Privacy Policy
Last updated 6 November 2026
This policy explains what personal data VYRS collects, why, and what your rights are. VYRS is run by CloudFreaks B.V., which is the controller for your personal data under the General Data Protection Regulation (GDPR).
CloudFreaks B.V., Willem Dreeslaan 432-B, 2729 NK Zoetermeer, the Netherlands. Email: info@cloudfreaks.nl. Chamber of Commerce (KvK) 65279921, VAT NL856049384B01.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address, name or artist name, password (stored only as a secure hash) | To create and secure your account and to sign you in | Contract |
| Waitlist: email address, name (optional), time and IP address of signing up | To invite you when there is room, and to prevent abuse | Consent, legitimate interest |
| Artist profile: bio, links, role | To show your profile on your songs, and publicly with songs you publish | Contract |
| Your content: ideas, lyrics, notes, uploaded audio, generated tracks, stems, artwork, track metadata | To provide the service | Contract |
| Plan, payment status, Mollie customer and subscription IDs, invoices | To bill you and keep our books | Contract, legal obligation |
| Usage: number of tracks and stems made this month | To apply the limits of your plan | Contract |
| IP address, time of sign-up, of accepting these terms and of confirming upload rights | To prevent abuse and to be able to show what was agreed | Legitimate interest |
| Technical logs (errors, requests) | To keep VYRS secure and working | Legitimate interest |
| Visit statistics: page visited, the site or campaign link you came from, browser language, type of device, and the country derived from your time zone. A visitor code that changes every day, made from your IP address and browser with a secret key; the IP address itself is not stored | To see how many people visit and which channels and countries bring new writers | Legitimate interest |
| With your account: the campaign or site you first came from, country (from your time zone), browser language and type of device | To learn which channels and countries bring members, shown only as totals | Legitimate interest |
| Emails you send us | To answer you | Legitimate interest |
| Affiliates: name, email address, application, bank details (IBAN, account holder, company and VAT number if given), statistics of your link and the commission | To run the affiliate programme and pay you | Contract, legal obligation (accounts) |
| Plays and likes of published songs: a like is stored with your account; a play is counted with a code that changes every day (no IP address stored) | To show how often songs are played and liked, and for the Top 100 | Legitimate interest |
| Newsletter: your email address and whether you want it (only if you turned it on) | To send you the monthly newsletter; one click in every newsletter unsubscribes you | Consent |
| VYRS Desktop: the name of each computer you connect, when it was connected and last used, and a protected code for its access | To let the app fetch your songs and to let you disconnect it | Contract |
| Reports about songs: your name, email address, what you report and why, and your IP address | To handle the report, tell you what we decided, and prevent abuse of the report form. The owner of the song doesn't see your name or email | Legal obligation (Digital Services Act), legitimate interest |
We don't use your data for advertising, we don't sell it, and we don't train AI models on it. Visit statistics stay with us: there is no analytics company involved, and we only look at totals. If your browser sends Do Not Track or Global Privacy Control, we don't count your visit. We don't make decisions about you that are based solely on automated processing and have legal or similarly significant effects. We do automatically check uploads and generated lyrics for copyright and originality (see Acceptable Use & Copyright); if a check blocks something, you can ask us to look at it.
If you take part in a blind listening or lyric test as a judge, we store the name and role you give (both optional), your votes and comments, and your IP address to prevent repeat voting.
Who we share data with
We use these service providers (processors). They only get what they need to do their part, and only process it on our instructions:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, storage and sending email | EU (Frankfurt) |
| Anthropic PBC | AI for lyrics, hooks, scores, co-writer, translations, originality checks and the Ask VYRS help chat | United States |
| ElevenLabs | AI for music and vocals, stems, and copyright screening of uploads | United States / EU |
| Mollie B.V. | Payments | Netherlands |
Mollie is also responsible for the payment data it processes itself, such as bank or card details. We never see your full card or bank details. Mollie's own privacy statement applies to that.
When you send lyrics or audio to the AI providers, they process it to return a result. Anthropic does not use data sent through its commercial API to train its models. Where data goes to the United States, the transfer is protected by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.
We may also share data when the law requires it, for example with a court or the police.
How long we keep it
- Account data and your content: as long as you have an account. When you delete your account, we delete it straight away from the live service.
- Songs and tracks you delete: removed straight away from the live service.
- Payment records and invoices: 7 years, because Dutch tax law requires this.
- Waitlist: until you create your account, or at most 12 months. Ask us and we take you off the list straight away.
- Accounts we close (for example after misuse) are first kept in a closed archive, so a mistake can be undone, and deleted for good within 12 months. Accounts you delete yourself are deleted straight away.
- Technical logs: at most 90 days.
- Records of accepted terms and upload rights confirmations: as long as your account exists, plus up to 2 years after, in case of a dispute about rights.
Security
Passwords are stored as salted hashes. Connections are encrypted (HTTPS). API keys for our providers are stored encrypted. Access to the servers is limited to the people who run VYRS. If a data breach puts your rights at risk, we tell you and the Dutch Data Protection Authority as the law requires.
Your rights
You have the right to access, correct and delete your data, to object to processing based on legitimate interest, to restrict processing, and to receive your data in a usable format. You can download your lyrics and tracks from your library, and delete your account yourself on your account page. For anything else, email info@cloudfreaks.nl. We respond within one month.
You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Cookies
VYRS uses one functional cookie to keep you signed in, and no tracking cookies. See Cookies.
Changes
If we change this policy in a way that matters to you, we tell you by email before it takes effect.