1. Who is responsible for your data
RNIFY Limited, trading as Lyro, is the controller of your personal data, which means we decide how and why it is used. We are a private limited company registered in England and Wales, company number 16749515, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For any privacy question or request, contact us through the contact form or hello@lyromusic.com.
This notice covers the website at https://lyromusic.com, the studio and share pages. We follow the UK GDPR and the Data Protection Act 2018. Where the EU GDPR applies to you, for example because you live in the European Economic Area, you have the same rights under it.
2. What we collect
We collect the data below. You give us most of it yourself, and the rest comes from your use of Lyro.
| Category | What it includes |
|---|---|
| Account | Email address, name if you give one, password (stored only as a salted hash), language, the version of the terms you accepted and when, whether product emails are switched on, and whether tips and offers inside the app are switched on. With Google sign-in: your name, email address and a Google account identifier, never your Google password. |
| Payment and billing | Plan, price, billing period, credit balance and credit history, plan changes, pauses and cancellations, with the reason for cancelling if you gave one, and Stripe customer and subscription identifiers. For each plan checkout you open on Stripe: its identifier, the plan and price, when it was opened, and whether it was paid or left unfinished, and whether the studio has reminded you of it. For each checkout you open, what Stripe reports when it ends: whether it was paid or left unpaid, the currency and amount it showed you, the payment methods it offered and whether a payment was tried. Whether the email about a plan checkout you did not finish was sent, is waiting its turn or will not be sent, and why. For the two offers in section 4 of the terms: when the first-month email was made and sent, the Starter price level it stated, when its link was first opened and when its 10-minute window ended, the checkout opened in that time and whether it was paid; when the yearly offer was earned and by which purchase, when it became ready to show and which finished song or top-up made it ready, when it was shown, its yearly price, the charge for today and the credit it showed, the bonus credits it offered, whether it was declined, ran out or was taken, and what it charged; for the offer to move a yearly Starter to Creator yearly, the same, with the discount it showed. Stripe holds your card details and billing address. We never see your full card number. |
| iPhone app | If you use the Lyro app for iPhone: the record of any App Store purchase (the product, its dates, the Apple transaction identifiers, the store country and whether it was refunded), and a random purchase token we create for your account so that a purchase can be matched to it. We never receive your card or your Apple Account details. If you use Sign in with Apple: a stable identifier Apple gives us for your account, your email address or an Apple private relay address, and your name if you choose to share it. If the app crashes, a crash report with the device model, the iOS and app versions and where in the app it happened. The app uses no advertising identifier and does not track you across other companies' apps or websites. |
| A song as a gift | For a gift song: the first name of the person it is for, how that name is said if you give it, who they are to you, the memories and details you write about them, the occasion, the style and voice you chose, your name and your message for the gift page, the lyrics and the versions made, the address of the gift page, and when it was first opened and how often it was played (not who played it). These details are about another person, so give only what that person would be happy to hear in a song; we use them only to write and sing the song and to show the gift page, and we keep them with your account and delete them with it. |
| Your content | Audio you upload or record, which can include your voice. Lyrics, prompts and titles. The tracks, stems and cover art you generate, your studio projects and your share links. For a song for a product page: the page address you give, what we read from that page (its text, product details and picture addresses), the brief written from it and your confirmation that you may advertise the product. |
| Usage analytics | On our public pages: pages and sections viewed, scroll depth, clicks on buttons, time on a page, referring site, campaign tags, browser language, device type, which browser or app opened the page (a short label), whether you arrived by typing the address or by a link from elsewhere, country, and a random identifier in the lyro_a cookie (section 4). Inside the signed-in studio: the screens you open and the steps you take, such as the plans and the price level you were shown, which example clip you play on the plans screen and for how many seconds, and when you came back from a checkout, recorded under your account. Separately, with no cookie and no identifier, our server keeps daily totals of page requests: one for each page, and one for each part of the site split by whether the link carried ChatGPT's campaign tag, whether your browser sent a referring address (yes or no, never the address) and how your browser says the request began (typed or opened by an app, a link on another site, or a link inside ours). |
| Your answer to one optional question | When you have just made an account, the studio may ask once "How did you hear about Lyro?" with one-tap choices and a Skip button. If you choose one, we keep the choice with your account, to see which places send us people. If you skip, we keep that you skipped, so that we do not ask again. Nothing else changes either way. |
| Technical data | IP address, browser type, and the security log and error log below. For each sign-in session, the browser and country, which you can review in Settings. |
| Security log | Sign-ups, log-ins, failed log-ins, lockouts, password resets and failed security checks. Each entry holds the time, the kind of event, the account it concerns if there is one, a keyed hash of the IP address (not the address itself), the country and the browser string. |
| Error log | When something breaks on a page or in a generation: the error message, the page path, and the account and the job it concerns if there is one. |
| Email log | For each email we send or try to send you: your email address, the kind of email, its subject line and whether it was sent. Not the body of the email. |
| Support conversations | What you and our team write, your email address and name, and the topic. When you write from Help inside the app, your plan, credit balance, language, browser string and last failed generation are attached automatically, so that you do not have to explain your account. If you rate the conversation, the rating. Messages from the contact form are handled in the same way, with your browser string attached. |
| In-app message records | For each tip, offer or notice shown to your account: how often it was shown, clicked and dismissed, when, and whether you did what it suggested within seven days. Also whether your account is in the small random group that gets no promotional messages (section 5). |
| Invite programme | Your invite code, who invited whom, whether the reward is waiting, given or refused, and a keyed hash of the IP address used when the invited account was created. We compare that hash with the inviter's entries in the security log to spot self-invites. |
| Other messages and feedback | Teams applications, reports about tracks, takedown notices, your thumbs up or down on tracks with what went wrong and anything you write with it, whether you let our team listen to that track, and testimonials you submit, with the language of your account and the track you were rating or downloading when you wrote it. After your first thumbs up or first download, the studio may ask once, in a small card you can skip, what you would tell a friend about Lyro; we keep when it asked, so that it does not ask again. |
| Quiz answers | Your starting point, the genre, mood, voice, language and theme you chose, and how often you plan to make music. |
| A request kept to finish on a computer | If you choose "Finish on your computer" on the plans screen, the request you were making on the Create screen: its settings, your idea, title and lyrics, which plan you had picked and which of your files it uses (the file itself stays in your library), with when you asked and when you opened the link. We email you a link to it. The link carries a random code, never the request or your email address. |
To open an account you must give an email address and a password, or use Google sign-in or Sign in with Apple, and to buy a plan you must give payment details, to Stripe on the web or to Apple in the iPhone app. Everything else is optional. A voice recording is personal data, and we do not use voices to identify anyone. Our analytics store the country that our host derives from your IP address, not the address itself. We do not ask for your friends' contact details for the invite programme, and we do not message them: you share your link yourself.
3. Why we use it and our lawful bases
We use your data only for the purposes below. Each has a lawful basis under data protection law.
| Purpose | Data | Lawful basis |
|---|---|---|
| Run your account, sign you in and keep it secure | Account, technical data | Contract. Legitimate interests in security. |
| Protect sign-up and sign-in: the security log, the short lock after repeated wrong passwords, the refusal of throwaway email addresses, rate limits and, when it is switched on, the Turnstile check | Security log, technical data, email address | Legitimate interests in preventing fraud and abuse and in keeping accounts safe. |
| Make, store and play your music, which includes sending prompts, lyrics and audio to the model providers and serving share links you switch on | Your content | Contract. |
| Keep your library for as long as the terms say, remind you before it is deleted, and then delete it | Your content, account, email address | Contract. |
| Take payment, manage your plan and credits, including changes, pauses and cancellations, and send receipts and other emails about your account | Payment and billing, email address, email log | Contract. Legal obligation for tax and accounting records. |
| Turn your quiz answers into a song plan and a suggested plan | Quiz answers | Steps before a contract, at your request. Legitimate interests. |
| Keep the request you were making and email you a link to it, when you choose "Finish on your computer", so that you can finish on another device | A request kept to finish on a computer, account, email address, email log | Steps before a contract, or the contract, at your request. |
| Answer support conversations, contact form messages and Teams applications | Support conversations, other messages and feedback | Contract, where you are a customer. Legitimate interests in replying. Steps before a contract for Teams. |
| Show messages about your own account inside the app, such as a failed payment or a reminder that your library will be deleted | Account, payment and billing, in-app message records | Contract. |
| Show tips, product news and offers inside the app, limit how often you see them, and measure whether they help. This includes one reminder on your next visit when a plan checkout you opened was not finished, which opens the plans again at that day's price. | Account, payment and billing, how you have used Lyro (for example how many tracks you have made), in-app message records | Legitimate interests in helping you get more out of Lyro and in promoting our own service. You can object at any time with the switch in Settings > Notifications (section 5). |
| Send one email with 50% off the first month, about an hour after you make an account (or once, on or after 13 October 2026, if you made it before then), if you have bought nothing and offers by email are switched on, and keep the record of its offer | Email address, name, language, the country of your newest sign-in (for the Starter price the email states), whether you have bought anything, payment and billing, email log | Legitimate interests in promoting our own service to people who made an account with us (the soft opt-in of the Privacy and Electronic Communications Regulations 2003). You can object at any time with the unsubscribe link in the email or the switch in Settings. |
| Show the yearly offer once inside the app after the first song that finishes after a purchase (or right after a top-up), and the move from yearly Starter to Creator yearly right after a yearly Starter is bought, and keep the record of each window, the charge it showed and whether it was taken | Account, payment and billing | Legitimate interests in promoting our own service to our customers; the contract, once you take it. You can object at any time with the switch for offers inside the app in Settings > Notifications. |
| Run the invite programme: give the rewards and spot self-invites | Invite programme, security log | Contract, to give the reward. Legitimate interests in preventing abuse of the programme. |
| Understand how the site, the studio and the models perform, so that we can improve them | Usage analytics, feedback on tracks, and numbers about each generation: how many words and lines it was given for how long a file, how long it took, how long the result is, and how much of it the voice covers. Not the words or the audio themselves. | Legitimate interests. You can object at any time (section 4). |
| Find out what went wrong with a track you rated down, when you tick the box that lets our team listen to it | That track, the file it was made with, its lyrics and style text, and your rating. Only for the tracks you choose. | Consent. Rate the track again without ticking the box, delete the track, or contact us, and we stop. |
| See where visitors come from and which pages lead to sign-ups and purchases, with Google Analytics | Google Analytics data (section 4) | Consent. You can withdraw it at any time (section 4). |
| Find and fix faults | Error log | Legitimate interests in a service that works. |
| Keep a record of the emails we sent, so that we can answer when you ask whether we emailed you | Email log | Legitimate interests. |
| Back up the database every night, so that a failure does not lose your account or your credits | Everything in our database | Legitimate interests in a reliable service. Legal obligation to keep personal data secure. |
| Prevent abuse and fraud, enforce our terms, handle reports and takedown notices | Technical data, security log, your content, support conversations, other messages and feedback | Legitimate interests in a safe and lawful service. Legal obligation where the law requires action. |
| Send tips, product news and offers by email, or publish a testimonial you wrote, on our home page and feature pages, only after you ticked the box and we approved it | Email address, quote and display name (your first name, if you gave it) | Legitimate interests for product emails to existing contacts, and consent for a testimonial you wrote. Every such email has a one-click unsubscribe link, and the switch in Settings turns them off at any time. |
| Bring or defend legal claims and answer regulators | Whatever is relevant | Legitimate interests. Legal obligation. |
When offer and reminder emails go out. We send at most one offer or reminder email to an account in 24 hours. The first-month offer comes first: the email about a plan checkout you did not finish may wait up to three days behind it, and after that it is not sent. Neither is sent once you have bought a plan, or while offers by email are switched off.
4. Our analytics and your right to object
We run our own analytics, and you can turn them off at any time. There are no advertising trackers. The only third-party analytics is Google Analytics, which runs only if you allow it (see the end of this section). Our own data stays in our own database and is used only to improve the site and the studio.
The analytics cookie is set under the statistical-purposes exception in the UK Privacy and Electronic Communications Regulations, in force since 5 February 2026. It allows improvement statistics without consent if we explain them clearly and give you a simple, free way to object. Our lawful basis for the processing is legitimate interests.
To object, use the "Analytics: on/off" switch in the footer of any page, or choose "Turn off" in the analytics notice. The cookie is deleted and the tracker stops at once. After that the only thing our server counts about a visit is each page request, in daily totals with no cookie and no identifier: one for the page, and one for its part of the site split by whether the link carried ChatGPT's campaign tag, whether a referring address was sent (yes or no, never the address) and how the browser says the request began. The cookies and analytics page has the details.
A visit to our public pages is recorded under the random identifier in the cookie, with no account identifier. What you do inside the signed-in studio is recorded under your account, without the cookie identifier.
The link between the two is the random identifier of the visit (the one in your browser's session storage, replaced after 30 minutes without activity). When you sign up, start a checkout, leave a checkout unpaid or pay, and when you take a step in the signed-in studio, our server records it under your account together with the identifier of the visit it happened in. A visit that led to a sign-up or a purchase is also marked with a yes. We use this link to see which pages help people get started and on what kind of device a step was taken, for example whether a "Finish on your computer" link was opened on a computer. The visit record itself never holds your account identifier. Turning analytics off stops this, because there is then no visit identifier.
Account steps such as signing up, paying, changing a plan or cancelling are recorded under your account whether analytics is on or off, because they are part of running your account.
Google Analytics. The notice on our public pages asks whether you allow Google Analytics, with two equal buttons. Until you choose "Allow Google Analytics", its script is not loaded and nothing is sent to Google for it. The quiz and the sign-up page do not ask; Google Analytics runs there only if you allowed it on another page. If you allow it, Google Analytics sets its cookies (_ga and _ga_ followed by our property code) and receives the pages you view, the site that referred you, campaign tags, device and browser details, your approximate location, and a few steps: starting and finishing the quiz, signing up, seeing the plans, starting a checkout and paying, with the plan and the price. It never receives your name, email address or account identifier. Google Analytics does not log or store IP addresses; it uses them only to work out an approximate location. We have switched off Google signals, ad personalisation and data sharing with Google, so the data is not used for advertising or joined to your Google account. Google acts as our processor under its data processing terms, and the data is kept for 14 months. Our lawful basis is your consent. You can withdraw it at any time with the "Google Analytics: on/off" switch in the footer or in Settings > Privacy in the studio, or by turning off all analytics; this deletes the Google Analytics cookies and stops it at once.
5. Messages inside the app, and how we measure them
Tips, product news and offers inside the app are switched on by default, and the terms say so. You can switch them off at any time in Settings > Notifications. That switch is also how you object to this use of your data, and it works at once. Messages about your own account, such as a failed payment or a reminder that your library will be deleted, are always shown.
To decide which message fits, the app looks at facts about your account: your plan, your credit balance, how many tracks you have made, which tools you have used, how long you have been with us, and whether a plan checkout you opened was left unfinished. Nothing is sent to anyone else for this, and no advertising network is involved.
For each message we record, under your account, how often it was shown, clicked and dismissed, when, and whether you did what it suggested within seven days. We use these records for two things: to keep to the frequency limits in the terms, and to measure which messages help.
A small share of accounts, picked at random when the account is created, never gets promotional messages. Comparing the two groups is how we measure the effect. If your account is in that group, the only difference is that you do not see tips and offers. The two offers in section 4 of the terms are not part of this measurement, so those accounts can get them too.
Our lawful basis is legitimate interests. These messages are not emails, texts or push notifications: they exist only inside the app, while you are using it.
6. Who we share data with
We share data with the providers that run Lyro for us, and with nobody for advertising. Each provider acts on our instructions under a contract, except where we say otherwise.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare | Hosting, database, file storage, the nightly database backups, security and rate limiting, the Turnstile check at sign-up when it is switched on, and a fallback language model for the writing assistant. Cloudflare Email Service sends our emails about your account: email confirmation, password reset, receipts, failed payments, cancellation and pause confirmations, library deletion reminders, support replies and invite rewards, and tips and offers by email. For those it receives your email address and the content of the email. Cloudflare Email Routing forwards mail sent to our addresses to our team's inbox. | USA and its global network |
| fal.ai | Runs AI models for music, restyling, section edits and stem separation. Receives your prompt and lyrics and, for audio tasks, a short-lived signed link to the audio file. | USA |
| Provides the models behind Lyro High and Lyro Extra, the model that makes cover art and a backup model for the writing assistant, directly (Google Cloud Vertex AI and the Gemini API) or through fal.ai or OpenRouter. Receives the prompt and lyrics for songs made with them and, for cover art, a description written from the song’s title, genre, mood and lyrics, plus any idea you type. When it stands in for the writing assistant, it receives what the OpenRouter row lists. | USA | |
| OpenRouter | Routes writing assistant requests, and some song and cover art requests, to the model providers. The writing assistant’s requests (the prompt generator, the lyric writer and its tools, the description a cover is painted from, and the brief and lyrics of a song for a product page) go through it to DeepSeek’s openly published models, run by hosting companies that OpenRouter lets receive a request only if they do not keep or train on it. Receives the text you give the writing assistant, the title, genre, mood and lyrics a cover description is written from, what we read from a product page you give us, and the prompt, lyrics or cover description for songs and covers made through it. | USA |
| MiniMax (Nanonoble Pte. Ltd.) | Writes lyrics when the writing assistant’s main model is unavailable. Receives the theme and settings you give the lyric writer, or the brief written from your product page. | Singapore |
| Mureka (SKYWORK AI PTE. LTD.) | Sings your lyrics over your own beat, or plays a beat around your own vocal. Receives your prompt, your lyrics and the audio file you chose. | Singapore |
| Stripe | Payments, invoices, the billing portal and fraud prevention. Also a controller in its own right for part of this, under its privacy policy. | USA and the countries where Stripe operates |
| Apple | If you use the Lyro app for iPhone: sells and bills App Store purchases, and runs Sign in with Apple if you choose it. We receive the data in the "iPhone app" row of section 2. Apple acts as a controller in its own right under its privacy policy. | USA and the countries where Apple operates |
| Google (Google Analytics) | Measures visits, where they come from and which lead to sign-ups and purchases, only if you allow it. Receives the data listed at the end of section 4. | USA |
| Have I Been Pwned | Password breach check. Our server sends only the first 5 characters of a SHA-1 hash of a new password, never the password, your email address or your IP address. | No personal data is sent |
Requests to the model providers carry the content of your request. They do not include your name, email address or account identifier.
When the Turnstile check is switched on, the sign-up page loads a small program from Cloudflare that tells people from automated programs. Cloudflare receives your IP address, technical details of your browser and connection, and the address of our site. Our server then sends Cloudflare your IP address with the result, so that Cloudflare can confirm it. Cloudflare runs the check on our instructions. It also uses the same signals to improve its bot detection, as a controller in its own right, under its Turnstile privacy addendum.
When you write to support, a copy of your message is emailed to our team's mailbox through the email provider above, so that a person sees it quickly.
If you choose Google sign-in, Google receives data straight from your browser and handles it under its own privacy policy, as a controller in its own right. Our typeface, Instrument Sans, is served from our own site, so loading it sends nothing to anyone else.
We also share data when the law requires it, to bring or defend legal claims, with a rights holder where a takedown process requires it, and with a buyer if the business is sold, under the same protections. We do not sell personal data.
7. International transfers
We are in the UK and most of our providers are in the United States, so your data leaves the UK and the European Economic Area, with safeguards.
Where a US provider is certified under the UK Extension to the EU-US Data Privacy Framework, known as the UK-US data bridge, we rely on that. For data covered by the EU GDPR, we rely on the EU-US Data Privacy Framework in the same way. Where a provider is not certified, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on the Standard Contractual Clauses themselves for data covered by the EU GDPR. Contact us for a copy of the safeguard that applies to a provider.
8. How long we keep data
We keep data only as long as we need it for the purposes above. The periods are:
| Data | How long |
|---|---|
| Your library: tracks, stems, uploads, recordings, cover art and studio projects | While your account is active, which means while it has a plan or unused top-up credits. When it stops being active we keep the library for 30 more days, remind you by email and in the app 30, 7 and 1 days before the deletion date, and then delete it. The account itself stays, and starting a plan again before the date keeps everything. You can also delete a track, or your account, yourself at any time. |
| Deleted files | A deleted track leaves your library at once. A nightly clean-up erases the file from storage once it has been deleted for 24 hours, so in practice within about one to two days. |
| A request kept to finish on a computer | Until you open the link, which empties it. A link stops working 7 days after you asked for it, opened or not, and the nightly clean-up then deletes it, with the request if it is still there. These requests are not copied into the nightly backups. |
| Account record and quiz answers | Until you delete your account. The account record is then anonymised at once. Quiz answers that were never linked to an account carry no name or email address. |
| Billing records: plans, invoices and the credit history | 6 years, as tax and accounting law requires |
| Analytics events | 120 days |
| Visit summaries, one row for each browsing session | 400 days |
| Google Analytics data, if you allowed it | 14 months, on Google's servers. The cookies last up to 13 months and are deleted when you withdraw consent. |
| Security log | 90 days |
| Email log | 90 days |
| Error log | 30 days |
| Sign-in sessions and one-time links | Sessions last 30 days or until you sign out, email confirmation links 3 days and password reset links 1 hour. Expired records are deleted every night. |
| Support conversations and contact form messages | Until you delete your account, or 24 months after the conversation is solved, whichever comes first |
| In-app message records | Until you delete your account. We need them for that long so that a message you have dismissed for good stays away. |
| Records of plan checkouts you opened, for the reminder about one you did not finish | 90 days, or until you delete your account |
| Records of the two offers in section 4 of the terms (when each was made, sent, opened, ended, declined or taken, and what it charged) | While your account exists, because each offer is made once per account; deleted with your account |
| Notices in your in-app inbox | Up to 30 days |
| Invite programme records | While your account is open. If you delete your account, the record of the invite stays with the credit history, because it explains why credits were given, but it then points to an anonymised account record. The hash of the IP address in it is only ever compared with security log entries, which last 90 days. |
| Teams applications, reports about tracks and takedown notices | While we deal with the matter, and then for as long as a legal claim could arise from it |
| Server request logs at our host | A short time, for debugging and security, and then deleted automatically |
Backups. A copy of the database is made every night and stored in Cloudflare R2, inside our own Cloudflare account. We keep the three most recent copies, so data that you delete disappears from the backups within about three days. Cloudflare also keeps a point-in-time recovery history of the database for up to 30 days. We would use either only to recover from a failure. Audio files are not part of these backups.
We may in future set a storage period for individual tracks. We have not done this. If we do, the terms say how you will be told: in the app, with at least 7 days' notice before any track is deleted, and by email before the change takes effect.
9. Your rights and how to use them
You have the right to:
- get a copy of your data, in a portable format;
- have wrong data corrected;
- have your data erased;
- object to processing based on legitimate interests, including our analytics, and ask us to restrict processing;
- object to direct marketing at any time. For tips and offers inside the app, use the switch in Settings > Notifications. For marketing email, use the unsubscribe link in any such email or the switch in Settings. We always act on this objection;
- withdraw consent at any time, where we rely on consent;
- not be subject to a decision based only on automated processing that has a legal or similarly significant effect.
The quickest route is the Privacy tab in Settings. "Export my data" downloads one file with your account details, track list, generation history, credit history, activity, quiz answers, requests kept to finish on a computer, plan checkout records and any quotes you wrote, and the records of the offers made to your account, and "Delete my account" erases your account. The file does not include support conversations, in-app message records, invite records or security log entries. Contact us for those. You can also reach us through the contact form or hello@lyromusic.com. Using your rights is free. We reply within one month and may need to check that the request comes from you.
Deleting your account ends any plan paid on the web at the same moment, so that you are never charged again; a plan bought in the iPhone app is billed by Apple and you stop it in your Apple Account. If we cannot end a web plan, for example because the payment provider does not answer, nothing is deleted and we ask you to try again. Deleting then erases your tracks, projects, support conversations, in-app message records, checkout records, offer records, email log entries, analytics events and quiz answers, signs you out everywhere, and strips the account record of your email address, name, password hash, Google identifier and Apple identifiers, and revokes Sign in with Apple if you used it. Billing records stay for the period in section 8. Security log entries age out after 90 days and error log entries after 30 days. Backups catch up within about three days, and Cloudflare's recovery history within 30 days.
10. Complaints
If you are unhappy with how we handle your data, please tell us first, through the contact form or hello@lyromusic.com. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You can also complain to the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint. If you live in the European Economic Area, you can complain to the data protection authority in your country.
11. Children
You must be 16 or over to have an account, and we do not knowingly collect data from anyone under 16. If you believe someone younger has opened an account, contact us and we will close it and delete the data.
People aged 16 and 17 are children under UK data protection law, so we design for them too: the account is private by default, share links are off until you switch one on, tips and offers inside the app can be switched off in Settings, we run no advertising and no profiling that decides anything about you, and we collect no more than the service needs. Making music costs money, so a plan needs a payment method, which in practice means a parent or guardian is involved.
12. How we protect your data
We use measures that fit the size of the service and the kind of data we hold:
- Passwords are stored only as salted hashes, and new passwords are checked against known breaches without leaving our server.
- The sign-in cookie is HttpOnly, so scripts in the page cannot read it, and we store only a hash of the session token.
- All traffic to Lyro is encrypted in transit.
- Your files are private: served only to you, through a share link you switched on, or to a model provider through a signed link that expires.
- Card details go straight to Stripe and never touch our servers.
- Repeated wrong passwords are refused for 15 minutes: first for the address they come from (after 8), and for the whole account only if they arrive from many addresses at once. You can add two-step sign-in with an authenticator app in Settings, Security.
- We refuse sign-ups from throwaway email services, we limit how fast sign-up and sign-in can be tried, and we may show a Cloudflare Turnstile check at sign-up.
- We keep a security log of sign-ups, log-ins, failed log-ins and lockouts. It holds a keyed hash of the IP address, which lets us see that the same address came back without storing the address itself.
- The database is backed up every night to storage inside our own Cloudflare account, and we keep the three most recent copies.
No service can promise perfect security. If a breach is likely to put you at risk, we will tell you and the regulator as the law requires.
13. Automated decisions
We make no automated decisions about you that have a legal or similarly significant effect. Some things are automated without such an effect: Lyro picks the AI model for a request from the language and the task, the quiz suggests a plan that you are free to ignore, and rate limits slow down unusually frequent requests.
Other steps are automatic too. Sign-in to an account is locked for a short time after repeated wrong passwords. Sign-ups from throwaway email services are refused. An invite reward is withheld when the two accounts appear to share a household or network. In-app messages are chosen by rules about your account, and a random share of accounts gets no promotional messages. None of these has a legal or similarly significant effect. If you think one of them got it wrong, contact us and a person will look at it.
14. Changes to this notice
We update this notice when what we do changes, for example when we add a provider. The date at the top shows the latest version. If a change is significant, we will tell you by email or in the studio before it takes effect.