is where the company is. Your local privacy law may also govern you. Where it does, we honour the rights it gives you (section 14). Naming Canada first is not a decision to sell only in Canada.

Because we are a British Columbia organization engaged in commercial activity, the Personal Information Protection Act (British Columbia) (“PIPA”) applies to our collection, use, and disclosure of personal information in British Columbia. The Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”) applies to the extent our commercial activity is interprovincial or international — including a sale to a customer outside Canada.

Four further regimes impose a notice duty on a Canadian company that offers software into those markets. They are named because they bite, not because they are the only places we will sell:

• Québec — the Act respecting the protection of personal information in the private sector as amended by Law 25 (“Québec privacy law”) applies to an enterprise that handles personal information of people in Québec, including an enterprise based elsewhere in Canada.
• European Economic Area and United Kingdom — the GDPR or UK GDPR may apply where we offer the Software to individuals there (GDPR Article 3(2)).
• California — the California Consumer Privacy Act may apply to you. Other US state privacy laws are addressed in section 14.6 rather than reprinted in full.
• Other countries — Australia, Brazil, Japan, and others have their own statutes. They largely require what this Policy already states: what we collect, why, who receives it, how long we keep it, and how to ask. Section 14.6 is the catch-all. We do not reprint every statute.

This Policy is intended to satisfy the openness and notification requirements of those laws: PIPA section 10 (notice of purposes at or before collection) and section 5 (policies readily available); PIPEDA Schedule 1, Principles 4.2, 4.3 and 4.8 (identifying purposes, consent, and openness); and, where they apply, the equivalent transparency rules of Québec privacy law, the GDPR, the UK GDPR, the CCPA, and other applicable law.

A privacy notice that can travel with a worldwide offer is not the same as being operationally set up to take payment, charge tax, or appoint local representatives in every market. Those are commercial and tax questions. They are not this Policy.

FleetMouse can see a great deal on a machine where it is installed. Almost none of that information is transmitted to Dreamodus.

Screen contents, window titles, keystrokes, clipboard contents, the accessibility tree of on-screen controls, pairing lists, monitor layout, and the local activity log stay on the computers you own or are authorised to operate, or they travel directly between those computers over a mutually authenticated connection on a private network. We do not relay that traffic. We do not receive it. We do not store it.

The personal information that does reach Dreamodus is licensing information: an email address used to issue a licence, the licence key, a machine licensing identity, a machine display name, the operating system family, and a periodic heartbeat that updates last-seen. That information is stored on a licence server we operate at https://licensing.dreamodus.software.

There is a third path that is easy to confuse with the first two. If you attach a hosted AI assistant to the Software, that assistant’s vendor may receive screenshots and other tool results you caused it to send, under that vendor’s privacy policy. If you attach a model that you run locally, that stream does not leave your equipment. Dreamodus is not the model in either case, and we do not receive that stream.

3.1 What this Policy covers

This Policy applies to:

• personal information we collect when you obtain, activate, renew, or deactivate a FleetMouse licence;
• personal information generated by the Software’s licence client (activation, weekly heartbeat, fetch, and seat release);
• infrastructure logs created when the Software or a browser talks to the licence server;
• the public website at https://fleetmouse.com to the extent it currently exists to publish this Policy and related legal documents;
• emails we send you about your licence.

This Policy does not apply to personal information that remains on your machines, that crosses only between machines you control, or that a hosted AI vendor receives because you attached that vendor’s client. Those categories are described in sections 6 to 8 so that the Software’s behaviour is not mistaken for our collection.

3.2 Our role, and whose role it is not

For the licensing information in section 4, Dreamodus is the organization (PIPA / PIPEDA) and the controller (GDPR) of that personal information.

For screen contents, keystrokes, clipboard contents, and related on-machine information, Dreamodus is not a processor and not a controller. We never receive those categories. The person or organization that operates the machine is responsible for that information, including any notice owed to other people who use the machine. If you attach a hosted AI assistant, that vendor is responsible under its own terms for whatever its client sends it.

We do not require a Dreamodus account in order for two of your machines to pair. Pairing and spanning are not a cloud service we host.

3.3 Defined terms used in this Policy

• Personal information means information about an identifiable individual, as that phrase is used in PIPA and PIPEDA. It does not include business contact information used solely to communicate with a person in relation to their employment, business, or profession, to the extent PIPA excludes that information.
• You means the individual whose personal information we collect, or the organization that holds a licence where the context is the licence relationship.
• Seat means one activation of the Software on one machine. A seat is AI driving of that machine. Pairing is not a seat check. Spanning and tools aimed at another machine need a seat on each machine that takes part.
• Pairing is the owner’s act of authorising two machines to recognise each other. It is designed as a person at both desks.
• Spanning is the human use of one pointer and keyboard across paired machines, in the same product class as a software KVM. It does not require an AI assistant.
• Assistant means an AI client you choose to attach to the Software. We are not that client and we do not log you into a model.
• Remove all my data is the in-app control of that name. It clears this copy of the Software on that machine and attempts to release that machine’s seat. It is not uninstall. It is not a request that we erase your record from the licence database. How to make that request is in section 14.

We collect only the personal information reasonably required for the purposes in section 5. We do not operate a general “account profile,” social login, or advertising identifier in the Software. We do not buy personal information from data brokers, and we do not collect social insurance numbers, government identity documents, biometric identifiers, or health information.

4.1 Information you provide

4.2 Information the Software sends in order to be licensed

The heartbeat is client-initiated, approximately weekly, and jittered. An unreachable licence server is a warning, never a stop. A revoked or expired key still receives the current signed licence file — that is how a revocation is delivered. There is no inbound licensing path onto your machine.

4.3 Purchase records

We do not collect payment card numbers, bank account numbers, or other payment-instrument details. When a purchase or refund is posted to us we keep a purchase record: a payment reference, the event, and seat counts before and after. That is not a card.

4.4 Infrastructure logs

The licence application database has no IP-address column. The reverse proxy in front of the licence server and customer account will typically still record connecting IP address, requested path, and response status. Those logs roll (on the order of 10 MiB × 5 files). The web server behind fleetmouse.com and the package repository at apt.dreamodus.software (which your package manager contacts when you install or update the Software on Linux) keep web-server logs of the same kind: address, path, status, and the client software’s name. They are infrastructure logs for security and abuse detection, not a telemetry channel and not a substitute for the application record in sections 4.1–4.3.

4.5 What this section does not include

We do not currently collect hardware component digests, serial numbers, MAC addresses, or similar device fingerprints. A field for hashed hardware hints exists on the licensing call; both sides send an empty list.

We do not currently operate an automatic software-update service that contacts us or a content-delivery network.

We do not currently mark a machine’s licensing identity as having “consumed” a trial.

5.1 Identified purposes

We collect, use, and disclose the personal information in section 4 for the following purposes, and no others without a new notice or a legal exception:

1. Issuing and administering a licence — generating a key, binding seats to machines, showing you which machines are on the key, delivering a revocation or an updated signed licence file, and releasing a seat when you ask.
2. Contacting you about that licence — sending you a copy of the key (the key itself is shown on the page after checkout and on your customer account at portal.fleetmouse.com), a sign-in link when you ask for one, and corresponding about activation, expiry, refund, or a privacy or support request.
3. Operating your customer account — sending a sign-in link to the address you give, keeping a session while you are signed in, and showing you every licence issued to that address across our products.
4. Keeping the licence record accurate — last-seen, display name, operating system family.
5. Preventing abuse of issuance — one key per email address; cooling-off on a repeat request to the same address.
6. Securing the licence service — infrastructure logs, investigating suspected fraud or unauthorised use of a key.
7. Meeting legal obligations — tax and accounting records of a purchase, and disclosure required by law.
8. Responding to your requests — access, correction, deletion, and complaints under section 14.

We do not use licensing information to build an advertising profile, to train a public AI model, or to sell a list of customers. We take reasonable steps to keep the licence record accurate for those purposes; you can rename or blank a machine display name in the Software, and you can ask us to correct what we hold (section 14).

Email we send about a licence (the key, activation, a privacy reply) is transactional. We do not currently send marketing or commercial electronic messages. If we start to,

5.2 Consent

Under PIPA and PIPEDA, we collect, use, and disclose personal information with your consent except where the law authorises us to proceed without it (for example, to investigate a breach of agreement, to collect a debt, or as required by court order).

Providing an email address in order to obtain a licence key is consent to our using that address for the purposes in section 5.1. Activating the Software on a machine is consent to our recording the licensing identity, display name, and operating system family of that machine, and to the weekly heartbeat. You can rename or blank the display name at any time in the Software. Asking for a sign-in link is consent to our sending one to that address and to the session that opening it starts; signing out ends the session.

We do not require consent to collection, use, or disclosure that is not necessary to provide the Software. Refusing the collections in section 4 means we cannot issue or maintain a licence for you; the Software’s tools and spanning will not run on an unlicensed copy. The manager application will still launch.

Where the GDPR applies, our legal bases are: performance of a contract (issuing and administering the licence you asked for); legitimate interests that are not overridden by your interests or fundamental rights (securing the licence service, investigating abuse of a key, limited infrastructure logging); compliance with a legal obligation (tax, accounting, and compelled disclosure); and, where you submit an email address for a key, the steps needed to enter into that contract.

5.3 Withdrawing consent

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice, by writing to the Privacy Officer. The likely consequence is that we cannot continue to license that email address or those seats, and the Software’s tools and spanning on the affected machines will stop the next time those machines contact us. Pairing records on the machines themselves are not something we can withdraw; you delete those locally with Remove all my data (see section 7).

Withdrawal of consent is not the same as Remove all my data, and it is not the same as releasing a seat. Those controls are described in sections 7 and 14.

Dreamodus does not receive, as ordinary collection, any of the following:

• screenshots or other screen pixels;
• keystrokes, typed text, or clipboard contents;
• window titles, the accessibility tree, or a process list;
• peer lists, pairing pins, or spanning topology;
• monitor layouts, except as a local-network announcement described in section 9, which we do not receive;
• the local activity log;
• files copied between your machines;
• contents of an AI assistant’s chat with you.

Two qualifications, both already true, so that the sentence “we do not collect screenshots” is not written in an unqualified form:

1. The Software writes a screenshot cache on that machine (section 7). We do not receive those files.
2. A hosted assistant you attached may receive the pixels and the local path named in a tool result, under that vendor’s policy. A local model does not leave the machine. We are not the model either way.

We do not collect crash reports. There is no analytics software development kit in the Software. We do not sell personal information. We do not currently have subsidiaries or related companies with whom we share personal information. We do not collect personal information from other organizations about you, other than a payment reference if a purchase is posted to us.

The Software stores information on each machine where it is installed so that pairing, spanning, a local assistant, and offline proof of a seat can work without sending that information to us. Deleting the application without first using Remove all my data leaves most of this behind — particularly on macOS, which has no uninstall hook, and on Linux, where a package uninstall does not delete per-user home-folder state. On Windows, ordinary uninstall removes this store only if you tick the option to delete application data, and never on update.

The following is stored locally. Dreamodus does not receive it as part of ordinary use.

The Software does not keep its own clipboard history.

Operating-system permissions sit with the operating system on that computer. We do not receive them. Remove all my data is the control that revokes the grants this copy holds. Dragging the application to the Trash is not enough. In customer terms, that button takes back:

• macOS: Accessibility, Screen Recording, and Removable Volumes for this application.
• Windows: the optional scheduled task, if you created one, that lets this copy start a listed program with administrator rights. Windows will ask you to confirm that removal.
• Linux: the desktop’s capture and input permission, a GNOME Shell extension if one was installed, and an optional passwordless-admin file for this application. It does not uninstall a kernel input helper, if one was installed.

While the Software is armed and the preference is on (it defaults on), it can keep the display and the machine from sleeping. That is a local power-management setting, not personal information we collect.

7.1 What “Remove all my data” does, and does not do

In order, the button: (1) tries to release this machine’s licence seat while the licensing identity still exists — a network failure never blocks the rest of the local deletion; (2) forgets pairing on this machine, removes access tokens, deletes the local data folders including the screenshot cache, removes the start-at-login entry, and revokes the operating-system grants this copy holds; (3) unregisters assistant clients this application wrote.

If the release call did not succeed, the leftover seat can be released from Account on this machine after it activates under the new identity, or from any other machine that holds the same licence key. A new identity is a new seat even when the display name matches.

It does not:

• delete your email address or the licence row on our server — that is a section 14 request;
• free a seat if the release call did not succeed — that seat stays held until released from Account;
• un-pair the other machine;
• uninstall the application;
• remove firewall rules unless you tick that option;
• uninstall a Linux kernel input helper, if one was installed.

For a clean removal: use Remove all my data, then uninstall.

The local assistant endpoint binds only on the machine itself and requires a token, or it will not start. Pairing and spanning listen on the local network and refuse a public source address before a handshake. Seeing a machine on the local network (section 9) is not permission to use the Software.

Other devices on the same local network can see that a copy of the Software is present. The announcement is the same kind of discovery printers use. It includes a name, addresses, a public-key fingerprint (the peering pin — not the licensing identity), and the application version. While spanning is on, the spanning announcement also includes that machine’s display layout (monitor sizes and positions, which edges are free, a hashed display identifier). That is not a screenshot. With spanning off, nothing about the desk is announced.

Discovery authenticates nothing. Seeing the announcement is not permission to pair, span, or drive the machine. This information is not data Dreamodus receives. We disclose it because a privacy notice that spoke only of “what we collect” would miss it.

We disclose the personal information in section 4 only as follows:

1. Holders of the same licence key. A seated machine on that key can see the other active seats’ display names, operating system family, first-seen, and last-seen. A released seat that still asks can see the fleet it might rejoin. Whoever holds the key can rename or blank any of those names and can release seats. Treat the key as a secret.
2. Service providers who process information on our behalf to operate the licence server, the customer account, the website, and the package repository (hosting and reverse-proxy infrastructure we control). We remain responsible under PIPA and PIPEDA for personal information that is not in our custody. We do not name a hosting brand in this Policy; the legal entity that is accountable to you is Dreamodus.
3. Email delivery. A copy of your licence key, sign-in links, and correspondence about your licence are sent to the email on the licence. The key itself is delivered on your customer account. We send that mail through Plus Five Five, Inc. (trading as Resend), San Francisco, United States, as our processor under a written data processing agreement. Resend processes the address, the subject and body of each message — which, for a key mail or a sign-in mail, includes the key or the link — and reports delivery status back to us. Mail is sent from mail.dreamodus.software. A licence key is never placed in a subject line.
4. Payments. We do not collect cards.
5. Professional advisers (for example lawyers or accountants) under a duty of confidence, where reasonably required.
6. A purchaser of the business, as part of a merger, acquisition, or sale of assets, in which case this Policy will continue to govern or you will be given notice of a successor policy.
7. Where required or authorised by law — a court order, a warrant, or another lawful compulsion. Our policy is to notify you of a legal demand for your licensing record before disclosure unless we are prohibited from doing so, or there are exceptional circumstances involving a risk of serious harm.
8. With your direction — for example if you ask us to send a record to another person.

We do not disclose personal information to third parties for their own marketing. We do not sell personal information. We do not “share” personal information for cross-context behavioural advertising.

We keep personal information only as long as it is reasonably required for the purposes in section 5, or as required by law.

• Licence rows — including the email address, the fleet key, and released activations — are kept for the life of the licence relationship and thereafter as needed to issue the same key to the same address, to prevent abuse of issuance, to complete accounting, and to respond to a dispute or a legal demand. Releasing a seat marks that activation released. It does not delete the licence row or the email.
• Purchase records are kept for the period required for tax and accounting (in British Columbia, typically seven years from the end of the relevant tax year).
• Sign-in links are kept only as a hash and are unusable after 15 minutes or one use. Sessions end when you sign out or after 30 days without use.
• Mail we sent you — the message and its delivery status — is kept with the licence record, so that a question about a key or a link can be answered and a bouncing address is not written to again.
• Infrastructure logs roll as described in section 4.4.
• Support correspondence is kept as long as reasonably required to complete the request and for a short period afterwards in case it resumes.

When personal information is no longer required, we destroy it, erase it, or render it non-identifying, as PIPA requires.

Local stores on your machines (section 7) are retained until you delete them. Their prune caps are not a Dreamodus retention period.

We protect personal information in our custody with safeguards appropriate to its sensitivity, including:

• licence traffic is HTTPS and client-initiated;
• a sign-in link is single-use, expires in 15 minutes, and is stored only as a hash; the session cookie is marked HttpOnly and Secure; a licence key is never put in a mail subject;
• the licence application schema does not store IP addresses, screenshots, window titles, layouts, or peer graphs — a breach of that database must not describe anyone’s desk;
• access to the licence service is limited to people who operate that service;
• infrastructure logs are rotated;
• when we use a service provider to host or carry that service, we remain responsible for the personal information and we require comparable protection by agreement, as PIPA expects of information that is under our control but not in our custody.

The Software’s own controls bound the tools. They are not a claim that an attached model is competent, and they do not apply to human spanning. They are not a warranty that secrets cannot appear in a screenshot. They are described here because they are real, not because they convert us into a processor of your screen:

• the local assistant endpoint binds only on this computer; a token is required or it will not start;
• tokens are stored as hashes; a scope can only narrow, never widen; the default mode allows input with a best-effort password-window filter on;
• pairing and spanning refuse a public source address before a handshake, then authenticate with a pin — there is no public certificate authority on that path;
• the owner can Disarm this copy (the kill switch); assistant input is rate-limited; there is a local activity log of assistant actions, not of human spanning;
• a page in the Software reads out what this copy can actually do;
• the commercial licence check sits behind those safety gates, so a refused or expired licence cannot mask a disarmed machine.

No method of transmission or storage is completely secure. A breach of the licence database would expose the customer list described at the head of this Policy, not screen contents. If you believe a licence key has been disclosed, contact us so we can revoke and re-issue.

Personal information we collect is stored on servers we operate in connection with https://licensing.dreamodus.software (which also serves your customer account at portal.fleetmouse.com). That server is operated for us by a hosting provider and is located in the United States. Our website and our package repository are hosted by the same provider, also in the United States. Your licensing information is therefore stored outside British Columbia and outside Canada.

Email we send you is carried by Resend (section 10), which is established in the United States and processes the address and content of each message there under a written data processing agreement with us.

When personal information is stored or processed outside British Columbia, it may be subject to the law of the place where it sits, including lawful access by authorities there. We remain responsible under PIPA and PIPEDA for personal information under our control, including personal information that is not in our custody. The hosting provider processes that information under a written data processing agreement with us. We do not name the provider in this Policy; the organization accountable to you is Dreamodus Software Inc.

If you are in Québec, personal information about you may be communicated outside Québec for the purposes in section 5. We assess that communication against the sensitivity of the information, the purposes, the safeguards in place, and the legal regime of the destination, as Québec privacy law requires, and the hosting provider and the email provider are each bound by a written agreement that reflects that assessment.

If the GDPR or UK GDPR applies to you, your information reaches Dreamodus in Canada, a country the European Commission and the United Kingdom recognise as providing adequate protection for recipients subject to PIPEDA, which we are for that information. Dreamodus stores it with a hosting provider established in the European Union, under a data processing agreement that meets Article 28, on that provider’s servers in the United States. Where the provider moves the information outside the European Union it does so under the European Commission’s standard contractual clauses (2021) and the UK International Data Transfer Addendum, which its agreement incorporates. Email is transferred by us directly to Resend in the United States under the European Commission’s standard contractual clauses (2021) and the UK International Data Transfer Addendum, which Resend’s data processing agreement incorporates; Resend has also certified to the EU-U.S. Data Privacy Framework and its UK Extension. You may ask the Privacy Officer for a copy of the clauses that apply.

14.1 How to make a request

Write to the Privacy Officer at info@dreamodus.software with “Privacy request” in the subject line. Tell us which right you wish to exercise and enough information for us to locate your record (typically the email address on the licence, and if you have it, the licence key). We may ask you to confirm your identity before we release or change a record, so that we do not disclose a licence to the wrong person. If you tell us you need help formulating the request, we will assist, as PIPEDA requires.

We will respond within 30 calendar days of receiving a written request, as PIPA and PIPEDA require. We may extend that period by up to 30 further days in the circumstances the statutes allow, in which case we will tell you why, and of your right to complain to the relevant commissioner, before the first 30 days run out. We do not currently charge a fee. If a fee were ever required, we would give you a written estimate first.

Remove all my data is not an access, correction, or deletion request under this section. Use this section for the company record; use the button for the copy on a machine.

14.2 Rights under PIPA and PIPEDA

Subject to the limited statutory exceptions, you may:

• Access the personal information we hold about you, and be told how it has been used and to whom it has been disclosed (PIPA s. 23; PIPEDA Principle 4.9).
• Correct personal information that is inaccurate or incomplete. Where we have disclosed the information to third parties, we will send the corrected information to them if reasonably practicable (PIPA s. 24; PIPEDA Principle 4.9).
• Withdraw consent as described in section 5.3.
• Challenge our compliance as described in section 21.

You may also request that we delete the personal information we hold about you. PIPA and PIPEDA do not create a general “right to erasure” in the GDPR sense, but we will consider a deletion request in good faith and in light of our retention needs in section 11. We may decline where we are required or authorised to keep the information (for example, a purchase record we must keep for tax, a released activation we keep to administer the same key, or a record we must retain while a dispute is outstanding). If we decline, we will tell you why and how to complain.

14.3 Additional rights in Québec

If Québec privacy law applies to you, you also have the rights of access and rectification under that Act, the right to withdraw consent, and — where the statutory conditions are met — the right to request that we cease disseminating information or de-index a hyperlink, and the right to data portability of computerised personal information we hold. You may complain to the Commission d’accès à l’information du Québec. Our Privacy Officer is the person responsible for the protection of personal information for the purposes of that Act.

14.4 Additional rights in the EEA and the United Kingdom

If the GDPR or UK GDPR applies to you, you may also request erasure, restriction of processing, objection to processing based on legitimate interests, and data portability, and you may withdraw consent where consent is the basis we rely on. You may lodge a complaint with your local supervisory authority.

14.5 California

If the California Consumer Privacy Act applies to you, this section is our notice at collection. In the preceding twelve months we have collected, or may collect, the following categories of personal information, for the purposes in section 5, disclosed only as described in section 10:

• Identifiers — email address, licence key, licensing public key and activation identifier, machine display name.
• Commercial information — purchase reference, event, seat counts.
• Internet or other electronic network activity — licence HTTPS requests; infrastructure logs of IP address, path, and status.
• Inferences — none.

We do not collect sensitive personal information as that term is used in the CCPA (for example government ID, precise geolocation, account log-in combined with a password, or the contents of a consumer’s mail, other than the licensing correspondence described above). We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not offer a financial incentive for personal information. Retention is as in section 11. To exercise access, deletion, correction, or to ask us to confirm that we do not sell or share, use the contact in section 22. We will not discriminate against you for exercising a CCPA right. We do not disclose personal information to third parties for their own direct marketing (California’s “Shine the Light” request therefore has nothing to return). We do not currently use cookies or pixels that would constitute a “sale” or “share.” If a legally recognised opt-out preference signal (including Global Privacy Control) is present in your browser, we treat it as an opt-out of sale or share; because we do not sell or share, that signal does not change our licensing processing.

14.6 Other countries and other US states

If you are in a jurisdiction whose privacy law applies to our handling of your personal information — including other US state privacy laws (for example Colorado, Virginia, Connecticut, Texas, Oregon), Australia’s Privacy Act 1988, Brazil’s LGPD, Japan’s APPI, or another statute that gives you rights of access, correction, deletion, portability, or complaint — you may exercise those rights by writing to the Privacy Officer as in section 14.1. We will respond within the time that law requires, or within 30 days if it is silent. We will not reprint every such statute in this Policy. The categories, purposes, recipients, and retention in sections 4, 5, 10, and 11 are the facts those statutes ask us to state.

The Software is intended for people and organizations who own, or are authorised to operate, every machine they pair. It is built to run unattended. The operating system treats assistant actions and spanning input as the signed-in user. It does not label those actions “done by an assistant” or “done from another computer.”

If you install the Software on a machine that an employee, contractor, family member, or other person uses, you are responsible for giving that person whatever notice and obtaining whatever consent applicable law requires about:

• the fact that an assistant you attached, or a person at another paired desk, may see the screen and act as the signed-in user;
• the local screenshot cache and activity log on that machine;
• the local-network announcement in section 9.

Dreamodus does not receive those pixels and is not in a position to give that notice for you. If you are that other person and you have questions about what the Software is doing on a machine you use, ask the person or organization that installed it. If your question is about the licensing record we hold, contact us.

https://fleetmouse.com exists to publish this Policy, our Personal Information Governance statement, and related legal documents (the end-user licence, terms, and refund policy) and to identify the product. Contact remains info@dreamodus.software.

The site does not currently use advertising cookies, analytics cookies, or a contact form that collects personal information beyond whatever your browser sends as a matter of ordinary HTTPS (which may be recorded in web-server logs of the same kind as section 4.4). The site is served through a content-delivery network. Your customer account at portal.fleetmouse.com sets one cookie, and only after you sign in: the session cookie that keeps you signed in. It is strictly necessary for the account to work, it carries no tracking, and it is removed when you sign out. We do not currently respond to browser “Do Not Track” signals because we do not use tracking cookies; there is nothing for that signal to turn off.

Third-party sites we link to — including a hosted AI vendor you choose — have their own policies. This Policy does not cover them.

The Software is not directed at children. We do not knowingly collect personal information from anyone under 13 years of age (the COPPA line, and the age most Canadian notices use). Where the GDPR applies to an information-society service, the relevant age may be 16 unless a Member State has set a lower age not below 13. If you believe we have collected personal information from a child below the applicable age, contact the Privacy Officer and we will delete it.

We do not make decisions that produce legal or similarly significant effects concerning you solely by automated processing of personal information. Issuing a key, refusing a second key to the same email address, activating a seat, and stopping tools when a licence is expired or revoked are licence-administration rules you can see and contest by writing to us, not profiling.

If personal information under our control is lost, stolen, or accessed without authorisation in circumstances that create a real risk of significant harm to an individual, we will report the breach to the Office of the Privacy Commissioner of Canada and notify affected individuals as PIPEDA requires, keep the record of it that PIPEDA requires, and inform the Information and Privacy Commissioner for British Columbia in line with that office’s guidance. Where Québec privacy law applies, we will also notify the Commission d’accès à l’information and affected persons as that Act requires. Where the GDPR applies, we will notify the competent supervisory authority and, where required, affected individuals, without undue delay.

We may update this Policy to reflect a change in the Software, in our practices, or in the law. We will post the updated Policy at https://fleetmouse.com with a new “Last updated” date. We will bring a material change to your attention — at minimum by the new date on this page, and by email to the address on the licence where the change is material.

The version that applies to a collection is the version in force when that collection occurs, unless a later version is more protective and we apply it retrospectively as a matter of practice.

Please contact the Privacy Officer first. We will investigate and respond. If you are not satisfied, you may complain to the supervisory authority that applies to you:

• British Columbia: Information and Privacy Commissioner for British Columbia, oipc.bc.ca.
• Canada (PIPEDA): Office of the Privacy Commissioner of Canada, priv.gc.ca.
• Québec: Commission d’accès à l’information du Québec, cai.gouv.qc.ca.
• European Economic Area: your national data protection authority (a list is maintained by the European Data Protection Board).
• United Kingdom: Information Commissioner’s Office, ico.org.uk.
• California: California Privacy Protection Agency, or the California Attorney General.
• Elsewhere: the privacy or data-protection authority of the country or state whose law applies to you — for example the Office of the Australian Information Commissioner, Brazil’s ANPD, or another US state attorney general.

Privacy Officer
Dreamodus Software Inc.
Creston, British Columbia, Canada
Telephone: +1 236-490-8833
Email: privacy@dreamodus.software
All other matters: info@dreamodus.software

Please put “Privacy request” in the subject line of an access, correction, deletion, or complaint message so that it is routed promptly. We will not ask you to send a licence key in an unsolicited email; if we need it to locate a record, we will say so in the reply.