Privacy Policy — VersPad

This policy explains what data VersPad collects, why we collect it, and the choices you have. We try to keep this in plain English.

VersPad is an Australian business and handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). While VersPad may currently qualify for the small business exemption under the Act, we voluntarily commit to handling your personal information in accordance with APP standards.

In this policy, 'personal information' means any information or opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not. This includes things like your name, email address, and IP address, but not anonymised or aggregated data that cannot be linked back to you.

1. Data we collect

Account data (email address, password hash, optional display name) — to create and manage your account and verify your identity.
Prompts (the text inputs you enter to generate lyrics) — stored to enable regeneration and retry features, and analysed in anonymised, aggregated form to understand usage patterns and improve the service.
Content (prompts, lyrics, song structures and other material you create) — to store and display your work within the service.
Usage data (AI token consumption, feature usage, log timestamps) — to manage your subscription limits and monitor service performance.
Billing data (subscription status and last 4 digits of your card, via Stripe) — to manage your subscription and send receipts.
Device & log data (IP address, browser type, error reports) — to secure the service, diagnose technical issues, and prevent abuse.
Trial cookie (vp_trial, contains no personal data) — to enforce the anonymous free-try limit for users without an account.

2. Why we use your data

To run, secure and improve the service.
To process payments and prevent abuse.
To send transactional emails (password resets, receipts, important changes).
To respond to support requests.
To comply with legal obligations.
To analyse usage patterns and improve the service using anonymised, aggregated prompt data.

We do not sell your data, and we do not use your content — including prompts, lyrics, or any other material you create — to train AI models.

From time to time we may send you marketing or promotional emails about VersPad features, offers, or updates. You can opt out of these at any time via the unsubscribe link in the email. Transactional emails (receipts, security alerts, service notices) are not affected by opting out.

If you submit feedback or suggestions about VersPad, we may use that information to improve the service. Feedback is treated as non-confidential as described in our Terms of Service.

Lawful bases for processing (EEA and UK users)

For users in the EEA or UK, we process your personal data under the following lawful bases: performance of a contract (to provide the service and process payments), legitimate interests (to secure and improve the service, analyse usage, and respond to support requests), consent (for marketing communications), and legal obligation (to comply with applicable law).

3. Who we share data with

We use a small number of trusted processors to run the service. All third-party processors are bound by written data protection agreements and may only use your data as necessary to provide their services to VersPad.

Hosting & database (Supabase, AWS Sydney, Australia) — to store your account and content.
AI provider — your prompts and relevant context are sent to a third-party AI provider to generate lyrics. Outputs are returned to you and saved in your account. The AI provider does not use your content to train its models.
Payment processing (Stripe) — handles all subscription payments, card details, and invoices. VersPad receives only your subscription status and the last 4 digits of your card.
Email delivery — sends transactional emails on our behalf.
Error reporting and analytics tooling — helps us monitor service performance, diagnose technical issues, and understand how users interact with the service. These tools may receive device and log data such as IP address, browser type, and usage patterns.

We disclose data to law enforcement only when legally required.

In the event of a merger, acquisition, sale of assets, or similar business transaction, your data may be transferred to the acquiring party. We will notify users of any such change and the new owner will be bound by this Privacy Policy or a policy offering equivalent protections.

4. Cookies

Authentication cookie — keeps you signed in.
Trial cookie (vp_trial) — enforces the anonymous free-try limit.
Analytics cookies — only set with consent where required by law.

When you first visit VersPad, you will be presented with a cookie consent banner allowing you to accept or decline non-essential cookies. You can update your preferences at any time via the cookie settings link in the footer.

5. Data retention

Account and content data: kept while your account is active.
Prompts: retained for the life of your account to enable regeneration and retry features, and deleted along with your account data upon account deletion.
After account deletion: removed within 30 days, except where we must retain records for legal or tax reasons.
Backups: rolled off within 90 days.
Inactive accounts: accounts that have been inactive for 24 months or more may be suspended or permanently deleted along with all associated content and data, as described in our Terms of Service.

In the event that VersPad ceases operations, we will provide users with reasonable advance notice and a window to export their content before any data is permanently deleted.

6. Your rights

Depending on where you live (including under the Australian Privacy Principles, GDPR, UK GDPR, CCPA and similar), you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and associated data.
Export your content.
Object to or restrict certain processing.
Opt out of "sale" or "sharing" of personal information (we don't do either).
Lodge a complaint with your local data-protection authority (in Australia, the Office of the Australian Information Commissioner).

Most rights — including content export — can be exercised directly through your account settings. Account deletion and other requests that cannot be handled self-serve must be submitted via the contact page. We will respond within 30 days. We may ask you to verify your identity before acting on your request.

7. International transfers

Your data is primarily stored on servers located in Australia (AWS Sydney). It may also be processed in other countries by our third-party service providers, such as our AI provider. Where such transfers occur, we rely on standard contractual clauses or equivalent safeguards to protect your data.

8. Security

We use encryption in transit, hashed passwords, and access controls. No system is perfectly secure; please use a strong unique password and notify us of suspected breaches.

In the event of a data breach that is likely to result in serious harm to any affected individuals, we will comply with our obligations under the Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner (OAIC), including notifying affected users and the OAIC as required by law.

9. Children

VersPad is not intended for children under 13. If you believe a child has given us data, contact us and we'll delete it.

Users between the ages of 13 and 17 may only use VersPad with the express consent of a parent or guardian. By using the service, such users confirm that parental or guardian consent has been given. See our Terms of Service for full details.

10. Changes

We'll post material changes here and notify account holders by email when appropriate. The 'last updated' date at the top of this page will always reflect the current version.

If VersPad introduces team or multi-user account features in future, this policy will be updated to reflect how data is handled in those contexts.

11. Contact

Privacy questions? Use the contact page.

VersPad is not required to appoint a Data Protection Officer. For all privacy-related queries including GDPR and APP requests, please contact us via the contact page.