Policy

Privacy policy

Last updated: 19 September 2026

This is a translation provided for convenience. In case of discrepancy, the French version prevails.

Lyricly generates lyrics and style tags from a brief. To do so, we process a small amount of personal data. This page says which data, why, how long we keep it, who receives it and how to exercise your rights — in plain words, and without collecting anything the service doesn't need.

1. Data controller

The publisher of the Lyricly service (lyricly-music.com) is the controller of your data. For any question or request about your data: contact@lyricly-music.com.

2. Data we collect

Your account

• Email address — your sign-in identifier, used to send the verification link and password reset links.
• Password — stored only as a bcrypt hash. We cannot read it, and we will never send it back to you by email.
• Dates of account creation, email verification and last password change (the latter is used to sign out your other devices).
• Interface language (English or French), if you have chosen one.

What you write

• The brief, the genre / mood / theme fields, the requested languages, and the lyrics you bring or dictate.
• The generated songs (title, styles, lyrics, model used), kept in your history so that you can reopen them from any device.
• The audio you dictate or import is not kept: it is sent for transcription, then only the resulting text is retained, in the form, until you save or clear it.

Subscription

• Your plan (Free, Pro or Premium), the billing interval (monthly or yearly), the end of the current period, and the number of songs produced this month (the quota).
• The technical identifiers of your customer and subscription at Stripe. We never receive your card number or bank details: payment happens entirely on Stripe's checkout page.

Technical data

• IP address — used only in anti-abuse counters (account creation, sign-in, email verification, password reset), and deleted at most one hour after the last attempt.
• Server technical logs (errors, requests), kept briefly for diagnostics.

3. Cookies and local storage

Strictly necessary cookie. Lyricly sets one cookie, lyricly_session, which keeps you signed in for 7 days. It is inaccessible to scripts (httpOnly), restricted to the site (SameSite) and encrypted in transit (Secure). It does not require your consent, as the law doesn't require it for an essential session cookie.

Audience measurement, only with your consent. We use Google Analytics 4 to know how many people visit the site, which pages they view and from which country — never for advertising. Until you click “Accept” in the banner, nothing is loaded: neither Google's script, nor any request to its servers, nor any cookie. If you accept, Google sets the _ga and _ga_* cookies, which we cap at 13 months. Declining restricts no feature. You can change your mind at any time via the “Cookies” link in the footer: declining disables measurement immediately and clears those cookies. Your choice is remembered for 6 months, after which you are asked again.

We use no advertising cookie and no other third-party tracker. Payment takes place on a page hosted by Stripe, outside our site: Stripe may set its own cookies there, within its own framework (see its policy below).

Your browser stores a few preferences locally (your answer to the cookie banner, the fact that you have already confirmed a paid retouch): this information never leaves your device.

4. Why we process this data

We send no newsletter or marketing email, and we make no automated decision producing legal effects concerning you.

5. Who receives your data

We do not sell your data. It is shared only with the following providers:

• OpenAI (United States) — receives the brief, the form fields, the lyrics to translate or vocalise, and the audio to transcribe, in order to produce the result. These exchanges go through OpenAI's API, whose terms exclude the use of your content to train its models. The transfer outside the European Union is governed by the European Commission's standard contractual clauses.
• Stripe (Stripe Payments Europe Ltd, Ireland) — payment provider: it collects the payment, stores the payment method, issues invoices and runs the subscription portal. Stripe is responsible for its own processing; see its privacy policy.
• Google (Google Ireland Ltd, Ireland) — for Google Analytics, and only if you have accepted it: receives the pages viewed, the source of the visit, the browser and device, and a random identifier carried by the _ga cookie. The IP address is not logged by Google Analytics 4. Data may be processed in the United States under the EU-US Data Privacy Framework and the standard contractual clauses; see Google's privacy policy.
• Our email delivery provider — receives your address to deliver service emails.
• Our hosting provider — the server on which the application and its database run.

We may also disclose data where the law requires it (judicial request).

6. How long we keep it

• Account and song history — as long as the account exists. Deleting the account immediately and permanently erases your songs with it. You can also delete each song, or the whole history, from the History page.
• Tokens for email verification (24 h) and password reset (1 h) — single-use, stored hashed.
• Anti-abuse counters (including the IP address) — one hour at most.
• Audience measurement — _ga* cookies: 13 months at most; your answer to the banner: 6 months; individual data in Google Analytics: 2 months (the aggregated reports derived from it cannot identify you).
• Billing data — kept by Stripe for the legal retention period (10 years for accounting records). On our side, the technical identifiers disappear with the account.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data.

• Without writing to us: from the My account page, you can change your password, manage or cancel your subscription, and delete your account — which first cancels the current Stripe subscription, then erases your data. From the History, you can delete your songs.
• For everything else (a copy of your data, correcting your email, a question): write to contact@lyricly-music.com from the account's address. We reply within one month.

If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

8. Security

The site is served exclusively over HTTPS (HSTS). Passwords are hashed with bcrypt. A password change or reset signs out all sessions open on other devices. Sensitive actions are rate-limited. No API secret is exposed to the browser.

9. Minors

The service is intended for people aged 15 and over. Below that age, registration requires the consent of the holder of parental authority.

10. Changes

This policy may evolve with the service. The date at the top of the page indicates the last revision; a significant change will be announced to you by email or in the application.