Join the waitlist

Privacy policy.

Last updated

What data Lyrictake processes when you visit the website, join the waitlist or use the app, why we need it, and what rights you have. We only collect what it takes to make your videos.

Who is responsible

The controller responsible for your data under the EU General Data Protection Regulation (GDPR) is:

LL Platforms UG (haftungsbeschränkt)
Wuhlestraße 7a
12683 Berlin
Germany
Email: help@lyrictake.com

Lyrictake is a product of LL Platforms UG (haftungsbeschränkt); our details are in the imprint. We aren't required to appoint a data protection officer. For anything about your data, write to us at the address above.

Visiting the website

The website runs on Cloudflare. When you open a page, your browser sends technical data, which Cloudflare processes to deliver the page and to protect the site, for example against attacks: your IP address, the date and time, the page or file requested, the page you came from, and your browser and operating system.

We keep no request logs of our own. Cloudflare processes this data briefly, to deliver and protect the site, and what we can see are totals, such as the number of requests per day, not records of your visit. The legal basis is our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).

Fonts, pictures and videos are delivered from our own domain. Your browser doesn't connect to Google Fonts, a video platform or any other third party when you visit.

The waitlist

When you enter your email address to join the waitlist, we store it as unconfirmed and email you a link (double opt-in). Only when you open that link and confirm are you on the list. Until then we send you nothing else, and an address that isn't confirmed within 7 days is deleted.

For the waitlist we store:

  • your email address,
  • whether it is unconfirmed, confirmed or has left the list,
  • when you signed up, confirmed or left, and when we last sent you a confirmation email,
  • your place in line, which decides the Founding Artists price,
  • two random codes for the links in our emails: one to confirm, one to leave.

We don't store your IP address or anything else about your device.

We use your address only to tell you when you can make your first video and to keep your Founding Artists price. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, with the link on the confirmation page or in any email from us, or by writing to us; this doesn't affect what we did before. The record of when you confirmed is how we prove your consent (Art. 7(1) GDPR).

The list is stored in a Cloudflare database located in the EU. Our emails are sent through Resend (see section 10, “Our providers”).

Your account

The app isn't open yet. This section and the next three describe how it will work. Before it opens, we'll update them, name the providers that will then process your data, and tell everyone on the waitlist.

You'll sign in with Google or with a link we email you. There is no password.

  • With Google. Google tells us your name, email address and profile picture. We don't get access to anything else in your Google account. The sign-in itself is run by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under Google's privacy policy: policies.google.com/privacy.
  • With an email link. We send a link to your address that signs you in. It works for 15 minutes.

For your account we store your email address and name, the artists and releases you create, your settings and email choices, your plan and the releases you have left, and when you confirmed that you have the rights to what you upload. On a Label plan, the account holder can invite team members; we then use the email address they give us to send the invitation.

We need this to provide your account and Lyrictake (Art. 6(1)(b) GDPR). We also keep the record of your rights confirmation because we have a legitimate interest in being able to show it, for example to our payment provider or to a rights holder (Art. 6(1)(f) GDPR). Without an email address we can't give you an account.

Your songs and videos

To make a video, you upload a song (WAV or MP3), its cover and its lyrics, and give the release a title and an artist name. This is what happens to them:

  • Analysis. On our servers, we separate the vocals from the music and use speech-to-text to line up every word of your lyrics with your voice. We also find the beats and read the colours of your cover. This runs automatically.
  • Preview. The live preview in the editor runs in your browser, which loads your song, cover and timing from our servers to play them. The changes you make are saved to your account.
  • Rendering. When you export, our servers render your video files, and you download them from Exports.

A recording of a voice is personal data. We use it only to time your lyrics, never to identify anyone. We don't use your songs, lyrics, covers or videos to train AI models, and we don't share them with anyone except the providers that run our servers for us.

The legal basis is our contract with you (Art. 6(1)(b) GDPR). Your uploads may contain other people's personal data, such as a name in a lyric or a person on a cover. Please only upload what you're allowed to use; see our terms.

Payment through Paddle

Our plans are sold by Paddle as merchant of record: Paddle.com Market Limited in the United Kingdom, and for buyers in the USA and Canada its sister companies Paddle.com Inc. and Paddle.com (Canada) Ltd. Paddle is the seller. It takes your payment, works out the tax for your country and sends your receipts. You enter your payment details directly with Paddle; we never see your card or bank details. Paddle processes your data as a controller in its own right, under its privacy policy: paddle.com/legal/privacy.

From Paddle we receive what we need to run your plan: your name, email address and country, the plan you bought, the amounts and status of your payments, and Paddle's customer and transaction numbers. The legal basis is our contract with you (Art. 6(1)(b) GDPR) and, for our bookkeeping, German tax and commercial law (Art. 6(1)(c) GDPR).

Emails from us

Once you have an account, we email you about it and about your releases:

  • sign-in links,
  • when your song has been analysed and when your files are ready,
  • three days before your 30 days of free fixes end,
  • a week before an unused release expires.

These emails are part of the service (Art. 6(1)(b) GDPR). Apart from sign-in links, you can turn them off in Settings, under Emails. Receipts come from Paddle.

Only if you turn them on in Settings do we send you news about new looks and features, at most once a month, and tips for your release, four emails in your first month. The legal basis is your consent (Art. 6(1)(a) GDPR); you can turn them off at any time, in Settings or with the link in each email.

All our emails, the waitlist's included, are sent through Resend, with open and click tracking switched off: we don't know whether you opened an email or clicked a link in it.

When you write to us

When you write to us, we use your email address and your message to answer you. If it's about your account or a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise it's our legitimate interest in answering you (Art. 6(1)(f) GDPR).

Our providers

We run Lyrictake on rented infrastructure. These providers process data only on our instructions and under a data processing agreement (Art. 28 GDPR):

Website and waitlist
Cloudflare, Inc., USA. Delivers and protects the website from its network, and stores the waitlist in a database located in the EU.
Emails
Resend, Inc., USA. Sends our emails from its EU region in Ireland.
The app
Once the app opens: the providers that store your songs and videos and run the analysis and rendering. We name them here before then.

Paddle, for payment, and Google, for sign-in with Google, are not our processors. They process your data as controllers in their own right, as described above.

Transfers outside the EU

We prefer providers that keep data in the EU. Where data goes to a country outside the EU and the EEA, we make sure it stays protected: either the European Commission has decided that the country protects data adequately (Art. 45 GDPR), as for the United Kingdom and for US companies certified under the EU–US Data Privacy Framework, or we agree the EU's Standard Contractual Clauses with the provider (Art. 46(2)(c) GDPR).

This concerns Cloudflare and Resend, both US companies, under the Data Privacy Framework where they are certified and under Standard Contractual Clauses; and, once the app opens, Paddle (United Kingdom, and the USA and Canada for buyers there) and Google (USA, under the Data Privacy Framework). You can ask us for a copy of the safeguards.

How long we keep data

We keep your data only as long as we need it:

Visiting the website
We keep no request logs of our own. Cloudflare processes connection data only briefly.
Waitlist, unconfirmed
Deleted after 7 days.
Waitlist, confirmed
Until you leave the list, or until we close it after the app has opened. If you then create an account with the same address, your Founding Artists price moves to your account.
Waitlist, left
We keep the record of when your consent existed and when it ended for three years, to be able to prove it, and then delete it. Ask us and we delete it sooner.
Your account
As long as you have it. When you delete it, we erase your data; copies in our backups are overwritten within 30 days.
Songs, covers, lyrics
As long as the release is in your account, so you can fix it within 30 days of an export and export it again later. You can delete a release at any time.
Analysis files
The separated vocals and other working files are deleted as soon as the analysis is done.
Exported videos
Downloadable for 90 days after the export, then deleted from our servers. The release stays in your account.
Payment records
As long as German tax and commercial law require, up to ten years (§ 147 AO, § 257 HGB).
Emails to us
Until your question is settled, unless the law requires us to keep it longer, as for business letters about a contract (up to six years, § 257 HGB).

Your rights

You have the right to:

  • access the data we hold about you (Art. 15 GDPR),
  • have it corrected (Art. 16),
  • have it erased (Art. 17),
  • have its processing restricted (Art. 18),
  • receive it in a common, machine-readable format, or have it sent to someone else (data portability, Art. 20),
  • withdraw your consent at any time, for the future (Art. 7(3)).

Your right to object

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. If data were used for direct marketing, you could object at any time without giving reasons, and we would stop.

To use your rights, write to help@lyrictake.com.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR), and we don't build profiles. The analysis of your song is automatic, but it only times your lyrics.

Complaints

If you think we process your data unlawfully, you can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work, or where the infringement took place. Our registered office is in Hamburg, so the authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit). We'd be glad if you came to us first, so we can put it right.

Cookies

The website and the waitlist set no cookies and store nothing in your browser. We use no analytics, no advertising and no third-party tracking, which is why there is no cookie banner.

Two kinds of storage can still happen, both strictly necessary for something you asked for, which needs no consent (§ 25(2) no. 2 TDDDG):

Security
When Cloudflare needs to check that a visitor is a person, for example during an attack on the site, it may set a short-lived security cookie.
The app
Once it opens: a session cookie that keeps you signed in, for up to 30 days, renewed while you use the app and deleted when you sign out. When you open the checkout, it loads from Paddle, which may store information in your browser that it needs to process the payment and prevent fraud; Paddle is responsible for this.

If we ever want to add analytics, we'll ask for your consent first and update this policy.

Security

All traffic to the website is encrypted (HTTPS). The links in our emails carry long random codes that can't be guessed, and a link only confirms or removes an address when you press the button on the page it opens, so a program that scans your inbox can't do it for you. Access to the data is limited to what running Lyrictake requires.

Changes to this policy

We update this policy when Lyrictake or the law changes; the date at the top shows the current version. If a change affects how we use data you've already given us, we'll tell you by email before it applies, and ask for your consent where it's needed.