Privacy policy

Last updated: November 9, 2026.

1. Who we are

LYRA is an assistant, available on WhatsApp among other channels, that analyzes, prepares and gets signed the contracts, splits and metadata of music tracks. The service is currently offered as a demonstration and pilot.

The data controller is LYRA HQ, a French société par actions simplifiée registered with the Paris Trade and Companies Register under number 104 556 691, with its registered office at 50 avenue des Champs-Élysées, 75008 Paris, France.

For any question about your data: moustafa@lyrahq.co.

2. Data we process

• Identification and contact details: name, WhatsApp number, WhatsApp profile name, email address if you provide it and, if you have one, your company (name, registration number and address from the public business register).
• The content of our conversations: messages, voice notes, documents and audio files you send.
• Data about your tracks and contracts: contributors, roles, shares, collecting societies, identifiers (ISRC, ISWC, IPI), contract terms.
• Identity verification, if you complete it: it is performed by a specialized provider, using an ID document and a selfie. LYRA does not keep the images of the document or the selfie, only the result of the verification (verified or not, date, method).
• Electronic signature: name, contact method, signature, timestamp, IP address and signing log.
• Technical data: message identifiers and timestamps, system logs.

3. Why, and on what legal basis

• To provide the service you request (analyze, prepare, send and get your documents signed, build a track's file): performance of a contract or pre-contractual steps.
• To verify your identity before a signature: your explicit consent, collected before the verification, which you can withdraw at any time.
• To keep the service secure and prevent fraud: our legitimate interest.
• To meet our legal obligations, including keeping proof of an agreement.

Your content is not used to train artificial intelligence models without your explicit consent. We do not sell your data.

4. Who has access

• The other parties to a document you prepare with LYRA (co-writers, producer, label) see the information about them in that document.
• The recipients you choose, for example your distributor, when you ask us to send a file.
• Our service providers, acting on our behalf: Meta (WhatsApp Business Platform), which carries messages between you and LYRA; Stripe, for identity verification; DocuSeal, for electronic signatures; our hosting and artificial intelligence model providers, which process messages and transcribe voice notes.

5. Transfers outside the European Union

Some data may be processed outside the European Union, including in the United States. These transfers rely on the European Commission's standard contractual clauses, or on the Data Privacy Framework where the provider is certified.

6. How long we keep data

• Demonstration data: deleted no later than 30 days after the demonstration.
• Account data and conversations: while you use LYRA, then three years after your last interaction.
• Signed documents and signing logs: up to five years after the end of the agreement, as proof.

7. Your rights

You can access, correct and delete your data, restrict or object to its processing, request its portability, withdraw your consent and set instructions for your data after your death.

Write to moustafa@lyrahq.co. We reply within one month.

You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with your local authority.

8. Deleting your data

Send "DELETE" to LYRA on WhatsApp, or email moustafa@lyrahq.co.

We delete your data within 30 days and confirm it to you, except documents we must keep by law or as proof of an agreement.

Step-by-step instructions are on the Delete your data page.

9. Security

Data is encrypted in transit, and access is limited to the people who need it to run the service.

10. Age

LYRA is intended for people aged 18 and over.

11. The lyrahq.co website and invitation requests

The website sets no cookies and does not measure its audience. Its host, GitHub, logs visitors' IP addresses to keep the service secure.

When you request an invitation, the form on the website collects your name, your email address, what you do and, if you give it, a link to your work. We use them to reply to you and manage the invitation list, at your request (pre-contractual steps).

The form sends them to Google, our email provider (Google Workspace), which stores them in the LYRA HQ workspace and notifies us by email. Google may process them outside the European Union; these transfers are covered by the European Commission's standard contractual clauses.

We keep them until your access opens, and no later than twelve months after our last exchange. You can leave the list at any time by writing to us.

12. Changes

We publish any change to this policy on this page, with its update date.