This is the international English version. Nederlandse versie
This policy explains what personal data VerseWorthy processes, why, on what legal basis, and what you can do about it. It describes the service as it actually works today, not as it might work later.
We hold an email address, a password you can never read back, and a credit balance. Your songs are not part of that: projects stay in your own browser, and the text sent for an AI review is not stored afterwards. Payments are handled by Stripe; we never see your card.
The controller for the processing described here is Boot Scoot Media, trading as VerseWorthy, [STREET ADDRESS], [POSTAL CODE] [CITY], the Netherlands, KvK 90776356.
For privacy questions or to exercise your rights, contact info@bootscootmedia.nl. We have not appointed a data protection officer; we are not required to.
Songs, versions, settings, project names and statuses are stored in your browser's local storage on your own device. We do not receive or hold this data, we cannot read it, and we cannot restore it for you. Clearing your site data deletes it. The backup and export functions exist so that you control your own copies.
When you use a review, writing, rewrite, polish, co-writer or fact-check function, the text needed for that request — typically your lyrics together with the relevant settings such as title, writer name if you entered one, style and intention — is transmitted to our server and forwarded to our AI provider for processing. The result is returned to your browser.
We do not store this content in a database after the request completes. Content may appear transiently in server memory and, in the event of an error, in error logs; where that happens we keep such logs only as described under retention.
Our server processes the IP address of your request as part of ordinary internet communication. For usage limiting we store a one-way hash of that address together with request timestamps — not the address itself. Standard web server logs may record IP address, time, requested resource, status code and user agent.
If you contact us, we process your message, your email address and anything you choose to include.
When you create an account we store your email address, your display name if you give one, a one-way hash of your password, your credit balance, and the dates you signed up and last signed in. A password hash cannot be turned back into a password, so we cannot read your password and cannot tell it to you.
Signing in sets a session cookie named vwsess, which holds nothing but a random identifier.
Every change to your balance is recorded: the amount, the reason (sign-up, an action you ran, a purchase, a refund), the resulting balance and the time. This is how a balance can always be explained, to you and to us.
When you buy credits we store the Stripe session and payment identifiers, which pack you bought, the amount, the currency, the status and the email address Stripe passes back. We never receive or store your card details. The payment itself happens on Stripe's own pages.
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the features you request | AI request content | Performance of a contract, or steps taken at your request (Art. 6(1)(b) GDPR) |
| Running your account and your credit balance | Account data, credit history | Performance of a contract (Art. 6(1)(b)) |
| Taking payment and keeping the records the law requires | Purchase data | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for the accounts |
| Keeping the service available and preventing abuse of our AI budget | Hashed identifier, timestamps | Legitimate interests (Art. 6(1)(f)): protecting the service against overuse and misuse |
| Security, diagnosing faults, protecting infrastructure | Server and error logs | Legitimate interests (Art. 6(1)(f)); legal obligation where applicable |
| Answering support requests | Support data | Performance of a contract or legitimate interests |
| Complying with legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have considered your interests and rights; you may object as described under your rights.
We do not use your lyrics to train AI models, and we do not sell personal data or share it for advertising.
We use a small number of service providers who process data on our behalf under a data processing agreement.
| Provider | Role | Status |
|---|---|---|
| Anthropic | AI processing of request content | In use. Provider terms and retention: anthropic.com/legal |
| Versio B.V., the Netherlands | Hosting, server logs | In use |
| Our email provider | Support correspondence | In use for support correspondence |
| Stripe | Payment processing; handles all card data | In use |
| — | Accounts and sign-in | Handled by us; no third party involved |
Suno is not a processor for us. If you copy material from VerseWorthy into Suno, that is your own use of a separate service, governed by Suno's own terms and privacy policy.
We may disclose data where required by law or to establish, exercise or defend legal claims.
Some providers may process data outside the European Economic Area, including in the United States. Where that happens we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or an adequacy decision, together with additional measures where needed. You can ask us at info@bootscootmedia.nl which mechanism applies to a specific provider.
| Category | Retention |
|---|---|
| AI request content | Not retained by us after the request completes, other than transiently in memory |
| Rate-limit records (hashed identifier, timestamps) | Up to 48 hours, then deleted automatically |
| Server and error logs | 30 days |
| Support correspondence | 24 months |
| Account data | Until you delete your account, then removed |
| Credit history and purchases | Seven years, as Dutch tax law requires for financial records |
| Session cookie | 30 days, or until you sign out |
| Local project data | Held on your device until you delete it; we hold no copy |
Statutory retention obligations override deletion requests to the extent that the law requires it; we will tell you when that applies.
Subject to the conditions in the GDPR, you have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and portability, and the right to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Write to info@bootscootmedia.nl. We aim to respond within one month and will tell you if we need longer, as the GDPR permits.
You can erase your own account without asking us. The Delete account link beside your name removes your email address, balance and credit history immediately and irreversibly. Two things survive it: projects saved in your own browser, which only you can clear, and the financial record of any purchase, which we must keep for seven years under Dutch tax law — with your identity removed from it.
Note the practical limit: because your projects are stored only in your browser and we do not retain AI request content, there is often very little personal data for us to give you, correct or erase. That is a deliberate design choice, not an evasion.
If you believe we are processing your data unlawfully, you may lodge a complaint with a supervisory authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the supervisory authority in your own country of residence or place of work. We would welcome the chance to address your concern first.
VerseWorthy is intended for adults aged 18 or over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact info@bootscootmedia.nl and we will delete it.
The Songwriter Score and the other indicators are creative and editorial assistance regarding a text you submit. They are not used to make decisions that produce legal effects for you or similarly significantly affect you, and we do not carry out profiling of users for such purposes.
Automated processing is used for security and rate limiting; its only effect is that AI features may be temporarily unavailable to a visitor who exceeds the limit.
We keep AI provider credentials on the server and never in the browser, restrict access to server-side configuration, transmit data over encrypted connections and limit what is stored in the first place. No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority and, where required, you.
We will update this policy when the service changes, for instance if we introduce accounts or payments. Each version carries a date and version number. Where a change is material we will inform users in an appropriate way before it takes effect.