Privacy Policy

1.1The controller of the personal data processed in Setlyst is Allan Rigo Somensi, an individual registered under Brazilian CPF no. 055.156.570-55, with address at Rua Amedeu Arioli, 269, Bairro Licorsul, Bento Gonçalves - RS, 95705832.

1.2This Policy explains how we process personal data under the Brazilian General Data Protection Law (Law 13,709/2018, “LGPD”) and the Brazilian Civil Rights Framework for the Internet (Law 12,965/2014). Questions and requests about personal data can be sent to the privacy channel at suporte@setlyst.com.br (section 9).

2.1We only process the data needed to provide the service:

1. Registration data: username, e-mail address, first and last name (optional), password (stored only as a hash), language, account creation date, accepted terms version, acceptance date and age declaration, referral code and, if any, the account that referred you.
2. Profile data: bio, location, instruments and the address (URL) of the profile picture you provide. We do not store the image file, only its address.
3. Sign in with Google: Google account identifier, e-mail address and name, received from Google when you choose that sign-in method.
4. Content: songs, lyrics, chords, notes, setlists, gigs, tours, bands, suggestions, votes, reminders and links you add.
5. Usage and security data: IP address, date and time of access, sign-in attempts, security events (password change, two-step verification turned on) and audit records of administrative actions.
6. Preferences: theme, language, Live Mode and interface settings, communication preferences and pinned items.
7. Communications: e-mails sent to you (verification, security, notices), notifications and messages you send to support.
8. Subscription and payment data: plan, billing period, subscription status, credits, redeemed promo codes, referrals and, for each payment, the amount, date, plan and any refunds, plus the customer, subscription and invoice identifiers at Stripe. Card details are entered directly on Stripe's payment page: Setlyst never receives or stores card numbers.

2.2Data saved for offline use stays in your own browser's storage and is erased when you sign out.

3.1We process personal data for the purposes below, with the corresponding legal bases of article 7 of the LGPD:

1. Creating and maintaining the account, authenticating you, providing the contracted service, syncing bands and generating exports: performance of a contract (art. 7, V).
2. Keeping access records (IP address, date and time) for 6 months, for security, fraud prevention and responding to requests from authorities: legitimate interest (art. 7, IX) and regular exercise of rights (art. 7, VI). The period uses article 15 of the Civil Rights Framework for the Internet as a benchmark; if an authority so requests, the records may be preserved for longer (art. 15, § 2).
3. Preventing fraud and abuse, limiting sign-in attempts, moderating usernames and profile pictures, keeping the platform secure and improving the service with aggregated statistics: legitimate interest (art. 7, IX), always respecting your rights and expectations.
4. Sending product news and offers by e-mail: consent (art. 7, I), which you can withdraw at any time.
5. Sending security communications and essential account notices: performance of a contract and legitimate interest.
6. Processing the subscription and payments: performance of a contract (art. 7, V). Keeping payment records to meet tax and accounting obligations: legal obligation (art. 7, II).
7. Defending rights in judicial, administrative or arbitration proceedings: regular exercise of rights (art. 7, VI).

3.2Automatic checks of usernames and images only flag cases for review. Any moderation measure is decided by a member of Staff, and you may ask for a review of decisions based on automated processing (art. 20 of the LGPD).

4.1We do not sell personal data. We share data only with processors that help us provide the service, under contract and following our instructions:

1. Render Services, Inc. (API hosting) and Neon (managed PostgreSQL database): store and process all platform data.
2. Vercel Inc.: hosts the website and web app and provides Vercel Web Analytics, which measures visits in aggregate and without cookies.
3. Resend, Inc.: delivery of transactional e-mails and of the communications you have authorised.
4. Google LLC: authentication, when you use Sign in with Google.
5. Google Cloud Vision (Google LLC), when enabled: may receive the address of a profile picture or band logo to classify inappropriate content. The feature is optional and is used only while it is enabled in the platform's configuration.
6. Stripe (Stripe, Inc. and its group companies): processes subscription payments. It receives your e-mail address, username and the payment details you enter on Stripe's payment page, and also processes them as an independent controller for fraud prevention and its own legal obligations, under Stripe's privacy policy.

4.2Data is also shared as a result of how you use the platform: members of your bands see the band's content and your username, and anyone who opens a public link sees the shared information, without lyrics, chords or your personal data.

4.3We may provide data to authorities when required by law or court order, within legal limits.

4.4Staff members only access your account's data and content when needed for support, moderation or security, in read-only mode, for a limited time and with an audit record, under a duty of confidentiality.

5.1Render, Neon, Vercel, Stripe, Google and Resend may store or process data outside Brazil, mainly in the United States. These transfers are based on article 33, IX, of the LGPD, as they are necessary to perform the contract with you (art. 7, V), and, where adopted by the processor, on the standard contractual clauses approved by the ANPD (art. 33, II, “b”, and ANPD Resolution CD/ANPD No. 19/2024).

6.1Retention periods are:

1. Registration, profile, preference and content data: while the account exists. After the account is deleted, they are erased, except as described below.
2. Access records (IP address, date and time): 6 months, based on legitimate interest and using article 15 of the Civil Rights Framework for the Internet as a benchmark; if an authority so requests, they may be preserved for longer. The exception is the IP address used to create the account, kept while the account exists to prevent referral program fraud (legitimate interest).
3. Audit records of administrative and security actions: for as long as needed to investigate incidents and defend rights, up to 5 years.
4. Items in the trash: 30 days; after that they are permanently deleted.
5. E-mails in the delivery queue: the content of sensitive e-mails (such as codes) is erased after sending, and delivery records are removed after 30 days.
6. Verification codes: expire in 15 minutes and are erased daily.
7. Database backups: up to 30 days, on rotation; deleted data disappears from backups at the end of that period.
8. Payment records (amount, date, plan and Stripe identifiers): for the period required by tax law, usually 5 years. When the account is deleted they are no longer linked to it, and the customer record at Stripe is deleted.
9. Records of acceptance of the terms and of consent (version, date, IP address): while the account exists and for 5 more years, as proof (art. 7, VI, and art. 8, § 2, of the LGPD).

7.1Under article 18 of the LGPD, you may request:

1. confirmation that processing takes place;
2. access to the data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
5. portability of the data to another provider;
6. deletion of data processed on the basis of consent;
7. information about the entities we share data with;
8. information about the possibility of not giving consent and its consequences;
9. withdrawal of consent;
10. review of decisions based solely on automated processing.

7.2You may also lodge a complaint with the National Data Protection Authority (ANPD).

8.1Many rights can be exercised directly in the platform:

1. Access and correction: in My account and in Settings.
2. Access and portability: in Settings, in the Data section, download the backup of your content and the file with all your personal data (profile, preferences, consents, subscription, payments and security log).
3. Consent to e-mails: adjust your preferences in Settings, in the Communications section, or use the unsubscribe link in the e-mails.
4. Deletion: delete your account in Settings.

8.2For other requests, write to suporte@setlyst.com.br from the e-mail address registered on your account. We may ask for additional information to confirm your identity. We reply within 15 days.

9.1Setlyst is a small-scale processing agent (ANPD Resolution CD/ANPD No. 2/2022) and, under its article 11, has not appointed a data protection officer (encarregado). The communication channel for data subjects and the ANPD is suporte@setlyst.com.br, under the responsibility of Allan Rigo Somensi.

10.1We adopt technical and administrative measures to protect personal data, as required by article 46 of the LGPD, including:

1. encryption in transit (HTTPS/TLS) on every connection;
2. passwords stored only as Argon2 hashes;
3. optional two-step verification (TOTP), with secrets encrypted at rest (AES-256-GCM) and recovery codes stored as hashes;
4. e-mail verification codes stored as HMAC with a limited number of attempts;
5. sign-in attempt limits and temporary account lockout;
6. role-based access control, least privilege and an audit log of Staff actions;
7. profile pictures loaded through our server, with validation, so your IP address is not exposed to third-party sites.

10.2No system is completely immune to failure. That is why we recommend a strong password and two-step verification.

11.1If a security incident occurs that may cause relevant risk or harm, we will notify the ANPD and the affected data subjects within 3 business days of becoming aware of the incident, under article 48 of the LGPD and ANPD Resolution CD/ANPD No. 15/2024, stating the nature of the affected data, the risks involved and the measures taken.

12.1Setlyst is intended for people aged 18 or over. Teenagers aged 16 and 17 may use the platform with the assistance of a legal guardian required by civil law. Teenagers' data is processed on the legal bases of article 7 of the LGPD, always in their best interest (article 14 of the LGPD and ANPD Statement CD/ANPD No. 1/2023), without profiling for advertising and with the most protective settings by default.

12.2At sign-up, you declare that you are 18 or over, or that you are 16 or 17 and have your legal guardian's authorisation. The platform is not intended for anyone under 16. If we identify an account belonging to someone under 16, or to a teenager without the required assistance, the account may be closed and the data deleted.

13.1We only use strictly necessary cookies (session, protection against cross-site request forgery, Sign in with Google, language, time zone and referral) and the browser's local storage for preferences and offline use. We do not use advertising or tracking cookies. Details in the Cookie Policy.

14.1This Policy may be updated to reflect changes in the service or the law. Relevant changes will be communicated by e-mail and in the platform at least 15 days before they take effect, together with a summary of what changed; previous versions remain available in this document's version history. Changes required by law, by an order of an authority or to fix a security flaw may take effect immediately. If you do not agree with the new version, you may export your data and close your account; if you have a paid plan in progress, you may cancel it with a pro-rata refund for the period not used. Exercising your rights as a data subject, including portability, does not depend on accepting the new version. General questions: suporte@setlyst.com.br.