dreammachine  | SYSTEMS

This privacy policy informs you about how Dream Machine Systems FlexCo ("we", "us") processes personal data when you use this website, in accordance with the EU General Data Protection Regulation (GDPR / DSGVO) and applicable Austrian law (DSG, TKG 2021).

>_ Controller:

Dream Machine Systems FlexCo
c/o Impact Hub Vienna, Lindengasse 56/18-19, 1070 Vienna, Austria
Email: signal@dreammachine.systems
Phone: +43 1 295 51 90

>_ Hosting & Server Log Files:

When you visit this website, our hosting provider automatically stores server log files (IP address, date and time of access, requested URL, browser type, referrer URL). This processing is based on our legitimate interest (Art 6(1)(f) GDPR) in the secure and stable operation of the website. Log files are deleted automatically after a short retention period and are not merged with other data sources. To protect the website against spam and abuse, it also keeps short-lived request counters in its own database: when you submit a form (newsletter sign-up or unsubscribe, feedback, telemetry report, media request, contact request) or a simulator sends its usage data, we store your IP address with the time of the request, and for newsletter sign-ups and unsubscribes also your e-mail address. These counters look back one hour (24 hours for e-mail addresses); their entries are deleted automatically once they are older than 24 hours, the next time any of them is checked. Failed logins to the administration area are counted per IP address in a separate counter, whose entries are deleted once they are older than one hour, the next time a failed login is recorded; repeated failures lock that IP address out for 15 minutes, and that lock entry is deleted like the request counters above. The counters are used only to limit the number of requests and are not merged with other data sources. Legal basis: our legitimate interest (Art 6(1)(f) GDPR) in protecting the service against spam and abuse.

>_ Contact & Feedback Forms:

If you submit our feedback or telemetry forms, we process the data you provide (name or alias, optional email address, optional location, and the content of your submission) to review your feedback and — where you have consented — to contact you with follow-up questions. Legal basis: your consent (Art 6(1)(a) GDPR) and our legitimate interest in improving our publications (Art 6(1)(f) GDPR). Submissions are stored in a database on our server and retained until their purpose is fulfilled or you request deletion. Testimonials are only published if you have explicitly authorized the broadcast.

>_ Press & Media Requests:

If you send a request through the media request form on our press page (/press/), we process the data you enter (name, media outlet or organisation, e-mail address, optional phone number, optional link to the outlet, type of request, optional deadline and your message), together with the time of your consent and the version of this privacy policy you agreed to, in order to answer your request. Legal basis: your consent (Art 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Your request is stored in a database on our server and forwarded by e-mail to our press mailbox press@dreammachine.systems (sent through the mail service named under “Third-Party Services”); we reply from there to the e-mail address you entered. We do not send an automatic confirmation e-mail. Requests are retained until they have been answered and their purpose is fulfilled, or until you request deletion.

>_ Contact Requests:

If you send a request through the form on our contact page (/contact/), we process the data you enter (name, e-mail address, optional phone number, optional organisation and website, optional date by which you need a reply, your preferred language, the channel you selected, the details asked for that channel and your message), together with the time of your consent and the version of this privacy policy you agreed to, in order to answer your request. Legal basis: your consent (Art 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Your request is stored in a database on our server and forwarded by e-mail to signal@dreammachine.systems (sent through the mail service named under “Third-Party Services”); we reply from there to the e-mail address you entered. We do not send an automatic confirmation e-mail. Requests are retained until they have been answered and their purpose is fulfilled, or until you request deletion.

>_ Newsletter (System Update Channel & topic lists):

Our newsletters are operated through Sendy, a self-hosted mailing-list application running on our hosting provider's infrastructure at lists.newsversand.email. When you subscribe (via the update channel or the subscribe element on our pages, the optional opt-in box on the feedback or telemetry form, the access-code request on /deck, the documentation download at /docs/hla, the guest-token request on /masterclass.php, or the patch-alert box on the briefing pages at /docs/briefings), your email address is transmitted to that service and a double opt-in procedure applies: you receive a confirmation email, and only after you click the confirmation link is your address activated on the relevant list. We store your email address, an optional name, your subscription status, and the signup/confirmation timestamps. Legal basis: your consent (Art 6(1)(a) GDPR), which you can withdraw at any time via the one-click unsubscribe link contained in every mailing, or by contacting us. The confirmation and campaign emails are dispatched by the Sendy service through our hosting provider's mail infrastructure.

>_ Cookies & Local Storage:

This website itself does not set tracking cookies. The only cookie it can set is a functional one: mtm_consent_removed, which is stored only if you opt out of website analytics (see “Website Analytics” below) and records nothing but that objection. We use the browser's local storage for purely functional purposes (e.g., remembering that you dismissed the newsletter element or, on try.dreammachine.systems, your consent choice under the key dm_try_consent); this data never leaves your device. Third-party services listed below may set their own cookies, but only after your consent.

>_ Website Analytics:

We use Matomo, a self-hosted web analytics service running on our own server (stats.dreammachine.systems) to record aggregate page views, referrers, and general usage patterns. On the contact page (/contact/) it also records three actions, each with the name of the channel only and never anything you type into the form: choosing a channel, following a channel's link to another page, and sending a request. Your data stays with us and is never shared with or sold to any third party. The tracking script is configured not to set any cookies, and your IP address is anonymized before it is stored, so it cannot be used to identify you. We do not maintain a visit-level log or individual visitor profiles — only aggregated statistics are kept. Legal basis: our legitimate interest (Art 6(1)(f) GDPR) in understanding usage of our own website, in a manner that does not require your consent because no personal profile is created or retained. You can object to this processing (Art 21 GDPR) at any time using the opt-out control below — opting out sets one functional cookie on this website (mtm_consent_removed), which only stores your objection and is not used for tracking.

>_ Third-Party Services:

Web fonts are self-hosted on our own server; no font requests are sent to Google or any other third party.

Gmail SMTP (Google Ireland Ltd.): transactional emails (newsletter confirmations, notifications) are sent through Google mail servers, which process the recipient address and message content for delivery.

YouTube (Google Ireland Ltd.): the briefing pages at /docs/briefings and the news entries at /news/ can show a video. The player is not loaded when the page opens; it is only embedded, from youtube-nocookie.com, after you press the video poster or a transcript line (briefings) or the [ > LOAD VIDEO ] button (news entries). From that moment Google receives your IP address and technical device data and may set cookies or similar identifiers; data may be transferred to Google LLC in the USA (EU-U.S. Data Privacy Framework). Legal basis: your consent by clicking (Art 6(1)(a) GDPR). Audio and slide decks are served from our own server; the Spotify link only opens Spotify in a new tab.

Google Analytics (Google Ireland Ltd.): used to measure website usage on try.dreammachine.systems, and loaded only after you accept the consent banner shown on your first visit. If you decline or make no choice, no analytics script is loaded and no data is transmitted to Google (Google Consent Mode v2, basic mode). On try.dreammachine.systems, ad personalization stays denied even after you accept, Google signals are switched off, and event data is retained for 14 months. Legal basis: consent (Art 6(1)(a) GDPR), withdrawable at any time at https://try.dreammachine.systems/#consent. When active, IP addresses are processed by Google and data may be transferred to the USA under the EU-US Data Privacy Framework.

Google Ads (Google Ireland Ltd.): we advertise The Deployment Masterclass with Google search ads. If you click one of our ads and accept the consent banner on try.dreammachine.systems, Google Ads records whether the click led to a trial start or a buy click (conversion measurement). The click is identified by a click ID that Google adds to the ad link. We use this only to measure and steer our own ad spending; we do not use remarketing or personalized advertising. Legal basis: consent (Art 6(1)(a) GDPR), withdrawable as described above. Data may be transferred to the USA under the EU-US Data Privacy Framework.

>_ Online Shop (get.dreammachine.systems):

Books, the Human Debug Deck and Masterclass licenses are sold through our online shop at get.dreammachine.systems, which runs on Shopify. When you place an order there, Shopify processes your order, payment and delivery data on our behalf. The shop has its own privacy policy, which applies to all purchases: https://get.dreammachine.systems/policies/privacy-policy.

>_ The Deployment Masterclass (masterclass.dreammachine.systems):

The Masterclass app is built so that your answers never reach our server. Everything you enter in the modules (log entries, exercises, post-mortems, your alias) is stored only in your browser (IndexedDB on your device). The Somatic Runbook and the Execution Certificate are also generated as PDFs locally in your browser. We can neither read nor restore this content.

Our server receives only your license key. We use it to check your access and to record your progress status, “started” when you complete a module and “completed” when you reach SYS_EXIT, each with a timestamp. For each license we store the license key, the order number, the e-mail address of the purchasing person or company, the status (pending, started, completed, revoked) and the related timestamps. Answers, alias, selections and time spent are never transmitted. Legal basis: performance of the contract (Art 6(1)(b) GDPR). The purchase itself is processed via our online shop (see “Online Shop”).

If your employer bought the licenses, its B2B dashboard shows only the status and the date of the last change per key, never any content. The Execution Certificate contains only the name you enter yourself, the completion time and a checksum; whether you share it is up to you.

To prevent abuse, we limit failed login attempts per IP address and downloads of the manual per license key; server log files are handled as described under “Hosting & Server Log Files”. Fonts and scripts are loaded from our own server, and the app uses no tracking or analytics tools. The module videos are embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com); when you play a video, data is transmitted to YouTube (Google), see “Third-Party Services”.

You can permanently delete all Masterclass data in your browser at any time via “STORAGE: LOCAL_ONLY” or the button “WIPE LOCAL STORAGE & SHRED DATA”; clearing your browser data has the same effect. Since we hold no copy, recovery is not possible afterwards. To have your license data deleted from our server, contact signal@dreammachine.systems.

>_ Partner program:

If you apply as a partner, we process your name, company, billing address, country, e-mail address, VAT status and VAT ID, your bank account and your commissions and payouts, to run the program and to settle commissions by credit note (contract, Art. 6 (1) (b) GDPR), and we keep credit notes and accounting records for seven years (legal obligation, Art. 6 (1) (c) GDPR, § 132 BAO). The bank account is stored encrypted. We check VAT IDs with the European Commission's VIES service; your VAT ID and ours are transmitted for that check. To prevent fraud we keep a keyed hash of the IP address of your last portal login for 30 days (legitimate interest, Art. 6 (1) (f) GDPR); the IP address itself is not stored. An application that is not confirmed by e-mail within 31 days is deleted with everything it contains.

Contact: partner@dreammachine.systems

>_ Course Landing Pages (try.dreammachine.systems):

The pages on try.dreammachine.systems present The Deployment Masterclass to visitors who arrive via our search ads. They run on the same hosting as this website, with the same server log files and self-hosted web fonts.

On your first visit, a consent banner asks whether you allow analytics and ad measurement. Until you click ACCEPT, no Google script is loaded and no data is sent to Google. Your choice is stored in your browser's local storage under the key dm_try_consent and never leaves your device. You can change or withdraw it at any time at https://try.dreammachine.systems/#consent; on withdrawal, the analytics cookies are deleted.

If you accept, we use Google Analytics and Google Ads conversion measurement (see “Third-Party Services”). We record page views and three actions: starting the free trial, clicking a buy button and opening a PDF, each with the page, plus the campaign code for trial starts and buy clicks and the file name for PDFs. Cookies: _ga and _ga_3P74B4M843 (Google Analytics, up to 2 years) and, if you arrived by clicking a Google ad, the Google Ads click cookies _gcl_* (up to 90 days).

The buttons lead to our course app and to our online shop, which provide their own privacy information. Legal basis: your consent (Art 6(1)(a) GDPR, § 165(3) TKG 2021), withdrawable at any time with effect for the future.

>_ Your Rights:

You have the right to access (Art 15), rectification (Art 16), erasure (Art 17), restriction of processing (Art 18), data portability (Art 20), and objection to processing (Art 21 GDPR), as well as the right to withdraw any consent at any time with effect for the future. To exercise these rights, contact signal@dreammachine.systems.

If you believe the processing of your data violates data protection law, you may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

>_ Updates to this Policy:

We may update this privacy policy to reflect changes in our processing or legal requirements. The current version is always available on this page.

Last updated: 20. October 2026