Who this covers
This notice covers autolyrical.com, license administration, email delivery and the contact form. The operator/contact details are shown above. The desktop editor’s local files are separate from the website’s license database. No customer sign-in account is required.
What we process
- License records: your email address, encrypted license key, license status, creation and use dates, activation count, the terms version/time you accepted and an encrypted copy of those terms.
- Email preferences: whether and when you requested product updates, your confirmation, withdrawal and the wording/version associated with that choice.
- Security and delivery: random browser/session tokens, one-time email confirmation tokens, expiry dates, sending attempts and delivery status. The application stores hashes of tokens and network addresses for lookup or rate limits, rather than raw tokens or addresses in those tables.
- Requests: the name, email, license/contract reference and message you choose to send, together with receipt time and request status.
- Hosting requests: the hosting infrastructure processes network and browser information needed to serve and protect the website. Infrastructure logs and backups are managed by the hosting providers under their terms.
Why we use it
| Purpose | Legal basis |
|---|---|
| Provide the license, access, confirmation and support you request | Steps you request before a contract and performance of that contract, where necessary |
| Product newsletters | Separate, voluntary consent; only after email confirmation |
| Protect the website, limit abuse and document requests | Legitimate interests in secure operation and handling claims, balanced against your rights |
| Respond to statutory rights, complaints or legal requirements | Applicable legal obligations; contract or legitimate interests where appropriate |
Accepting the terms is not consent to newsletters. We do not sell customer email addresses or use this website’s application code for advertising profiles or third-party analytics.
License emails and product updates
Your email is needed when claiming a new license. We send the key and license confirmation to that address when email sending is connected. Email confirmation requires an explicit button press on the linked page; simply opening a link does not confirm a preference. Product newsletters remain optional, and requesting a license does not enroll you automatically. You can withdraw a pending or confirmed newsletter request in your downloads or through the contact form without losing your license.
Addresses are shown to the authorized owner in the customer panel. Unverified addresses are marked as unverified. A delivery status records acceptance or failure at the sending provider; it is not proof that a message reached your inbox. Campaign sending is not connected.
How long records remain
- License and contact records are kept while needed to provide the issued license and updates, unless a valid erasure request or another applicable requirement changes this. We do not claim they disappear when you clear cookies.
- Download sessions expire after 24 hours; browser recovery lasts up to one year. Expired session/rate-limit rows are removed during subsequent relevant requests.
- Rate-limit windows last 15 minutes, one hour or one day depending on the action. Application cleanup removes expired rows.
- Email confirmation links expire after 24 hours. Expired confirmation rows are removed during request/admin cleanup. Encrypted transactional-email outbox entries are removed after 30 days during that cleanup.
- Contact/request records are kept while open, then for up to 12 months after closure. The application deletes older closed requests during request/admin cleanup. The operator must preserve a record longer only where a specific legal duty or legal claim justifies it.
- Newsletter confirmation/withdrawal records may be retained as necessary to respect and document your choice. Backups and infrastructure logs have provider-controlled retention; deletion from the active application does not instantly erase every backup.
Who receives data
The authorized AutoLyrical operator accesses license/contact and request records. Hosting is provided through Sites, with OpenAI Ireland Ltd and its infrastructure/sub-processors, including Cloudflare. This is hosting, not a requirement for customers to have an account. See the hosting data-processing terms and sub-processor list.
License and requested receipt emails are sent through Resend. It receives the recipient address and message contents, including your key when delivering a license. See Resend’s privacy information.
Fonts and site videos are served from the website’s own hosting. We do not connect a payment processor or marketing campaign service at present. Providers may process information outside Sweden or the EEA; applicable processing agreements, adequacy decisions or standard contractual clauses and other required safeguards must cover those transfers. We do not promise that all processing stays in Sweden.
Security and local editing
Application contact details, keys, email payloads and request messages are encrypted in database storage. Access to the owner panel is restricted. No system is risk-free; keep your license key and backups safe. Do not send private media, passwords, payment card details or external service keys in the contact form.
Imported songs, footage, projects and local transcription models in the downloaded editor remain on your computer in its local workflow. If you explicitly select a third-party online service or download, that service has its own data handling and terms. This website’s policy is not a promise that every optional desktop integration stays offline.
Your rights and requests
Depending on the applicable conditions, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent. Withdrawing consent does not undo lawful earlier processing. Use the privacy request form or the published privacy email. We may ask only for proportionate information to verify identity before releasing or removing records. Mandatory retention or an active legal claim can limit erasure.
We aim to respond to a data-rights request within one month; any permitted extension will be explained. You may complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority. We do not use automated profiling to make legal or similarly significant decisions; automated checks limit abuse and manage license availability.