Legal
Data Processing Addendum
Effective July 13, 2026
Scope
This Addendum is part of the DreamBeam Terms between Recursive Systems LLC and a business customer. It applies when DreamBeam processes personal data for that customer to provide the service. The customer is the controller or business. Recursive Systems LLC is the processor or service provider.
Instructions and purpose
DreamBeam processes personal data only to provide, secure, support, and maintain the service, follow the customer's documented instructions, or comply with law. The Terms, product settings, and support requests are documented instructions. DreamBeam will notify the customer if an instruction appears unlawful unless prohibited.
Customer duties
The customer must have a lawful basis, provide required notices, obtain required permissions, and limit data to what is necessary. The customer must not use DreamBeam for restricted sensitive data or high-impact decisions listed in the Acceptable Use Policy without a separate written agreement.
Security and confidentiality
DreamBeam uses access controls, encrypted transport, encrypted provider credentials, owner-scoped authorization, brokered credentials, private attachment storage, secret filtering, and minimized diagnostics. People authorized to process customer data are bound by confidentiality duties.
Subprocessors
The customer authorizes the providers on the Subprocessors page. DreamBeam remains responsible for their processing to the extent required by law. DreamBeam gives 30 days' notice of a change when practical. A customer may object on reasonable data-protection grounds and may stop using the service before the change.
Requests and incidents
DreamBeam will reasonably assist with verified privacy requests, impact assessments, regulator inquiries, and security incidents involving customer data. We will notify the customer without undue delay after confirming a breach that requires notice and provide available facts needed for the customer's response.
Return, deletion, and evidence
The customer can export data and delete chats, workspaces, or the account. Recovery backups expire on the infrastructure provider's schedule and are not restored for account recovery. On reasonable request, DreamBeam will provide information needed to show compliance. Audits must protect other users, confidentiality, and system security, and should use existing reports before an on-site review.
U.S. state privacy terms
DreamBeam acts as a service provider or processor for covered personal data. It does not sell or share that data for cross-context behavioral advertising, retain or use it outside the permitted business purpose, or combine it with unrelated personal data except as allowed by law. DreamBeam will notify the customer if it can no longer meet these duties.
Order and contact
This Addendum controls over conflicting Terms for covered processing. Contact [email protected] for a signed copy or another data-protection request.