Privacy Policy

1. Data Controller

The controller of your personal data is:

For any matters related to the protection of personal data, you may contact us at: kontakt@lyricco.app.

2. What data we collect

In the course of providing services through the Lyricco.app platform, we process the following personal data:

• Registration data: email address and password (stored in encrypted form).
• Billing data: full name or company name, address, Tax ID (NIP) - provided voluntarily when purchasing a subscription.
• Payment data: payments are processed exclusively through Stripe Inc. Lyricco does not store credit card numbers or other payment instrument data.
• Technical data: IP address, browser type, login data (time, date) - collected automatically in system logs.
• Analytics data: anonymous usage data (pages visited, visit duration, country of origin, device type) - collected by Google Analytics 4 with IP address anonymization.
• User content: song lyrics and other materials entered into the application by the user.

Providing registration data is required to use the Services. Providing billing data is voluntary but necessary to issue an invoice.

3. Purposes and legal bases for processing

We process your data for the following purposes and on the following legal bases:

4. Data recipients

Your data may be shared with the following entities:

• Stripe Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA) - payment processor. Stripe acts as an independent data controller for payment processing. Data transfers to the USA are based on Standard Contractual Clauses (SCCs) approved by the European Commission and Stripe's participation in the EU-US Data Privacy Framework.
• Seohost.pl - hosting and server infrastructure provider. Servers are located in Poland.
• Email service provider - the SMTP server provider used to send emails (notifications, invoices).
• Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) - provider of Google Analytics 4 for traffic analysis. Google processes anonymous analytics data (IP addresses are anonymized before transmission). Data transfers to the USA are based on Standard Contractual Clauses (SCCs) and Google's participation in the EU-US Data Privacy Framework. Google Privacy Policy: policies.google.com/privacy.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Data retention period

• Account data: for the duration of the contract (active account); after account deletion - for 30 days (technical backup), then permanently deleted.
• Billing data: for 5 years from the end of the year in which the invoice was issued - in accordance with tax law requirements.
• Technical logs: up to 90 days from generation.
• Correspondence: for the time necessary to handle the matter, no longer than 3 years.

6. Your rights

Under the GDPR, you have the following rights:

• Right of access - you may request confirmation of whether we process your data and obtain a copy of it.
• Right to rectification - you may request correction of inaccurate or completion of incomplete data.
• Right to erasure - you may request deletion of your data in cases provided for by the GDPR (e.g., when they are no longer necessary for the purpose for which they were collected).
• Right to restriction of processing - you may request restriction of processing of your data in certain situations.
• Right to data portability - you may receive your data in a structured, commonly used, machine-readable format.
• Right to object - you may object to the processing of data based on the legitimate interest of the Controller.

To exercise any of the above rights, contact us at kontakt@lyricco.app. We will respond without undue delay, no later than within 30 days.

If you believe that we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, email: kancelaria@uodo.gov.pl, website: uodo.gov.pl.

7. Cookies

The Lyricco.app website uses cookies in two categories described below.

Essential (technical) cookies

These are cookies necessary for the website to function - without them, the service cannot operate properly. They include:

• Session cookie - stores the session state of a logged-in user. Deleted when the browser is closed or upon logout.
• CSRF cookie - a security token protecting against cross-site request forgery attacks.
• "Remember me" cookie - if the user selects the "Remember me" option, a long-term authentication token is stored.

Technical cookies do not require your consent - they are necessary for the provision of electronic services in accordance with applicable law.

Analytics cookies (Google Analytics 4)

We use Google Analytics 4 to analyze traffic and improve our service. Google Analytics sets the following cookies:

• _ga - identifies unique visitors to the website. Stored for 2 years.
• _ga_XXXXXXXXXX - stores session state. Stored for 2 years.

Analytics cookies are loaded only after you give consent via the banner shown on your first visit to the website. The legal basis for the data collected this way is your consent (Art. 6(1)(a) GDPR). IP addresses are anonymized before being sent to Google. Analytics data does not allow direct identification of individuals.

You can withdraw your consent at any time by clicking the "Manage cookies" link in the website footer and choosing "Essential only" - the banner will reappear and you can change your choice. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. You can also block Google Analytics tracking by installing a browser add-on: tools.google.com/dlpage/gaoptout.

Lyricco.app does not use advertising cookies, remarketing cookies, or tools such as Meta Pixel.

Managing cookies

You can change your consent for analytics cookies at any time using the "Manage cookies" link in the website footer, and also control and delete cookies through your browser settings. Disabling technical cookies may prevent you from using the application (in particular, logging in). Refusing consent for analytics cookies does not affect the functionality of the website.

8. Data transfers outside the EEA

Payment-related data is transferred to Stripe Inc. based in the USA. Stripe participates in the EU-US Data Privacy Framework, which provides a legal basis for lawful data transfers to the USA. In addition, Standard Contractual Clauses (SCCs) approved by the European Commission apply.

Anonymous analytics data is transferred to Google LLC based in the USA through Google Analytics 4. Google participates in the EU-US Data Privacy Framework. IP addresses are anonymized before transmission.

All other data is processed exclusively on servers located in Poland (within the EEA).

9. Data security

We implement appropriate technical and organizational measures to protect your personal data, including:

• encryption of connections using HTTPS (TLS),
• storing passwords in encrypted form (bcrypt),
• restricting data access to authorized personnel only,
• regular data backups.

10. Lyricco mobile application

This Privacy Policy also applies to the Lyricco mobile application available for Android and iOS devices. The mobile application uses the same user account as the Lyricco.app website and is used to display song lyrics (including in offline mode) and synchronize the displayed song between devices on a local network.

Login and account data

Logging into the application uses the same email address and password as the web service. After logging in, the application receives an access token (Sanctum), which is stored locally in the device's secure storage (Android Keystore / iOS Keychain via the Expo SecureStore library).

Data stored locally on the device

To enable offline use, your team's data - song lyrics, setlists, and team name - is saved locally on the device. This data is downloaded from your Lyricco.app account and remains only on the device until you log out of the application or uninstall it.

Permissions used by the application

• Internet access - required for logging in and downloading song lyrics from Lyricco.app.
• Camera - used exclusively for scanning QR codes when connecting devices in synchronization mode. The application does not take or save photos, and the camera feed is not transmitted anywhere.
• Network state and Wi-Fi - used in the song synchronization feature between devices (e.g., conductor's phone and musicians' phones) on the same local network. Communication occurs directly between devices and does not involve sending data to the internet or to Lyricco servers.

No ads or tracking

The Lyricco mobile application does not contain advertisements, analytics tools, or any third-party tracking libraries. We do not share data from the mobile application with any third parties for marketing or advertising purposes.

Account and data deletion

Logging out of the mobile application removes the access token and locally stored team data from the device - this does not delete your account or data from our servers.

To permanently delete your account and all associated data (repertoire, team settings, subscription data), log in at lyricco.app, go to Profile → Delete account, and confirm the deletion. You can also email us at kontakt@lyricco.app to request account deletion.

Account data is deleted immediately after confirmation; for technical reasons a backup copy is retained for 30 days, after which it is permanently erased.

11. Changes to this Privacy Policy

We reserve the right to make changes to this Privacy Policy. Users with active accounts will be notified of significant changes by email at least 14 days in advance. The current version of the Privacy Policy is always available at lyricco.app/privacy-policy.

12. Contact

For matters related to the protection of personal data, please contact us: