Privacy Policy

1.1The controller of the personal data processed in Setlyst is [RAZÃO SOCIAL], registered under CNPJ [CNPJ], with its registered office at [ENDEREÇO].

1.2This Policy explains how we process personal data under the Brazilian General Data Protection Law (Law 13,709/2018, “LGPD”) and the Brazilian Civil Rights Framework for the Internet (Law 12,965/2014). Questions can be sent to our Data Protection Officer at support@setlyst.app.

2.1We only process the data needed to provide the service:

1. Registration data: username, e-mail address, first and last name (optional), password (stored only as a hash), language, account creation date, accepted terms version and acceptance date, referral code and, if any, the account that referred you.
2. Profile data: bio, location, instruments and the address (URL) of the profile picture you provide. We do not store the image file, only its address.
3. Sign in with Google: Google account identifier, e-mail address and name, received from Google when you choose that sign-in method.
4. Content: songs, lyrics, chords, notes, setlists, gigs, tours, bands, suggestions, votes, reminders and links you add.
5. Usage and security data: IP address, date and time of access, sign-in attempts, security events (password change, two-step verification turned on) and audit records of administrative actions.
6. Preferences: theme, language, Live Mode and interface settings, communication preferences and pinned items.
7. Communications: e-mails sent to you (verification, security, notices), notifications and messages you send to support.
8. Subscription data: plan, subscription status, credits, redeemed promo codes and referrals. Once billing is active, also payment data processed by the payment processor; Setlyst does not store full card numbers.

2.2Data saved for offline use stays in your own browser's storage and is erased when you sign out.

3.1We process personal data for the purposes below, with the corresponding legal bases of article 7 of the LGPD:

1. Creating and maintaining the account, authenticating you, providing the contracted service, syncing bands and generating exports: performance of a contract (art. 7, V).
2. Keeping access records for 6 months: compliance with a legal obligation (art. 7, II, and art. 15 of the Civil Rights Framework for the Internet).
3. Preventing fraud and abuse, limiting sign-in attempts, moderating usernames and profile pictures, keeping the platform secure and improving the service with aggregated statistics: legitimate interest (art. 7, IX), always respecting your rights and expectations.
4. Sending product news and offers by e-mail: consent (art. 7, I), which you can withdraw at any time.
5. Sending security communications and essential account notices: performance of a contract and legitimate interest.
6. Meeting tax obligations related to payments, once billing is active: legal obligation (art. 7, II).
7. Defending rights in judicial, administrative or arbitration proceedings: regular exercise of rights (art. 7, VI).

3.2Automatic checks of usernames and images only flag cases for review. Any moderation measure is decided by a member of Staff, and you may ask for a review of decisions based on automated processing (art. 20 of the LGPD).

4.1We do not sell personal data. We share data only with processors that help us provide the service, under contract and following our instructions:

1. API and database hosting provider: stores and processes all platform data.
2. Vercel Inc.: hosts the website and web app and provides Vercel Web Analytics, which measures visits in aggregate and without cookies.
3. E-mail delivery provider: delivers transactional e-mails and the communications you have authorised.
4. Google LLC: authentication, when you use Sign in with Google.
5. Google Cloud Vision (optional): may receive the address of a profile picture or band logo to classify inappropriate content, when this feature is enabled.
6. Payment processor: once billing is active, it will process the data needed to handle payments.

4.2Data is also shared as a result of how you use the platform: members of your bands see the band's content and your username, and anyone who opens a public link sees the shared content, without your personal data.

4.3We may provide data to authorities when required by law or court order, within legal limits.

5.1Some processors, such as Vercel and Google, keep servers outside Brazil, mainly in the United States. These transfers are based on article 33 of the LGPD, through contractual clauses that ensure a level of protection compatible with Brazilian law, as regulated by the National Data Protection Authority (ANPD).

6.1Retention periods are:

1. Registration, profile, preference and content data: while the account exists. After the account is deleted, they are erased, except as described below.
2. Access records (IP, date and time): 6 months, under article 15 of the Civil Rights Framework for the Internet.
3. Audit records of administrative and security actions: for as long as needed to investigate incidents and defend rights, up to 5 years.
4. Items in the trash: 30 days; after that they are permanently deleted.
5. E-mails in the delivery queue: the content of sensitive e-mails (such as codes) is erased after sending, and delivery records are removed after 30 days.
6. Verification codes: expire in 15 minutes and are erased daily.
7. Database backups: up to 30 days, on rotation; deleted data disappears from backups at the end of that period.
8. Payment tax data: for the period required by tax law, usually 5 years.

7.1Under article 18 of the LGPD, you may request:

1. confirmation that processing takes place;
2. access to the data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
5. portability of the data to another provider;
6. deletion of data processed on the basis of consent;
7. information about the entities we share data with;
8. information about the possibility of not giving consent and its consequences;
9. withdrawal of consent;
10. review of decisions based solely on automated processing.

7.2You may also lodge a complaint with the National Data Protection Authority (ANPD).

8.1Many rights can be exercised directly in the platform:

1. Access and correction: in My account and in Settings.
2. Portability: export all your content in Settings, in the backup section.
3. Consent to e-mails: adjust your preferences in Settings, in the Communications section, or use the unsubscribe link in the e-mails.
4. Deletion: delete your account in Settings.

8.2For other requests, write to support@setlyst.app from the e-mail address registered on your account. We may ask for additional information to confirm your identity. We reply within 15 days.

9.1The Data Protection Officer (Encarregado) is the communication channel between you, Setlyst and the ANPD. Contact: support@setlyst.app.

10.1We adopt technical and administrative measures to protect personal data, as required by article 46 of the LGPD, including:

1. encryption in transit (HTTPS/TLS) on every connection;
2. passwords stored only as Argon2 hashes;
3. optional two-step verification (TOTP), with secrets encrypted at rest (AES-256-GCM) and recovery codes stored as hashes;
4. e-mail verification codes stored as HMAC with a limited number of attempts;
5. sign-in attempt limits and temporary account lockout;
6. role-based access control, least privilege and an audit log of Staff actions;
7. profile pictures loaded through our server, with validation, so your IP address is not exposed to third-party sites.

10.2No system is completely immune to failure. That is why we recommend a strong password and two-step verification.

11.1If a security incident occurs that may cause relevant risk or harm, we will notify the ANPD and the affected data subjects within the time and in the manner set by regulation, under article 48 of the LGPD, stating the nature of the affected data, the risks involved and the measures taken.

12.1Setlyst is intended for people aged 18 or over. Teenagers aged 16 and 17 may use the platform only with the consent of a parent or legal guardian, in the teenager's best interest (article 14 of the LGPD).

12.2The platform is not intended for anyone under 16. If we identify an account belonging to someone under 16, or without the required consent, the account may be closed and the data deleted.

13.1We only use strictly necessary cookies (session, protection against cross-site request forgery and language) and preference cookies (theme). We do not use advertising cookies. Details in the Cookie Policy.

14.1This Policy may be updated to reflect changes in the service or the law. The effective date is shown at the top of the document, and relevant changes will be communicated by e-mail or a notice in the platform. General questions: support@setlyst.app.