This is the international English version. Nederlandse versie
This policy explains what personal data VerseWorthy processes, why, on what legal basis, and what you can do about it. It describes the service as it actually works today, not as it might work later.
We hold an email address, a password you can never read back, and a credit balance. Your songs are not part of that: projects stay in your own browser, and the text sent for an AI review is not stored afterwards. Payments are handled by Stripe; we never see your card.
The controller for the processing described here is Boot Scoot Media, trading as VerseWorthy, Kolonel Verveerstraat 50, 1411 VE Naarden, the Netherlands, KvK 90776356.
For privacy questions or to exercise your rights, contact info@aicountrymusic.nl. We have not appointed a data protection officer; we are not required to.
Songs, versions, settings, project names and statuses are stored in your browser's local storage on your own device. We do not receive or hold this data, we cannot read it, and we cannot restore it for you. Clearing your site data deletes it. The backup and export functions exist so that you control your own copies.
When you use a review, writing, rewrite, polish, co-writer or fact-check function, the text needed for that request — typically your lyrics together with the relevant settings such as title, writer name if you entered one, style and intention — is transmitted to our server and forwarded to our AI provider for processing. The result is returned to your browser.
We do not store this content in a database after the request completes, and we do not write it to our application or error logs. Our server is configured so that a failure during processing records only what went wrong — the endpoint, the error category, the timing and the status — and never the text that was being processed. Content exists transiently in server memory for the duration of the request and is gone when it ends. Our AI provider processes it under its own terms, which we describe below.
Our server processes the IP address of your request as part of ordinary internet communication. For usage limiting we store a one-way hash of that address together with request timestamps — not the address itself. Standard web server logs may record IP address, time, requested resource, status code and user agent.
If you contact us, we process your message, your email address and anything you choose to include.
When you create an account we store your email address, your display name if you give one, a one-way hash of your password, your credit balance, and the dates you signed up and last signed in. A password hash cannot be turned back into a password, so we cannot read your password and cannot tell it to you.
Signing in sets a session cookie named vwsess, which holds nothing but a random identifier.
Every change to your balance is recorded: the amount, the reason (sign-up, an action you ran, a purchase, a refund), the resulting balance and the time. This is how a balance can always be explained, to you and to us.
When you buy credits we store the Stripe session and payment identifiers, which pack you bought, the amount, the currency, the status and the email address Stripe passes back. We never receive or store your card details. The payment itself happens on Stripe's own pages.
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the features you request | AI request content | Performance of a contract, or steps taken at your request (Art. 6(1)(b) GDPR) |
| Running your account and your credit balance | Account data, credit usage history | Performance of a contract (Art. 6(1)(b)) |
| Taking payment and keeping the records the law requires | Purchase data | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for the accounts |
| Keeping the service available and preventing abuse of our AI budget | Hashed identifier, timestamps | Legitimate interests (Art. 6(1)(f)): protecting the service against overuse and misuse |
| Security, diagnosing faults, protecting infrastructure | Server and error logs | Legitimate interests (Art. 6(1)(f)); legal obligation where applicable |
| Answering support requests | Support data | Performance of a contract or legitimate interests |
| Complying with legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have considered your interests and rights; you may object as described under your rights.
We do not use your lyrics to train AI models, and we do not sell personal data or share it for advertising.
We use a small number of service providers who process data on our behalf under a data processing agreement.
| Provider | Role | Status |
|---|---|---|
| Anthropic | AI processing of request content | In use. Provider terms and retention: anthropic.com/legal |
| Versio B.V., the Netherlands | Hosting, server logs | In use |
| Our email provider | Support correspondence | In use for support correspondence |
| Stripe | Payment processing; handles all card data | In use |
| — | Accounts and sign-in | Handled by us; no third party involved |
Suno is not a processor for us. If you copy material from VerseWorthy into Suno, that is your own use of a separate service, governed by Suno's own terms and privacy policy.
We may disclose data where required by law or to establish, exercise or defend legal claims.
Some providers may process data outside the European Economic Area, including in the United States. Where that happens we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses or an adequacy decision, together with additional measures where needed. You can ask us at info@aicountrymusic.nl which mechanism applies to a specific provider.
Under every professional review there is a question: does this match your own judgement of the song? Answering is entirely optional and nothing changes if you never do.
When you answer, we keep the thumb you chose, the score and risk ratings the reviewer gave, the strictness setting you used, and whatever you typed in the box. Your account is linked to it so we can reply if you asked something.
The review report itself is only kept if you tick the box that says so. That box is off every time. The report quotes lines from your song, which is creative content, and we do not retain that unless you deliberately hand it over — so the choice is yours each time and never remembered as a preference. Your lyrics are not sent with feedback at all, only the report, and only on that tick.
Why we ask: whether the reviewer breaks is something we can test. Whether its judgement is any good is a ruling only the writer holding the song can make. Feedback is how that reaches us.
| Category | Retention |
|---|---|
| AI request content | Not retained by us after the request completes, other than transiently in memory |
| Rate-limit records (hashed identifier, timestamps) | Up to 48 hours, then deleted automatically |
| Server and error logs | 30 days |
| Support correspondence | 24 months |
| Feedback you send about a review (thumb, ratings, your comment) | Until you ask us to remove it, or we have acted on it |
| A review report you chose to send with that feedback | Only when you ticked the box; removed once we have acted on it |
| Account data | Until you delete your account, then removed |
| Credit usage history (what each credit was spent on) | Kept while your account exists; deleted with the account |
| Financial records of a purchase (amount, date, payment reference, VAT data) | Seven years, as article 52 of the Algemene wet inzake rijksbelastingen requires, counted from the end of the year the record relates to — with your identity removed once the account is deleted |
| Session cookie | 30 days, or until you sign out |
| Local project data | Held on your device until you delete it; we hold no copy |
Statutory retention obligations override deletion requests to the extent that the law requires it; we will tell you when that applies.
Subject to the conditions in the GDPR, you have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and portability, and the right to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Write to info@aicountrymusic.nl. We aim to respond within one month and will tell you if we need longer, as the GDPR permits.
You can erase your own account without asking us. The Delete account link beside your name removes your email address, balance and credit history immediately and irreversibly. Two things survive it: projects saved in your own browser, which only you can clear, and the financial record of any purchase, which we must keep for seven years under Dutch tax law — with your identity removed from it.
Note the practical limit: because your projects are stored only in your browser and we do not retain AI request content, there is often very little personal data for us to give you, correct or erase. That is a deliberate design choice, not an evasion.
If you believe we are processing your data unlawfully, you may lodge a complaint with a supervisory authority. Our lead authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the supervisory authority in your own country of residence or place of work. We would welcome the chance to address your concern first.
VerseWorthy is intended for adults aged 18 or over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact info@aicountrymusic.nl and we will delete it.
The Songwriter Score and the other indicators are creative and editorial assistance regarding a text you submit. They are not used to make decisions that produce legal effects for you or similarly significantly affect you, and we do not carry out profiling of users for such purposes.
Automated processing is used for security and rate limiting; its only effect is that AI features may be temporarily unavailable to a visitor who exceeds the limit.
We keep AI provider credentials on the server and never in the browser, restrict access to server-side configuration, transmit data over encrypted connections and limit what is stored in the first place. No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority and, where required, you.
We will update this policy when the service changes, for instance if we introduce accounts or payments. Each version carries a date and version number. Where a change is material we will inform users in an appropriate way before it takes effect.