Privacy Policy

This Privacy Policy applies to the website dreemli.com, the Dreemli digital platform, associated user portals, forms and account areas, and related services operated by Serkan Tezgel under the name “Dreemli”. It applies to visitors, prospective customers, registered users, customers, applicants, contact persons and other individuals whose personal data is processed through these services.

The policy is based on the General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (“BDSG”), the German Telecommunications Digital Services Data Protection Act (“TDDDG”), and other applicable data protection and telecommunications rules.

This policy does not apply to independent third-party websites or services that you access through links, unless Dreemli expressly states otherwise. Those providers process data under their own privacy notices.

The controller responsible for deciding why and how personal data is processed is:

Email: contact@dreemli.com

You may use the above contact details for privacy questions and to exercise your rights. Where Dreemli uses processors, Dreemli remains responsible for determining the purposes and essential means of the processing unless a provider acts as an independent or joint controller for specific activities, such as regulated payment processing or provider account data.

“Personal data” means any information relating to an identified or identifiable individual. “Processing” includes collecting, recording, organizing, storing, changing, retrieving, using, disclosing, transmitting, restricting or deleting personal data. “Processor” means a service provider that processes personal data on Dreemli’s documented instructions. “Special-category data” includes, for example, health data, biometric data used for identification, religious beliefs, political opinions, trade-union membership, racial or ethnic origin, genetic data and information about sex life or sexual orientation.

The main processing activities are summarized below. More detail is provided in the sections that follow.

Website and security logs: Secure delivery of the website and platform; Art. 6(1)(f) GDPR. Logs are normally retained for 7–30 days, longer only for security incidents or legal requirements.

Accounts and platform services: Create and manage accounts and provide requested services; Art. 6(1)(b) GDPR. Retained for the account/contract term and applicable limitation or legal retention periods.

Counselling and applications: Respond to enquiries, provide educational/career counselling, prepare or support applications and document workflows; Art. 6(1)(b), (c) and/or (f) GDPR.

AI-assisted functions: Generate summaries, suggestions, classifications or draft content with human review; Art. 6(1)(b), (a) or (f) GDPR, and Art. 9(2)(a) GDPR where special-category data is intentionally processed.

CRM and communications: Manage contacts, cases, correspondence and service status; Art. 6(1)(b) and (f) GDPR. Prospective-contact records are generally deleted after 12 months without a continuing relationship.

Payments: Process fees, refunds, fraud prevention and accounting; Art. 6(1)(b) and (c) GDPR and legitimate interests in secure payment processing.

Analytics: Measure website use and improve the service; only after consent under Art. 6(1)(a) GDPR and Section 25 TDDDG, unless a strictly necessary exemption applies.

5.1 Categories of data

Identity and master data: name, title, date of birth where needed, nationality, customer or applicant number and account identifiers.

Contact data: postal address, email address, telephone number and preferred communication language.

Account and authentication data: username, password hash, login events, multi-factor authentication information, access roles and account settings.

Education, career and application data: CV information, schools and universities attended, qualifications, grades, language skills, work experience, career goals, study preferences, application status and related notes.

Immigration and mobility data where relevant to the requested service: citizenship, residence status, visa-related information, travel or relocation plans and documents needed for an application.

Document data: CVs, letters, certificates, transcripts, passports or identity documents, residence permits, application forms, photographs and other files you choose or are required to upload.

Payment and transaction data: payer name, billing address, amount, currency, transaction status, payment method type, invoice data and limited payment identifiers. Full card data is generally handled directly by Stripe when Stripe-hosted fields or Checkout are used.

Communication data: emails, messages, support requests, appointment notes, call summaries, feedback and records of consent or preferences.

Technical data: IP address, browser and device information, operating system, referrer URL, timestamps, page or feature requests, error data, security events and cookie or consent identifiers.

Usage and analytics data: pages viewed, interactions, session information, approximate location derived from IP address, device category and campaign parameters, where analytics consent has been given.

AI input and output data: prompts, uploaded content, extracted text, model responses, summaries, recommendations and user feedback on AI-assisted functions.

5.2 Sources of data

We generally receive personal data directly from you when you visit the website, create an account, complete a form, upload documents, communicate with us, make a payment or use a platform feature. We may also receive data from persons you authorize, educational institutions, partner organizations, payment providers, publicly accessible professional sources, or other services that you connect or instruct us to contact. Where another person provides data about you, we will provide the required information under Articles 13 or 14 GDPR, unless an exception applies.

When you access the website or platform, the hosting environment and delivery systems automatically process technical data necessary to establish the connection, display content, maintain stability and prevent attacks. This may include IP address, date and time, requested resource, HTTP status, transferred data volume, referrer, browser, operating system, device information and security signals.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are reliable operation, cybersecurity, fraud prevention, troubleshooting and evidencing misuse. Data required for a requested communication service may also be processed under Art. 6(1)(b) GDPR. Server logs are normally deleted or anonymized within 7–30 days. Logs may be retained longer where a concrete security incident, fraud investigation, legal claim or statutory duty requires this.

If you register for an account, we process the data needed to create, authenticate, secure and administer the account and to provide the platform functions you request. This includes account data, login and security records, profile information, preferences, uploaded content, activity relevant to the service and communications connected with the account.

The legal basis is Art. 6(1)(b) GDPR for account creation and service performance. Security measures and abuse prevention are additionally based on Art. 6(1)(f) GDPR. Where optional profile elements or features require consent, the legal basis is Art. 6(1)(a) GDPR.

You are responsible for keeping access credentials confidential and for ensuring that data entered into your account is accurate. We may temporarily restrict or permanently close accounts where necessary to protect the platform, comply with law or enforce contractual terms. Account data is deleted or anonymized after termination when it is no longer required for contractual, legal, security or claims-related purposes.

When you contact Dreemli or request educational, university, career, language, visa-related or relocation support, we process the information necessary to understand your request, communicate with you, assess possible service options, prepare offers, provide counselling, organize appointments and, where instructed, prepare or support applications.

Depending on the service, we may process education history, career goals, language level, preferred institutions or programmes, application documents, deadlines, status information and correspondence. If you instruct us to submit or communicate an application, data may be disclosed to the selected institution, programme provider, authority, embassy, consulate, examination body, translator, insurer, accommodation provider or other recipient necessary for the requested service.

The principal legal basis is Art. 6(1)(b) GDPR for pre-contractual steps and contract performance. Legal duties are based on Art. 6(1)(c) GDPR. Quality assurance, case administration, fraud prevention and the defence of legal claims may be based on Art. 6(1)(f) GDPR. Optional marketing or use of information beyond the requested service requires consent where applicable.

Documents uploaded for counselling or applications may contain extensive personal data. Please upload only information that is relevant and necessary. Before uploading documents, you should redact unrelated identifiers, financial information, family data or other information not required for the requested service.

Some documents may reveal special-category data, for example health or disability information, religious affiliation, racial or ethnic origin, biometric identifiers, political opinions or trade-union membership. Dreemli does not request such data unless it is genuinely necessary for a service or legal requirement. Where processing is necessary and no other legal basis applies, we obtain explicit consent under Art. 9(2)(a) GDPR. Processing may also be permitted under Art. 9(2)(f) GDPR where necessary for the establishment, exercise or defence of legal claims.

9.1 Data minimisation

Do not upload original identity documents or special-category information unless the platform or a Dreemli advisor specifically requests it for a defined purpose. Use the secure upload channel rather than ordinary email whenever one is available.

10.1 Purpose and operation

Dreemli may use Google Gemini API services to support functions such as extracting text from documents, translating or summarizing content, identifying missing information, generating draft application text, suggesting next steps, categorizing enquiries, preparing checklists or assisting advisors. AI-generated content may be inaccurate, incomplete or unsuitable and is therefore subject to human review before it is used for material counselling or application decisions.

10.2 Data transmitted to Gemini

Depending on the feature, prompts, selected profile information, uploaded files, extracted text and relevant context may be transmitted to the Gemini service. Dreemli applies data minimisation and, where feasible, pseudonymisation or redaction. Users should not provide unnecessary confidential information or third-party data in free-text prompts.

10.3 Legal basis

Where the AI function is necessary to provide a feature or service requested by you, processing is based on Art. 6(1)(b) GDPR. Optional AI features or processing that is not necessary for the contract may be based on consent under Art. 6(1)(a) GDPR. Internal assistance that does not override your rights may be based on Art. 6(1)(f) GDPR, reflecting our legitimate interest in efficient, consistent and high-quality service delivery. Special-category data is transmitted only where legally permitted, normally on the basis of explicit consent under Art. 9(2)(a) GDPR.

10.4 Provider, retention and model improvement

For production use in the EEA, Dreemli uses a paid Gemini API configuration under the applicable Google Cloud terms. The relevant contracting entity for Germany is generally Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Under the paid-service terms, Google states that prompts and responses are not used to improve Google products and are processed under Google’s data processing terms. Google may nevertheless retain limited prompt and response data for abuse monitoring and security, currently for up to 55 days, unless an eligible zero-data-retention configuration applies. Provider terms and technical controls may change, and Dreemli reviews them periodically.

10.5 Human oversight and your choices

Dreemli does not use Gemini output as the sole basis for decisions that produce legal effects or similarly significantly affect you. Material recommendations and submissions are reviewed by a person. You may ask for human review, correct source information, challenge an AI-assisted result, or request a non-AI alternative where reasonably available. Withdrawing consent does not affect processing already carried out lawfully before withdrawal.

10.6 AI transparency

Where a platform feature directly uses generative AI, the interface should clearly indicate this and explain what data is transmitted before the user submits information. Sensitive or identity-document processing should require a separate, explicit step.

Dreemli uses Zoho CRM to manage prospective and existing customer relationships, enquiries, counselling cases, application stages, tasks, appointments, communications, consent status and service history. Data stored in Zoho CRM may include contact details, profile information, notes, status information, correspondence and links or references to documents.

The legal bases are Art. 6(1)(b) GDPR for pre-contractual and contractual case management and Art. 6(1)(f) GDPR for organized customer service, workflow management, documentation and quality assurance. Consent under Art. 6(1)(a) GDPR is used where required, for example for optional marketing communication.

Zoho generally acts as a processor for service data. Dreemli uses or should use the EU Zoho domain for production accounts so that primary service data is hosted in Zoho’s EU data centres. Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands, operates EU data centres, while other Zoho group entities and subprocessors may support the service under contractual transfer safeguards. Dreemli relies on the applicable Zoho Data Processing Addendum and reviews access permissions and CRM retention settings.

Dreemli uses ZeptoMail, a Zoho service, to send transactional and service-related emails such as account verification, password reset, application status, appointment confirmation, security alerts, invoices or other messages triggered by your use of the platform.

The processed data may include recipient name and email address, message content, template and sender information, timestamps, delivery status, bounce and complaint information, and—if enabled—open or click events. The legal basis is Art. 6(1)(b) GDPR for contractual and account communications, Art. 6(1)(c) GDPR for required notices and Art. 6(1)(f) GDPR for reliable delivery, security and troubleshooting. Marketing emails are not treated as transactional messages and require a separate lawful basis, generally consent.

For EU-hosted use, the account should be registered through the EU ZeptoMail domain. ZeptoMail states that email content, where content storage is enabled, is retained for 60 days and that activity logs may be retained for one year. Dreemli configures the service to retain only the information required for delivery and troubleshooting and aligns its own records with the retention rules in Section 22.

The Dreemli platform uses Amazon Web Services (“AWS”) infrastructure for hosting, computing, databases, file storage, backups, security monitoring and related cloud functions. Depending on the architecture, AWS may process account data, uploaded documents, application data, technical logs and system metadata on Dreemli’s behalf.

The legal bases are Art. 6(1)(b) GDPR for providing the platform and Art. 6(1)(f) GDPR for reliable, scalable and secure operation. AWS acts as a processor for customer content under the AWS Data Processing Addendum. Dreemli selects EEA AWS Regions for primary storage where the relevant service is available and configures access, encryption, logging, backups and deletion under the AWS shared-responsibility model.

AWS states that customers control the selected region and that customer content is not moved outside the selected region without agreement, except where necessary for requested services or legal compliance. Certain support, security, global delivery or subprocessor functions can involve processing outside the EEA. Such transfers are governed by the AWS DPA, Standard Contractual Clauses or another valid transfer mechanism.

Dreemli uses Stripe to process online payments, payment method authentication, refunds, disputes, fraud detection, transaction reporting and related financial operations. Stripe may process name, email address, billing and shipping address, payment method details, bank or card information, transaction amount, currency, time, device data, IP address, customer identifier and fraud-prevention signals.

The legal basis for payment processing is Art. 6(1)(b) GDPR. Tax, accounting, anti-money-laundering or other legal duties are based on Art. 6(1)(c) GDPR. Fraud prevention and payment security may be based on Art. 6(1)(f) GDPR and on Stripe’s own legal obligations and legitimate interests.

Where Stripe Checkout or Stripe-hosted payment fields are used as intended, full card numbers are transmitted directly to Stripe and are not stored in Dreemli’s systems. Dreemli normally receives transaction status, limited payment method information and identifiers needed to reconcile the payment.

For users and business accounts in the EEA, relevant Stripe entities may include Stripe Payments Europe, Limited, Stripe Technology Company, Limited and Stripe Technology Europe, Limited, all located in Ireland, depending on the product and processing role. Stripe acts partly as Dreemli’s processor and partly as an independent or joint controller for regulated payment, fraud prevention and legal compliance. International transfers are covered by Stripe’s Data Processing Agreement, Standard Contractual Clauses, the EU–U.S. Data Privacy Framework where applicable, and other recognized mechanisms.

Dreemli uses Slack for internal team communication, operational coordination, technical support and case escalation. In limited cases, messages may contain a customer name, contact detail, case identifier, status, support request or a necessary extract from correspondence. Dreemli seeks to avoid placing full identity documents, payment data or unnecessary special-category data in Slack.

The legal basis is Art. 6(1)(b) GDPR where communication is necessary to perform a requested service and Art. 6(1)(f) GDPR for efficient collaboration, support, incident response and internal accountability. Access is restricted to authorized team members, and data is retained according to configured workspace retention rules and the underlying case-retention criteria.

Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland, generally acts as a processor for customer content in workspaces created for customers outside the United States and Canada. Slack may use subprocessors and process certain information in the United States. Transfers are supported through Slack’s Data Processing Addendum, Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

The website and platform may use cookies, local storage, session storage or similar technologies. Strictly necessary technologies support functions such as login, session continuity, security, load balancing, language settings, consent storage and payment flow. These may be used without consent where the requirements of Section 25(2) TDDDG are met. The associated personal-data processing is based on Art. 6(1)(b) or (f) GDPR, depending on the function.

Analytics, advertising or other non-essential technologies are activated only after valid consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent is voluntary and can be withdrawn at any time through the cookie settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. The cookie banner must offer a real choice and must not load non-essential tags before consent.

Cookie names, providers, purposes and durations should be displayed in the live cookie settings because they may change with the technical configuration. Browser settings can also delete or block cookies, although some platform functions may then be unavailable.

If you consent, Dreemli uses Google Analytics 4 to understand how visitors use the website and platform, measure performance, identify technical or usability issues and improve content and services. The service may process device and browser data, page and event information, approximate location, campaign parameters, consent status, identifiers stored in cookies and technical request data.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google Analytics is blocked before consent in the basic consent-mode configuration. You can withdraw consent at any time through cookie settings.

Google states that individual IP addresses from users in the EU, Switzerland and the United Kingdom are not logged or stored and are discarded after deriving coarse location data. Dreemli configures user- and event-level retention for no more than 14 months and disables Google Signals, advertising personalization and granular location/device collection unless a separate, informed consent and a documented need exist.

The provider for EEA services is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google group companies may process data globally. Transfers to third countries are based on applicable data processing terms, Standard Contractual Clauses, adequacy decisions or other valid safeguards.

Dreemli uses Google Search Console to monitor how the public website appears in Google Search, identify indexing and technical issues, and view aggregated search performance such as clicks, impressions, positions and search terms. Search Console is primarily an administrative tool and does not itself require Dreemli to place additional Search Console cookies on visitors’ devices.

Google may process search and crawling data under its own responsibility. Reports use aggregation and privacy protections; rare or sensitive search queries may be omitted. Dreemli’s use of the reports is based on Art. 6(1)(f) GDPR, reflecting the legitimate interest in maintaining website visibility, quality and security.

We use your contact information to respond to enquiries, provide contractual information, send account and security notifications, arrange appointments and communicate about active services. The legal basis is Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR where notices are legally required, and Art. 6(1)(f) GDPR for efficient service and documentation.

Promotional emails, newsletters or other direct marketing are sent only where a valid legal basis exists, generally consent under Art. 6(1)(a) GDPR and the applicable German rules on electronic marketing, or a narrowly applicable existing-customer exception. You can unsubscribe at any time using the link in the message or by contacting contact@dreemli.com. Service and security messages cannot always be opted out of while an account or contract remains active.

Personal data is disclosed only where necessary for the stated purposes, where you have instructed or consented to the disclosure, or where law requires it. Recipient categories may include:

Cloud, hosting, database, security, backup and technical support providers, including AWS.

CRM and email delivery providers, including Zoho CRM and ZeptoMail.

AI service providers, including Google Gemini API services.

Payment providers, financial institutions, payment networks and fraud-prevention partners, including Stripe.

Internal collaboration and support tools, including Slack.

Professional advisers such as lawyers, tax advisers, auditors, translators and IT security specialists, subject to confidentiality obligations.

Educational institutions, universities, language schools, examination bodies, immigration or other authorities, embassies, consulates, insurers, accommodation providers or other recipients selected by you or necessary for the requested application or service.

Public authorities, courts or law-enforcement bodies where disclosure is legally required or necessary to establish, exercise or defend legal claims.

Processors are engaged under Art. 28 GDPR where required. They may use subprocessors within the limits of the applicable contract. Independent controllers process data under their own statutory duties and privacy notices.

Some providers or recipients are located outside the European Economic Area or permit support access from third countries. A third-country transfer occurs only where the requirements of Chapter V GDPR are met. Depending on the circumstances, Dreemli relies on:

An adequacy decision of the European Commission, including the EU–U.S. Data Privacy Framework for appropriately certified U.S. recipients where applicable.

European Commission Standard Contractual Clauses, supplemented where necessary by transfer impact assessments and technical or organizational safeguards.

Binding corporate rules or another legally recognized transfer mechanism.

An exception under Art. 49 GDPR in limited cases, for example where a transfer is objectively necessary to perform a contract requested by you or to conclude or perform a contract in your interest, such as an application to an institution outside the EEA.

You may request information about the relevant transfer mechanism and, where available, a copy of the applicable safeguards. Commercial terms, confidential information and third-party rights may be redacted.

Dreemli retains personal data only for as long as necessary for the relevant purpose and thereafter only where required by law, contract, security needs or the establishment, exercise or defence of legal claims. The following periods are the usual rules or criteria:

Server and security logs: Normally 7–30 days; up to 90 days or longer where a security incident, fraud investigation or legal obligation requires it.

Enquiries without a contract: Usually 12 months after the last substantive contact, unless consent permits longer contact or a claim must be preserved.

Accounts and service files: For the active account or contract term, then generally through the regular three-year limitation period, calculated under German law, unless a longer or shorter period applies.

Application documents: Until the service and any agreed follow-up are complete, then deletion or return according to the contract, user request and applicable claims periods. Unnecessary identity-document copies should be deleted earlier.

CRM records: Aligned with the enquiry, contract and claims periods; inactive prospect data is generally deleted after 12 months without a continuing relationship.

Invoices and accounting records: Accounting vouchers generally for eight years; business correspondence generally for six years; certain books, records and annual accounts for ten years, subject to current German tax and commercial law.

Stripe payment records: Dreemli retains limited transaction and accounting data for applicable legal periods. Stripe may retain data independently under payment, fraud-prevention and legal obligations.

ZeptoMail: Email content, if storage is enabled, may be held by the provider for 60 days; provider activity logs may be retained for one year. Dreemli’s own message records follow the underlying case or legal retention period.

Gemini API: Dreemli retains AI inputs and outputs only as part of the relevant service record. Google may retain abuse-monitoring data for up to 55 days under the paid API terms unless an eligible zero-data-retention configuration applies.

Analytics: User- and event-level data for no more than 14 months; aggregated reports may be retained longer where they no longer identify individuals.

Consent records: For the period consent is relied on and generally for three years afterwards to demonstrate compliance.

Backups: Rolling backup copies are generally overwritten within 30–90 days, unless isolated for incident recovery or legal preservation.

Deletion may be temporarily suspended where data is subject to a legal hold, dispute, audit, investigation or statutory preservation obligation. When deletion is not immediately possible, processing is restricted and the data is deleted when the reason for retention ends.

Dreemli implements technical and organizational measures appropriate to the risk, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing. Measures may include TLS encryption in transit, encryption at rest where supported, access controls and role separation, multi-factor authentication, secure password hashing, logging and monitoring, backups, vulnerability management, staff confidentiality, processor due diligence, incident response procedures and data-minimising default settings.

No internet service can guarantee absolute security. You should use a strong, unique password, protect your devices, avoid sharing credentials, and notify Dreemli immediately if you suspect unauthorized access. Ordinary email may not be suitable for highly confidential documents; use the platform’s secure upload function where available.

Subject to the applicable legal requirements and exceptions, you have the following rights:

Access (Art. 15 GDPR): confirmation whether data is processed and information and copies concerning that processing.

Rectification (Art. 16 GDPR): correction of inaccurate data and completion of incomplete data.

Erasure (Art. 17 GDPR): deletion where the legal conditions are met, including where data is no longer necessary or consent is withdrawn and no other legal basis applies.

Restriction (Art. 18 GDPR): limitation of processing in specified circumstances, for example while accuracy or an objection is being assessed.

Data portability (Art. 20 GDPR): receipt of data you provided in a structured, commonly used, machine-readable format and, where technically feasible, transmission to another controller where processing is based on consent or contract and carried out by automated means.

Objection (Art. 21 GDPR): objection to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation, and an unconditional right to object to direct marketing.

Withdrawal of consent (Art. 7(3) GDPR): withdrawal at any time for the future.

Not to be subject to certain solely automated decisions (Art. 22 GDPR), where the legal conditions apply.

Complaint to a supervisory authority (Art. 77 GDPR).

To exercise a right, contact contact@dreemli.com. We may request information necessary to verify your identity and protect other persons’ data. Requests are normally answered within one month; this period may be extended by up to two further months for complex or numerous requests, in which case we will inform you. Rights may be limited where disclosure would adversely affect the rights and freedoms of others, legal privileges, statutory retention obligations or other applicable exceptions.

Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. Dreemli will stop the processing unless compelling legitimate grounds override your interests, rights and freedoms or the processing is required for legal claims. You may object to direct marketing at any time without giving reasons.

Where processing is based on consent, you may withdraw consent at any time through the relevant settings or by contacting us. Withdrawal applies only to future processing. If a requested service cannot be provided without the affected data, we will explain the consequences before or after withdrawal as appropriate.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the alleged infringement. The supervisory authority responsible for private-sector controllers established in Hessen is:

The Hessian Commissioner for Data Protection and Freedom of Information

Email: poststelle@datenschutz.hessen.de

You are welcome to contact Dreemli first so that we can try to resolve the issue directly, but this is not a prerequisite for filing a complaint.

Dreemli’s services may be relevant to students and young people. Where a user is not legally able to enter into the relevant contract or provide valid consent, authorization from a parent or legal guardian is required. For consent-based information-society services offered directly to a child, the age rules of Art. 8 GDPR and applicable German law apply. Dreemli may take reasonable steps to verify age and parental responsibility where necessary.

The paid Gemini API terms currently require API clients not to be directed toward, or likely to be accessed by, individuals under 18. Dreemli therefore restricts direct generative-AI platform functions to adults unless and until a legally and contractually compliant alternative or supervised workflow is implemented.

Some data is required to create an account, process a payment, provide counselling, prepare an application or meet a legal obligation. Required fields are identified in the interface or explained by an advisor. Without required data, Dreemli may be unable to create the account, conclude or perform a contract, process an application or provide a requested function. Optional data is marked or can be omitted without affecting the core service, although personalization or specific features may be limited.

If you upload or provide data about another person—for example a parent, sponsor, referee, family member, employer or contact at an institution—you must have a lawful basis to do so and must provide any information required under data protection law. Do not provide third-party identity documents, contact details or sensitive information unless it is necessary for the requested service and you are authorized to share it. Dreemli may ask for evidence of authority or may delete unnecessary third-party data.

Dreemli may use rules, scoring or AI-assisted analysis to prioritize tasks, identify missing information, match stated preferences with programme criteria, detect anomalies or suggest content. These tools support users and advisors; they do not by themselves make admission, visa, employment, credit or other decisions producing legal or similarly significant effects. Final decisions by universities, authorities, payment providers or other independent recipients are governed by those recipients’ processes and privacy notices.

If Dreemli introduces solely automated decision-making within the meaning of Art. 22 GDPR, the policy and interface will be updated in advance, including information about the logic involved, significance and envisaged consequences, and the rights to human intervention, expression of a viewpoint and contesting the decision.

The website or platform may link to universities, public authorities, partners, payment pages, social networks or other third-party services. Dreemli does not control the independent processing performed after you follow an external link. Review the third party’s privacy information before providing personal data.

Dreemli may update this policy when the platform, providers, legal requirements or processing activities change. The current version and effective date will be published on the website. Material changes may also be communicated through the platform or by email where appropriate. Processing based on consent will not be materially expanded without obtaining a new consent where required.

The following official pages provide additional information about the providers and legal rules referred to in this policy. Provider notices may change independently of Dreemli.

Zoho privacy policy: https://www.zoho.com/de/privacy.html

Zoho GDPR information: https://www.zoho.com/gdpr.html

Zoho ZeptoMail GDPR information: https://www.zoho.com/zeptomail/gdpr.html

Google Gemini Apps Privacy Hub (consumer service): https://support.google.com/gemini/answer/13594961?hl=en

Gemini API terms: https://ai.google.dev/gemini-api/terms

Gemini API zero data retention information: https://ai.google.dev/gemini-api/docs/zdr

AWS privacy notice: https://aws.amazon.com/privacy/app/

AWS data privacy FAQ: https://aws.amazon.com/compliance/data-privacy-faq/

Stripe privacy policy: https://stripe.com/at/privacy

Stripe data processing agreement: https://stripe.com/legal/dpa

Slack privacy policy: https://slack.com/intl/de-de/trust/privacy/privacy-policy

Slack GDPR information: https://slack.com/trust/compliance/gdpr

Google Analytics EU privacy information: https://support.google.com/analytics/answer/12017362?hl=en

German TDDDG Section 25: https://www.gesetze-im-internet.de/ttdsg/__25.html

Hessian data protection authority: https://datenschutz.hessen.de/

Questions and requests may be sent to contact@dreemli.com or by post to Serkan Tezgel, Viktoriastraße 24, 64283 Darmstadt, Germany.