Privacy notice

Who is responsible

• The controller is lyrik, based in the UK. Contact hello@lyrik.fm about privacy.
• This draft describes the UK GDPR position for review.

Optional advertising measurement

• If you accept advertising cookies, we use Google Ads to measure visits from our ads and completed credit-pack payments. Google receives advertising click identifiers, browser and connection information, and a payment reference with its value and currency. We do not send your account email, song, lyrics, artwork or project details. We do not enable personalised advertising or enhanced conversions.
• Rejecting advertising cookies does not affect making or buying a video. You can change your choice on the Cookies page. Browser Global Privacy Control and Do Not Track signals also disable this measurement.

Information we handle

• Your email, account details, sign-ins and terms acceptance; uploaded audio, lyrics, covers and photos; song settings, sync edits and exported videos; and the support requests, content reports and beta feedback you send us.
• If you sign in with Google or Apple, where offered, we receive a verified email address and that provider’s account identifier, and keep the link between that identifier and your lyrik account.
• If you use lyrik.fm inside a partner’s website, that partner signs you in for us. It tells us your account number with the partner, your email address and your plan with them. We don’t keep your plan. When you pick a release there, it also sends us the release’s title, artists, artwork and tracks (titles, ISRC codes, explicit flags and any lyrics you gave the partner), with short-lived links to the audio and artwork. We copy only the track you choose into your project: its audio and artwork, its title, artists and lyrics, its ISRC code, and the partner’s numbers for the release and the track. We keep them with the project like any upload. We keep the partner’s account number with your lyrik account, to sign you in again and to give you the prices agreed with the partner. We don’t keep or email the address it sends unless the partner tells us it has checked that the address is yours. If you use the video maker through Ditto, we keep the latest email address you give at Checkout separately from your sign-in details and use it only to tell you about your order. We also note that your account was made through the partner, so we can count the sign-ups, syncs and purchases that come from it.
• Stripe handles payment details. lyrik keeps payment metadata such as the amount, currency, payment reference and credit balance, never your card number.
• Credit packs are sold through Stripe Managed Payments, where Stripe’s Onelink service is the merchant of record for the payment. Stripe and Onelink use your payment details, billing address and email to take the payment, work out tax, send receipts, prevent fraud and answer payment questions, under their own privacy terms. You can ask Onelink to delete the information it holds about your Managed Payments purchases.
• Security records include hashed IP information, timestamps and limited browser information. Authorised support staff can access account and project information when helping with a request. Staff lookups and changes are audited.
• If you reach lyrik from one of our ads or another website, your browser keeps the ad’s campaign tags and the other website’s name (never the full address) for up to 30 days. If you then make an account, we keep them with it, so we can see which ads lead to sign-ups, synced songs and purchases. This first-party measurement is separate from the optional Google Ads measurement described above. A browser that sends Global Privacy Control or Do Not Track is not recorded. The tags are in your data export and are deleted with your account.
• We count how many visits reach each step of making a video: a page with the start button, tapping it, choosing a track, asking for a sign-in code or for a link to use on a computer, signing in, a first sync, a first download of your free clip and a first payment. We also count how often the advertising-cookie banner is shown and how often each answer is chosen. Each count is a daily total, kept by the campaign tags above, a rough device type (phone, tablet or computer) and whether the page was open inside an app’s own browser, such as Instagram’s. No name, email address, account, IP address or cookie is kept with a count, so a count can’t be traced back to you. Steps in your browser are not counted inside a partner’s website, or when your browser sends Global Privacy Control or Do Not Track. Signing in, a first sync, a first download of your free clip and a first payment are counted by our servers when they happen, under the campaign tags kept with the account, if any. To stop the counts being flooded, requests are rate-limited using a keyed hash of the network address, kept like our other security records.
• If we ask where you heard about lyrik, your answer (or that you skipped it) and when you gave it are kept with your account. So are a few first times: when that question was first shown (so it is asked only once), when you first reached the Download step and when you first downloaded your free clip. They help us see where people stop on the way to a video. Authorised staff can see them account by account in our admin tools, and each look is recorded. They are in your data export and are deleted with your account.
• If you ask on your phone for a link to finish on your computer, we use the address you give to send that one email. The link works once and expires after 3 days. If you tick the box for tips and new styles, that choice is recorded when you use the link.

Why we use it

• We use your account and uploads to sign you in, sync lyrics, create and deliver videos, manage credits and answer support requests. Proposed basis: performing our contract with you.
• We use security and operational records to prevent abuse, investigate reports and keep the service working. Proposed basis: legitimate interests in running a safe service.
• We read beta feedback to fix problems and decide what to improve. Proposed basis: legitimate interests in improving the service.
• Payment records may need to be kept to meet legal obligations. Optional product emails use a separate preference; agreeing to the Terms does not opt you into marketing.
• If you sync a song and don’t download or buy a video of it, we may send you one email about that song while its preview is still saved. It comes about a day after you were last in lyrik, never in the last 12 hours before the preview is deleted, and only once per song. To time it we use when your song finished syncing, when you last saved a style, and when you last signed in or used lyrik while signed in. To stop these emails, choose Stop project reminders in the email or turn off Project reminders and preview expiry in your account. Proposed basis: performing our contract with you (or legitimate interests in helping you finish a song you started).

Service providers

• Our cloud service uses Vercel for hosting; Cloudflare R2 for file storage and Cloudflare Turnstile for bot protection; Neon for the database; Modal for analysis and rendering; Stripe for payments; and Resend for email. Sentry receives restricted error reports only when enabled.
• When you choose one of the optional image tools (removing text from your cover, widening it, or making new backgrounds), we send the picture you chose, our instructions and any description you type to Replicate, which runs the image model and sends the result back. The tool shows its price before you use it. Your audio and lyrics are never sent to Replicate.
• When you search for a free video, we send Pexels the words you type or the category you tap, never your account, email or song. Your browser loads the clips’ pictures and previews straight from Pexels (images.pexels.com and videos.pexels.com), so Pexels sees your IP address and browser details, under its own privacy policy.
• Vercel is also our processor for optional cookieless traffic measurement on an allowlist of public pages. This measurement is not needed to create a video. It is kept off the app routes and /embed. Public pages may still be measured when visited by someone who has an account. We strip query values, except the campaign tags in homepage links from our ads (utm_source, utm_medium, utm_campaign and utm_content), and reject hash URLs before sending page views. This cookieless measurement is separate from the advertising-cookie choice.

International transfers

• Some providers may process information outside the UK. This draft does not promise that all processing stays in the UK.

How long information is kept

• Unpaid previews expire after 7 days. Download files are retained for 90 days. Paid project records and accounts can remain until you delete them. Account-data export files expire after 1 hour.
• Financial and related audit records may need to remain after deletion for legal obligations.
• We record server-side product events using pseudonymous project hashes, with event time and limited style/download details. These are removed when the project is erased; the current code has no general time-based purge for older metric rows.
• Reports include the reporter’s email, the content link, description and statement. They are available to authorised staff in the report queue. Terms acceptances are included in account export and removed during account erasure.
• Beta feedback holds your rating and note, the page and studio step you sent it from, the style you had open, whether you were on a phone or computer, whether lyrik.fm was running inside a partner’s website and, if you were signed in, your account and the song you had open. We keep an email only if you ask us to reply. Authorised staff read feedback in the admin console, and new notes are emailed to our operations inbox. Your feedback is included in account export and removed when you delete your account.
• Artist-credit invites that aren’t claimed are cleared after 60 days; claimed invite details stay with the account until you delete it.

Your choices and rights

• Account settings lets you export account data and request deletion. For access to other personal information, correction, restriction, objection, portability or a privacy complaint, email hello@lyrik.fm. Some rights depend on the circumstances and legal basis.
• You can change optional email preferences in your account and unsubscribe from optional messages. You can complain to the UK Information Commissioner’s Office at ico.org.uk.
• Our Cookies page explains session cookies, local browser storage and cookieless measurement.

Artist credits

• If you ask us for artist credits, we keep the email and social handle you give us so we can add the credits when you sign up. If you don’t sign up within 60 days, we delete them. We keep a one-way code made from the address so the same credits can’t be claimed twice. If you sign up, we keep the email and handle with your account, with a record of the credits, so we can see how the programme is going (for example songs synced, downloads and feedback). We delete the email and handle when you delete your account. Feedback from artists given credits is marked as incentivised and isn’t published as a rating.

Referral records

• When referrals are offered, we keep the link between the two accounts, eligibility decisions and credit records. We use keyed email and verified sign-in identity hashes to stop repeat claims, and short-lived hashed browser and network records to check abuse. Friends see only referral dates and reward status, without each other’s email or account details.
• Browser abuse records are used for up to a day and then removed. If you delete your account, we keep the keyed email and sign-in identity hashes and the account links held with reward and refund records, to stop repeat claims.

Help conversations

• When you use Help, Anthropic processes your question, relevant published guides and the account or song checks needed to answer it. Account checks sent to the model do not include payment details, your email, account ID or the account ID the partner site sends. Authorised staff can read saved conversations and tool checks. If you choose Email support, we send the conversation and diagnostics, including account and song IDs, the account ID the partner site sends when present, browser information and whether the browser reports being inside a partner website, to our support inbox. Conversations follow feedback retention: they stay with your account, are included in account export and are removed when you delete your account. The copy already sent to the support inbox is kept after account deletion for the support case.

Seller and contact

lyrik is an independent business based in the UK.

hello@lyrik.fm · Account settings: export or delete