Privacy Policy

Who We Are

Compose:EP is made by Veridem Holdings Inc., a Delaware C-Corporation. If you have any question about this policy or your data, email hello@getveridem.com.

How You Sign In

You can sign in with an email and password, an emailed magic link, Google, Apple, or as a guest. With Google or Apple, we receive your email address and a basic account identifier from them — never your password. A guest account has no email attached. Guest work is saved to that guest session only; if you sign out or clear your browser, we have no way to reconnect you to it.

What We Collect and Why

• Account: your email address and an artist name (to sign you in and label your work).
• Songs and releases: song titles, lyrics, style notes, BPM, length, tracklist order, release titles, and AI critiques you run (to build your EP).
• Cover art and prompts: the style, mood, palette, and other choices you make, generated or uploaded cover images.
• Mood Board and Video Board: images you upload, short voice notes ("MicChecks"), song clips (3–30 seconds), board layouts, and rendered videos you export.
• Scene prompts: the treatment and scene choices you enter in the video prompt builder.
• Handprint attestation: your legal name and citizenship if you complete the Arranger step, and the signature record created when you sign.
• Co-arrangers: names, roles, and email addresses you enter so we can send them a co-sign link. A co-arranger who signs may add a short voice recording and a digital signature.
• Usage counts: a record of each AI feature use, used only to enforce plan limits.
• Billing status: your plan, subscription status, and renewal date (see Payments).
• Label Access requests: if you submit one, your name, email, and message are sent to our internal team chat (Slack) so we can reply.

We do not sell your information and we do not use it for advertising.

AI Processing

When you use an AI feature (song critique, release sequencing, cover-art prompts or images), the text or choices needed for that request are sent through Lovable's AI gateway to Google's Gemini models. We keep the result you save, plus a count that the feature was used. We do not save a separate copy of the request itself. These providers process requests under their own terms and may keep limited logs for security and abuse prevention. The Help read-along voice uses ElevenLabs, but only for our own fixed Help text — none of your content is sent there. The video prompt builder writes prompts on its own; it does not send your scenes to an AI service.

Video Rendering

When you export a video, the images, song clip, and text on your Video Board are sent to Shotstack, a video rendering service, which builds the video file. The finished video is saved to your Video Locker.

Payments

Paid plans are handled by Stripe. Stripe collects and stores your card details — we never see or store your card number. We store your Stripe customer ID, subscription ID, plan, status, and renewal date so we know which features to unlock.

Collaborator Co-Signing

When you invite a co-arranger, we email them a private link. When you enter someone's information, you are telling us you have their permission to do so. Their name and signature become part of the release's Handprint record.

The Veridem Authorship Registry

When you sign a Handprint (or finalize a scene project), Compose:EP sends three things to the Veridem Authorship Registry: the creator name you signed with, the title of the work, and the product name. The Registry issues a certificate ID. Certificate IDs are publicly verifiable — anyone who has one can confirm it exists. The full record only unlocks with the certificate's private verification token or QR code. Your email, lyrics, uploads, and catalog are not sent.

Registry entries are permanent by design and are not removed when you delete your account. For more on how the Registry works, see the getveridem.com Privacy Policy.

What We Share With MHAIX

MHAIX is a sister Veridem product. If you use MHAIX with the same email, it can ask Compose:EP for your release list: release title, release date (if you set one), track titles in order, and whether the release has a signed, registered Handprint. Nothing else is shared — no cover art, visual choices, lyrics, or uploads.

Cookies, Browser Storage, and Analytics

We do not use advertising or tracking cookies. Your browser stores your sign-in session and a few small settings (for example, whether you've dismissed a tip, and backup copies of in-progress work) so the app works. We use Cloudflare Web Analytics to count page visits; it is designed not to use cookies or build profiles of individual visitors.

Other Services We Rely On

Your data is stored with our hosting and database provider (Lovable Cloud). We also use Stripe (payments), Shotstack (video rendering), Lovable's AI gateway and Google (AI), ElevenLabs (Help narration only), our email delivery provider (sign-in and invite emails), Slack (Label Access requests), and Cloudflare (analytics). Each only receives what it needs to do its job.

Storage and Security

Your data is tied to your account and protected so other users cannot read it. Uploaded Mood Board images, voice notes, song clips, and videos are private and opened with short-lived links. Cover-art images are stored at a public web address: anyone with the exact link can view one.

How Long We Keep Data

We keep your data for as long as your account exists. One exception: a Mood Board draft that hasn't been touched for 30 days and was never finalized may be deleted automatically, along with its uploaded images. Our service providers may keep their own backups and logs for a limited time under their own policies.

Deleting Your Account

You can delete your account from within the app. We then permanently erase your login, profile, and all unfinalized work — songs, draft releases, Mood Boards, uploaded images, voice notes, song clips, and cover art files. This cannot be undone.

Signed Handprint certificates are kept rather than deleted. They are disconnected from your account and stripped of contact details, but the certificate itself stays intact so the authorship record remains verifiable. The matching Registry entry also stays. If you have an active paid plan, deleting your account cancels your Stripe subscription immediately, so you won't be billed again.

Your Rights

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it by emailing hello@getveridem.com.

Children

Compose:EP is not directed to children under 13, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

Changes

We may update this policy as Compose:EP changes. We will update the "Last updated" date above when we do.

Contact

Veridem Holdings Inc. · hello@getveridem.com