Verseframe
Legal

Privacy Policy

Effective October 4, 2026

1. Who we are and scope

This policy explains how The Nerdic Coder, Business ID 3134083-3, a Finnish sole trader operated by Johan Axelsson (“Verseframe,” “we,” “us,” or “our”), handles personal data when you visit Verseframe, create an account, use the Studio, generate media, or contact us. The Nerdic Coder is the data controller for these activities. Contact us at [email protected].

2. Personal data we collect

  • Account data: user identifier, name, email address, profile image, sign-in status, and related authentication data supplied through Clerk.
  • Content and project data: audio, video, images, lyrics, fonts, file names, timing information, style choices, project names, generated outputs, and other material you submit.
  • Usage and technical data: service requests, IP address, browser and device information, timestamps, job identifiers and status, security events, error diagnostics, and server logs.
  • Analytics data, with your consent: Google Analytics collects information about website visits and interactions, including broad page categories, approved campaign sources, browser and device information, approximate location, and cookie identifiers used to distinguish visitors and sessions. We measure progress from account creation to your first MP4 download response and processing failures. Our analytics event parameters exclude emails, account identifiers, private filenames, lyrics, media, and raw page queries or referrers.
  • Billing data: account identifier, order and Stripe payment references, credit quantities and movements, amounts, currencies, timestamps, and refund or dispute status. Stripe collects payment and billing details through its hosted Checkout; we do not store full card numbers.
  • Communications: your email address, messages, attachments, job identifiers, and information in support requests, feedback, or showcase submissions.
  • Third-party media data: when a showcase thumbnail loads or you play an embedded video, YouTube may receive technical data such as your IP address, device information, and referring page.

We generally collect data from you, your browser or device, and our authentication and hosting providers. Do not upload personal data about another person unless you have a lawful basis and any permission needed.

3. Why we use personal data

  • Provide the service: create and authenticate accounts; accept uploads; transcribe, synchronize, render, store, display, download, duplicate, rename, and delete generations; maintain saved fonts, confirm credit purchases, and account for processing credits. This is necessary to perform our contract with you or take steps you request before entering it.
  • Secure and operate Verseframe: enforce limits, prevent abuse, investigate errors, maintain logs, recover jobs, and protect users, systems, and third parties. We rely on our legitimate interests in a reliable and secure service.
  • Understand website use, with consent: use Google Analytics reports to understand traffic sources, visits, and progress through creating a lyric video, and to improve the website and product experience. See section 7 for analytics choices and withdrawal.
  • Communicate: answer support requests, administer accounts, and send important service or legal notices, based on our contract, legitimate interests, or legal obligations as applicable.
  • Comply with law: respond to valid legal requests, establish or defend claims, and meet accounting, regulatory, or other legal duties.
  • With consent: feature a submitted public video or creator credit, or use data for another purpose explained when we ask for consent. You may withdraw consent at any time.

We do not sell personal data, use it for cross-context behavioral advertising, or use uploaded media or outputs to train general-purpose artificial-intelligence models. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

4. When we disclose data

We disclose personal data only as reasonably necessary to:

  • Clerk, for identity, authentication, and account management;
  • Stripe, for hosted Checkout, payment confirmation, tax, refund and dispute handling; when Managed Payments is used, Stripe acts as merchant of record under the terms and privacy information shown at Checkout;
  • Railway, for web application and PostgreSQL database hosting;
  • our private S3-compatible storage provider, for uploaded media, generated files, and saved fonts;
  • Modal, for background media processing in an EU region;
  • Google, for website usage measurement through Google Analytics;
  • YouTube/Google, when showcase thumbnails load or you play or follow a YouTube video;
  • professional advisers, authorities, courts, or other parties where required by law or reasonably necessary to protect rights, safety, and service integrity; and
  • a buyer, investor, or successor in a proposed or completed merger, financing, reorganization, or transfer of the service, subject to suitable safeguards.

Service providers process data for the services they provide to us and are subject to contractual and legal obligations. Public showcase material is visible to anyone.

5. International transfers

Some providers may process personal data outside Finland or the European Economic Area. Where the GDPR requires it, we use a European Commission adequacy decision, approved Standard Contractual Clauses, or another lawful mechanism, with supplementary safeguards where appropriate. Contact us for information about the mechanism relevant to your data.

6. Retention

We keep personal data only as long as needed for the purposes above:

  • account data is kept while your account is active and then for the period reasonably needed to complete deletion, meet legal duties, and resolve disputes;
  • generation metadata, source uploads, working files, and outputs are kept until you remove the generation, request account deletion, or the service applies a disclosed storage limit;
  • a saved font is kept until you remove it or your account is deleted; a copy used by an existing generation remains with that generation until it is removed;
  • support communications and security or error logs are kept only as long as reasonably needed to address the request, secure and improve reliability, and establish or defend legal claims; and
  • backup copies are deleted or overwritten on their normal rotation unless specific data must be preserved by law.

Deletion from active systems may not be immediate. We may retain limited information where law requires it or where necessary to prevent fraud, enforce agreements, or handle legal claims. We periodically review retention needs and delete or anonymize data no longer necessary.

7. Cookies, local storage, and external media

Verseframe uses technologies necessary to operate the service. A session cookie supports security features such as request-forgery protection, and Clerk uses cookies or browser storage to keep you signed in and protect your account. Your theme choice is stored locally in your browser. These technologies are used for functionality and security, not advertising.

Google Analytics 4 is disabled until you choose Accept analytics. Choosing Reject or leaving the choice unanswered prevents our Analytics tag from loading. Signing in, uploading, processing, and downloading remain available. You can change or withdraw your choice through Analytics settings in the footer; withdrawal stops further measurement, discards queued events, and removes our first-party Analytics cookies. It does not remove information previously sent to Google.

We remember your choice using the necessary verseframe_analytics_choice cookie for 180 days. If accepted, Analytics first-party cookies such as _ga and _ga_<container-id> distinguish visitors and maintain session information. Our tag requests a 180-day lifetime without renewal on each visit, subject to browser limits. See Google’s explanation of Analytics cookies. Our consent record and approved campaign context expire after 180 days. Queued event details are discarded after delivery, withdrawal, or 30 days; internal deduplication markers are retained for up to 14 months and are never sent to Google.

Your browser sends visit and technical information to Google when the Analytics tag runs. For visitors in the EU, Switzerland, and the UK, Google states that Analytics uses IP addresses to derive approximate location and then discards them without logging or storing them. Read Google’s regional Analytics privacy information, how Google uses information from sites that use its services, and Google’s Privacy Policy for more information.

You can also block analytics cookies through your browser settings. Google provides an Analytics opt-out browser add-on for supported browsers.

Showcase pages request thumbnails from YouTube. The player is not loaded until you choose to play a video, and it uses YouTube’s privacy-enhanced domain; YouTube may still use cookies or similar technologies and process data under Google’s privacy terms. You can avoid loading the player by not pressing play.

8. Security

We use measures intended to protect personal data, including authenticated access, owner-scoped authorization, private object storage, non-reversible owner-specific font paths, short-lived signed access, request-forgery protection, restricted worker access, and minimized error logging. No online service is completely secure. Keep independent copies of source media and use a strong, unique sign-in method.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing; receive a portable copy of data you provided; withdraw consent without affecting earlier lawful processing; and complain to a data-protection authority. In the EEA, you may complain to the authority where you live or work or where an alleged infringement occurred.

To exercise a right, email [email protected]. Describe your request and the account email concerned. We may ask for information reasonably needed to verify your identity and authority. We will respond within the period required by law. Some rights are limited, and we will explain if an exception applies. You may remove individual completed generations and saved fonts directly in the service.

10. Children

Verseframe is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided personal data contrary to this policy, contact us so we can investigate and delete it where appropriate.

11. Changes to this policy

We may update this policy when the service, providers, or legal requirements change. We will post the revised policy with a new effective date. If a change materially affects how we use personal data, we will provide reasonable notice through the service or by email where practical and seek consent when law requires it.

12. Contact

For privacy questions, requests, or complaints, contact:

The Nerdic Coder
Business ID 3134083-3
Långgrundsvägen 35
22220 Emkarby, Finland
[email protected]

Do not include passwords, authentication tokens, or unnecessary sensitive information in email.