Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Dream Machine GmbH
Plautstraße 27–29
04179 Leipzig, Germany
E-mail: hallo@dream-machine.de
Represented by the managing directors Sascha Geddert and Simon Johanning (see Legal Notice).

As a rule, we process personal data of our users only to the extent necessary to provide a functioning website and our content and services. Processing regularly takes place only with the user's consent or on the basis of a statutory permission (Art. 6 GDPR).

This website is hosted by an external service provider (host): Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The host processes, on our behalf, the data that is technically generated when the website is accessed. When you visit the website, the server automatically collects information transmitted by your browser (server log files):

• anonymised or truncated IP address
• date and time of access
• page / file requested
• browser type and operating system used
• referrer URL

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). A data processing agreement (Art. 28 GDPR) is in place with the host. Log files are generally deleted after 7 days at the latest, unless security-related incidents require longer retention.

If you contact us by e-mail, the details you provide (e-mail address, name, content of the message) are stored for the purpose of handling your enquiry. The legal basis is Art. 6(1)(b) GDPR (initiation or performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering the enquiry). The data is deleted as soon as it is no longer required for that purpose and no statutory retention obligations stand in the way.

The fonts used on this website are served locally from our own server. No connection is made to third-party servers (in particular not to Google Fonts); no personal data is transmitted to third parties for this purpose.

This website does not set cookies for analytics or marketing purposes and does not embed any third-party tracking or analytics tools in the browser (no Meta pixel, no Google Analytics or similar). No user profiles are created.

On the subdomain kulturradar.dream-machine.de (our “KulturRadar” service) we perform purely server-side campaign attribution to measure the success of advertising campaigns. For this, URL parameters are evaluated (e.g. utm_source, utm_campaign, a campaign code, and the click ID fbclid that Meta appends when an ad is clicked). Only the following is stored server-side: the campaign code, a coarse device category (e.g. “iOS Safari” or “desktop”), the hostname of the referring page and — only for clicks coming from a Meta ad — the click ID (fbclid) and your browser's user agent. The IP address and the full referrer URL are not stored. No cookies are set for this and no information is stored on or read from your device (Section 25 of the German TDDDG is therefore not affected).

If we run ads on Meta (Facebook/Instagram) and you contact us via such an ad, we send a “Lead” event through the Meta Conversions API — strictly server-to-server, without embedding any Meta code in the browser — to Meta Platforms Ireland Ltd., Dublin, Ireland. The data transmitted is the click ID (fbclid), your browser's user agent and a pseudonymous, hashed user identifier. The click ID and the user agent are deleted after 30 days at the latest. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our advertising campaigns). Further information on data processing by Meta is available at facebook.com/privacy/policy.

If you use our newsletter sign-up, the newsletter is sent via Brevo (Sendinblue GmbH, Cologne) using double opt-in. The legal basis is Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time via the unsubscribe link in the newsletter. Your e-mail address is stored until you withdraw consent.

“KulturRadar” is our culture and events assistant, which you can use as a Telegram bot and as a web app (kulturradar.dream-machine.de, sign-in via login.dream-machine.de). So that the assistant can recommend suitable events and answer your questions, we process the following data:

• profile data: Telegram name, Telegram ID and language
• your messages to the assistant (conversation history), including voice messages and photos you send
• your preferences (taste profile), saved events and reminders
• usage logs: which events were shown to you, and search requests with their results and the costs incurred

The legal basis is Art. 6(1)(b) GDPR (providing the service you use). We store the data with Supabase on servers in the EU. It is kept until you delete it: the command /deletemydata erases your data at any time, and /mydata gives you a copy. Alternatively, an e-mail to hallo@dream-machine.de is sufficient.

We use the following service providers to run the service:

• OpenAI (OpenAI, L.L.C., USA): understanding your messages, selecting suitable events and phrasing the answers, text analysis (embeddings), and reading photos and texts you send to add an event.
• OpenRouter (OpenRouter, Inc., USA), through which the “Jev” model by the provider Typesafe is used: rating how well an event matches your request. We transmit your search text and short event details from our calendar; if personal tips are enabled, also your taste profile, your recent messages and the titles of your saved events. Your name, Telegram ID or user identifier is not transmitted.
• Parallel Web Systems (Parallel Web Systems, Inc., USA) and, as a fallback, Perplexity (Perplexity AI, Inc., USA): web search when your question goes beyond our events calendar. We transmit a search query derived from your message, not your conversation history and no user identifier.
• Mistral AI (Mistral AI SAS, France): converting your voice messages into text.

Please note: whatever you write in a message yourself is processed as written — do not enter data there that you do not want to share.

Where service providers are based in the USA, data is transferred on the basis of the EU-US Data Privacy Framework (where the provider is certified under it) or of EU standard contractual clauses (Art. 46(2)(c) GDPR). The providers process the data on our behalf (Art. 28 GDPR) and, according to their own statements, do not use it to train their models.

When you use the Telegram bot, communication runs through Telegram (Telegram Messenger Inc.). Processing by Telegram itself is governed by its privacy policy at telegram.org/privacy. KulturRadar is intended for people aged 16 and over.

Within the statutory framework you have the following rights:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an e-mail to hallo@dream-machine.de is sufficient.

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority. For Dream Machine GmbH, based in Saxony, this is the Saxon Commissioner for Data Protection and Transparency (saechsdsb.de).

This privacy policy is current as of September 2026. As our website evolves or legal requirements change, it may become necessary to amend this privacy policy.