Privacy Policy
We take your privacy seriously. This policy explains what personal data we collect, why we collect it, and how we protect it, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: July 2026
1. Who Is Responsible for Your Data
The data controller is the individual operator of knowyourlyrics.com. For all data-related enquiries, contact us at privacy@knowyourlyrics.com.
The legal structure of the operator may change over time (e.g., from individual to registered company). This policy will be updated to reflect any such change.
2. What Data We Collect
| Data | Why We Collect It | Legal Basis (UK GDPR Art. 6) |
|---|---|---|
| Email address | Account registration and login | Contract (Art. 6(1)(b)) |
| Display name | Personalising your account | Contract (Art. 6(1)(b)) |
| Assessment data (your notes, scores, verdicts) | Core product: your personal worship discernment record | Contract (Art. 6(1)(b)) |
| Song requests and votes | Processing your content requests | Contract (Art. 6(1)(b)) |
| Analytics events (page views, feature usage) | Understanding how the platform is used to improve it | Consent (Art. 6(1)(a)), opt-in at registration only |
| Server / access logs (IP address, request metadata) | Infrastructure security and error diagnosis | Legitimate interest (Art. 6(1)(f)) |
We do not collect or store worship song lyrics at any point. Lyrics entered during AI analysis are used only in that request and are never written to any database.
3. How Long We Keep Your Data
| Data | Retention Period |
|---|---|
| Account, assessments, requests | Until you request deletion of your account |
| Analytics events | 24 months, then automatically deleted |
| Admin audit logs | 7 years (legal accountability obligation) |
| Export files | 30 days, then automatically deleted from storage |
| Server / infrastructure logs | 30 days (managed by our hosting provider, Vercel) |
| Error and session diagnostic data (Sentry) | 90 days (Sentry default retention) |
| Visitor analytics data (Vercel Analytics) | 90 days rolling window |
4. Your Rights
Under UK GDPR you have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Erasure: Ask us to delete your account and all associated personal data. Deleting your account removes your profile, assessments, assessment history, song requests, votes, and export files.
- Rectification: Correct your display name or analytics preference at any time in your Profile settings.
- Restriction: Ask us to restrict processing of your data in certain circumstances.
- Objection: Opt out of analytics at any time in your Profile settings.
- Portability: Request a structured export of your assessment data (available in a future update).
To exercise any of these rights, email privacy@knowyourlyrics.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
5. Third-Party Processors
We use the following third-party services to operate the platform. Each acts as a data processor under our instruction:
| Processor | Purpose | Data Location |
|---|---|---|
| Supabase | Database, authentication, and file storage | EU West (Ireland), within the EEA |
| Vercel | Application hosting, delivery, and web analytics. Vercel Analytics collects cookieless, aggregated visitor data (page views, referrers, device type, country). No personal data or persistent identifiers are stored. Vercel Speed Insights collects real-user Core Web Vitals (page load performance). Neither service sets cookies or requires consent under UK PECR. | Global edge network; Vercel DPA with Standard Contractual Clauses |
| OpenAI | AI-powered song analysis | United States; OpenAI DPA with Standard Contractual Clauses. No personal data is sent to OpenAI. Only song lyric content (ephemeral, not stored) and Bible reference text. |
| Sentry | Error monitoring and session diagnostics. Sentry captures application errors and, on a sample of sessions (approximately 10%), records a replay of user interactions to aid debugging. This may include request metadata such as page URLs and HTTP headers. No cookies are set by Sentry; it uses browser session storage only. | European Union (Sentry EU data centre, sentry.io/privacy); Sentry DPA with Standard Contractual Clauses. |
6. Cookies
We use one cookie: a session cookie that keeps you signed in. It is strictly necessary for the platform to function and does not track you across other websites. See our Cookie Policy for full details.
7. Changes to This Policy
We may update this policy as the platform evolves. Material changes will be signalled on the site. The “Last updated” date at the top of this page reflects the most recent revision.