Privacy Policy

1. Who is responsible

LyricFlow is operated from Brazil, and its operator is the controller of your personal data. For anything about your data — including the controller's identification details, which we provide on request — write to our data protection contact ("encarregado") at supportlyricflow@gmail.com.

2. Data we collect

• Account: email address, password (stored only as a secure hash), optional artist name, interface language, preferences and the date you accepted the terms.
• Sign-in with Google (optional): Google sends us your Google account ID, email address, whether it is verified, and your name. We never get your Google password or access to your Google account.
• Your content: songs, lyrics, timings, translations and romanizations, background images and videos, logos, fonts, singer names, colors and photos, project settings and the videos you export.
• Payments: handled by Stripe. We receive and keep only identifiers and status — customer and subscription IDs, plan, billing interval and renewal date. We never see or store your card number.
• Invitations: your invite code, who joined through it and the premium credits earned and spent.
• Usage: product events such as "export started" or "style selected", linked to your account, used to run and improve the service. They never contain lyrics, file contents or contact details.
• Technical: IP address, browser and device information and request logs recorded by our servers and hosting providers for security and operation.
• Support: what you write when you contact us.

3. How we use it and legal bases

• To provide the service you signed up for — store your projects, show previews, sync lyrics, render and deliver your videos, send service emails (welcome, video ready, payment problems) — based on the performance of our contract with you.
• To process payments and keep tax and accounting records — contract and legal obligation.
• To keep the service secure and prevent abuse (fraud, fake accounts, credit abuse, overload) — our legitimate interest and legal obligation.
• To understand which features are used and fix problems, using the usage events above — our legitimate interest. You can object at any time (see section 8).
• To show ads on the Free plan — with your consent where the law requires it (see section 6).
• To answer you and comply with legal requests — legitimate interest and legal obligation.

Automatic sync listens to your song on our own servers with a speech-recognition model. Your audio and lyrics are not sent to third-party AI services, and we don't use your content to train models. We don't make decisions with legal or similarly significant effects about you based solely on automated processing.

4. Who we share it with

We don't sell your personal data. We share it only with providers that process it on our behalf and under our instructions, or when the law requires:

• Stripe — payments and subscription management (Stripe's privacy policy).
• Google — sign-in, if you choose "Continue with Google" (Google's privacy policy).
• Google — ads on the Free plan through Google AdSense (how Google uses information from sites that use its services).
• Our email delivery provider — to send service emails.
• Hosting, database and file storage providers — to run the service and keep your files.
• Public authorities — when required by law or a valid court order.
• A successor company — if LyricFlow is merged or sold, under this same policy.

5. International transfers

Some providers (for example Stripe and Google) may process data outside your country, including in the United States. When that happens we rely on the safeguards the law provides, such as standard contractual clauses and the providers' own commitments.

6. Cookies

• lf_session — keeps you signed in (essential, 30 days).
• lf_locale — remembers your interface language (preference, 1 year).
• lf_ref — remembers the invite link you opened so the invitation can be credited (30 days).
• lf_oauth — only while you sign in with Google, to protect the sign-in from forgery (10 minutes).
• Advertising cookies — on the Free plan, Google AdSense may use cookies to show and measure ads. Where the law requires consent (for example in the EEA and UK), we ask for it first through Google's consent message and you can change your choice at any time. Pro accounts never see ads.

Your browser also lets you block or delete cookies; blocking essential cookies prevents signing in.

7. How long we keep it

• Exported videos: deleted automatically 24 hours after they're ready for download.
• Password-reset links: valid for 1 hour and single use; deleted a day after they expire.
• Account, projects and files: while your account exists. When you delete a file, project or your account, it is removed from our systems, and deleting the account also deletes your customer record at Stripe.
• Payment and tax records: for the period required by law.
• Sign-in records (date, time and IP address of each sign-in): 6 months, even if you delete your account, as Brazil's Marco Civil da Internet (Law 12.965/2014) requires.
• Usage events, server logs and service emails: for a limited time needed for security and operation; events of deleted accounts are kept only without the link to you.
• Backups: removed on our regular backup rotation.

8. Your rights

Under the LGPD (art. 18) and the GDPR you can ask to: confirm whether we process your data and access it; correct it; anonymize, block or delete unnecessary or unlawfully processed data; receive it in a portable format; know who we share it with; withdraw consent; and object to processing based on legitimate interest.

Many of these you can do yourself: edit your profile in Account, download your videos and subtitle files, turn off "video ready" emails, and delete projects or your whole account (Account → Delete account). For anything else, write to supportlyricflow@gmail.com. We answer within 15 days and may ask you to confirm your identity.

You can also complain to the data protection authority — in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados) — or the authority where you live.

9. Security

We use encrypted connections (HTTPS), store passwords only as salted hashes, keep every file private to its owner, use time-limited signed links for downloads, and limit staff and system access to what is needed. No system is perfectly secure; if an incident puts your rights at risk, we'll notify you and the authorities as the law requires.

10. Children

LyricFlow is not directed to children under 13 and they must not create accounts. Users under 18 need permission from a parent or guardian. If you believe a child gave us personal data, write to supportlyricflow@gmail.com and we'll delete it.

11. Changes to this policy

We'll update this policy when our data handling changes. For material changes we'll notify you by email or in the app before they take effect. The date at the top shows the current version.

12. Contact

Privacy questions and requests: supportlyricflow@gmail.com. Other support: supportlyricflow@gmail.com. LyricFlow is operated from Brazil.