Privacy Policy

Lyriot ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, share and protect your personal information, in accordance with the General Data Protection Regulation (GDPR) and applicable French law.

We collect the following categories of data:

• Account data: full name, email address, hashed password (bcrypt), city, country, gender, date of birth, phone number (optional).
• Profile data: profile picture (stored on Cloudflare R2), biography, interests.
• Activity data: events created and joined, waiting-list entries, comments posted, reactions, QR code check-ins, messages exchanged (content and timestamp), friendships, message read status (read receipts), achievements unlocked, activity streaks, referral code and list of referrals.
• Gamification data: points earned by source, current rank, leaderboard history, active boosts and their expiry, points wallet balance and history.
• Payment data: transaction history (subscriptions, paid events, boosts), active subscription and renewal date. Bank and card details are handled exclusively by Stripe — we never store them.
• Organiser data (Stripe Connect): for organisers receiving payments, KYC data is collected by Stripe directly: identity (name, date of birth, scanned identity document), full postal address, bank details (IBAN / account number) and, where applicable, company information (registered name, business registration or tax number). This data is governed by Stripe's privacy policy.
• Location data: GPS coordinates (latitude/longitude) entered when creating an event, used to display the map and to search by proximity. Continuous location is never collected. If you have already allowed geolocation on your device, your position, rounded to about ten kilometres, is also used to rank city suggestions; it is not saved to your account.
• Job application data: CV, cover letter and LinkedIn URL submitted through /careers/apply, stored on Cloudflare R2 ("resumes" bucket). Kept for a maximum of 2 years.
• Contact data: name, email and message content sent through the /contact form.
• Technical data: IP address, browser type, pages visited, connection date and time, session identifier (NextAuth), push notification tokens (Firebase).

Your data is used to:

• Provide, maintain and improve our services
• Authenticate you and keep your account secure (email/password sign-in or Google OAuth)
• Show you relevant events, profiles and leaderboards
• Process payments (subscriptions, paid events, boosts) through Stripe
• Pay out funds to organisers of paid events through Stripe Connect
• Send notifications (email through Resend, push through Firebase)
• Award points automatically every 15 minutes through scheduled jobs (cron jobs)
• Calculate and update user ranks automatically
• Generate the occurrences of recurring events (weekly, monthly, and so on)
• Capture and transfer event payments to organisers
• Reset the weekly, monthly and yearly leaderboards periodically
• Check eligibility for the referral programme (abuse prevention)
• Show your online status and last activity date to your friends
• Enable content moderation and the handling of reports
• Prevent fraud, abuse and duplicate accounts
• Meet our legal and accounting obligations

We process your data on the following legal bases:

• Performance of a contract: to provide the Lyriot services you signed up for (account, events, payments, messaging)
• Legitimate interests: to improve the platform, prevent fraud, maintain security, display online status and run the leaderboards
• Consent: for push notifications (which you can withdraw at any time in your settings) and optional marketing communications
• Legal obligation: to comply with applicable regulations, in particular accounting requirements (5-year retention) and lawful requests from the authorities

We never sell your personal data. We share it only with our technical service providers, strictly as needed to deliver the service:

• Stripe: payment processing (subscriptions, paid events, boosts) and organiser payouts through Stripe Connect — Stripe's policy
• OVH: hosting of the PostgreSQL database (VPS, France); Cloudflare R2: file storage (avatars, CVs)
• Resend: sending transactional emails (sign-up confirmation, password reset, event notifications)
• Mapbox: displaying interactive maps for event locations and proximity search
• Photon (komoot) and Nominatim (OpenStreetMap Foundation, data in the United Kingdom and the Netherlands): city suggestions as you type, Nominatim being used only if Photon does not respond. Our servers send them only the text you typed and, for Photon, an approximate position: the centre of your country or, if you have already allowed geolocation, your position rounded to about ten kilometres. Your name, IP address and account are never sent to them.
• Firebase (Google): sending push notifications to your devices (if enabled)
• Google OAuth: if you choose to sign in with Google, your Google name, email and profile picture are passed to Lyriot
• Competent authorities: where required by law, by a court order, or to protect our legitimate rights

Some of our providers are established outside the European Union (Firebase/Google, Stripe — in the United States). These transfers are covered by:

• The Standard Contractual Clauses approved by the European Commission
• The Commission's adequacy decisions (for example the EU-US Data Privacy Framework for Stripe and Google)
• The appropriate safeguards set out in Article 46 of the GDPR

Your data is kept for as long as your account is active. If you delete it, the data is erased within 30 days, except where the law requires otherwise:

• Transaction data: 5 years (French accounting requirement)
• Job application data (CVs, cover letters): 2 years maximum
• Technical logs: 12 months
• Moderation and sanction history: kept indefinitely (security and abuse prevention)
• Deleted private messages: metadata (timestamp, participants) may be retained even after the content is deleted

Under the GDPR, you have the following rights:

• Right of access: to see the data we hold about you
• Right to rectification: to correct inaccurate data (directly in Settings, or by contacting us)
• Right to erasure: to delete your account from Settings → Danger zone (processed within 30 days)
• Right to data portability: to obtain a copy of your data in a structured format
• Right to object: to object to certain processing (for example marketing communications, online status)
• Right to restriction: to ask us to suspend processing in certain cases
• Rights regarding automated decisions: to be informed about automated processing (points awards, rank calculation, referral validation) and to contest the outcome

To exercise these rights: contact form. You may also lodge a complaint with the CNIL.

Technical and organisational measures in place:

• All communications encrypted in transit (HTTPS/TLS)
• Passwords hashed with bcrypt (never stored in plain text)
• Data access restricted on a least-privilege basis
• Files stored securely on Cloudflare R2 (access through temporary signed URLs)
• CSRF protection on every form (NextAuth token)
• Logging of administrative actions
• Regular database backups
• In the event of a data breach, affected users will be notified within 72 hours as required by the GDPR

We use technical cookies that are necessary for the platform to work (user session, CSRF protection). We also use your browser's local storage to remember your preferences (light/dark theme, display currency, language) — this data never leaves your device. For more information, see our cookie policy.

Lyriot is open to people aged 15 or over, in accordance with Article 7-1 of the French Data Protection Act. In countries where the applicable law sets a different age (for example 13 in the United States under COPPA, or 16 in some EU member states), the more protective age applies. We do not knowingly collect data about minors below the required age. If you believe such a minor has created an account, please contact us immediately.

Beyond the European GDPR, Lyriot complies with the following data protection laws depending on your country of residence:

• California (CCPA/CPRA): If you live in California, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act: the right to know what personal data is collected, the right to delete it, the right to opt out of the sale of personal data (we do not sell your data), and the right not to be discriminated against. Contact us at contact@lyriot.com to exercise these rights.
• United Kingdom (UK GDPR): We comply with the post-Brexit UK GDPR. The supervisory authority is the ICO (Information Commissioner's Office). Your rights are equivalent to those under the EU GDPR.
• Brazil (LGPD): Under the Lei Geral de Proteção de Dados Pessoais, you have rights of access, correction, deletion, portability and objection. The competent authority is the ANPD (Autoridade Nacional de Proteção de Dados).
• Canada (PIPEDA + Law 25): We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec, Law 25 (An Act to modernize legislative provisions as regards the protection of personal information). Authorities: OPC (federal), CAI (Quebec).
• Australia (Privacy Act 1988): We comply with the Australian Privacy Act and the Australian Privacy Principles. The authority is the OAIC (Office of the Australian Information Commissioner).
• Japan (APPI): Under the Act on the Protection of Personal Information (個人情報の保護に関する法律), we comply with the obligations of the APPI. The authority is the PPC (Personal Information Protection Commission / 個人情報保護委員会).
• China (PIPL): Under the Personal Information Protection Law (个人信息保护法), we process your data on the principles of lawfulness, legitimacy and necessity. The competent authority is the CAC (Cyberspace Administration of China / 国家互联网信息办公室).
• South Korea (PIPA): Under the Personal Information Protection Act (개인정보 보호법), you have rights of access, rectification, deletion and objection. The authority is the PIPC (Personal Information Protection Commission / 개인정보보호위원회).
• India (DPDP Act 2023): Under the Digital Personal Data Protection Act 2023, you have the right to information, correction and erasure of your digital personal data. The authority is the Data Protection Board of India (being established by MeitY).
• Turkey (KVKK): Under Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), you have rights of access, correction and deletion. The authority is the KVKK (Kişisel Verileri Koruma Kurumu).
• Indonesia (UU PDP): Under Law No. 27/2022 on Personal Data Protection (Undang-Undang Perlindungan Data Pribadi), your rights include access, correction and deletion. The authority is the Kementerian Komunikasi dan Informatika.
• Thailand (PDPA): Under the Personal Data Protection Act B.E. 2562 (2019), you have rights of access, portability, deletion and objection. The authority is the PDPC (Personal Data Protection Committee).
• Saudi Arabia (PDPL): Under the Personal Data Protection Law (نظام حماية البيانات الشخصية), you have rights of access and correction. The competent authority is SDAIA (Saudi Data and AI Authority / هيئة السعودية للبيانات والذكاء الاصطناعي).

Supervisory authorities by country :

We may update this policy at any time. If we make a substantial change, you will be informed by email or through a notification on the platform. Continuing to use Lyriot after being notified means you accept the changes.

This policy is written in French. Versions in other languages are translations provided for information only; in the event of any discrepancy, only the French version is legally binding.

Data controller: Lyriot, France.

For any question about your personal data, to exercise your GDPR rights (access, rectification, erasure, portability, objection, restriction), or for any complaint about how your data is handled: contact form or directly at contact@lyriot.com.

You may also lodge a complaint with the competent supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, 75007 Paris.