Privacy Policy

LYRICS & BEATS / EVENTCANVAS AI – PRIVACY POLICY
Version: 2026-10-22.1
Last updated: 22 October 2026

WHO IS RESPONSIBLE
Odinn's Legacy CIC, company number 17452965, is the seller and data controller for the Lyrics & Beats shop and EventCanvas licence service.
Residential correspondence address: 14 Redvers Road, Chatham, Kent, ME4 5UU, United Kingdom. This is a residential correspondence address, not a retail or visitor premises.
Privacy contact: admin@odinnslegacy.co.uk. Website: https://lyricsbeats.uk.
This policy describes our processing. An independent customer's own event website has its own operator/controller and privacy notice.

PURCHASES, LICENCES AND SUPPORT
We process names, email and billing details, orders, payment status/references, correspondence, refund records, accepted terms and immediate-supply choices. We keep the accepted terms' version, UTC acceptance time and text with the order.
The licensing service stores the purchased product/order reference, licence status, bound website URL, issuance time, a hashed key for lookup and an encrypted key for authorised delivery. Your copy of Pro stores the entered key and validation results in its own WordPress database. Activation, checks and release send the key and your WordPress home URL to https://lyricsbeats.uk/wp-json/eventcanvas-licensing/v1/.
Licence requests do not send guest images, video, messages, creative content or AI keys to the licence server. We do not routinely monitor the creative content hosted on independent customer installations. This is not a claim that our own event pages store no guest content.
Our hosting and security systems may process IP addresses, request times and technical logs. The licence API uses the request IP for short-lived rate limiting. Do not send us passwords, payment-card details or AI secrets in support messages.

EVENTS HOSTED ON OUR OWN WEBSITE
If you submit a request, message or permitted media to an event hosted on lyricsbeats.uk, that website stores the submission, name, event association, uploaded files and any consent records. Approved display messages/media may be public, including through the display/feed; song requests are intended for the host, not the public display. The form's notice and the event host's instructions explain the intended use.
Submitting to a customer's separate site is controlled by that site's operator. We do not automatically receive that content through licensing. If a host shares content with us for support, we process what they actually provide and ask that unnecessary personal data be removed.

PURPOSES AND LAWFUL BASES
Contract: process orders, deliver downloads/keys, run activation and handle purchase-related support and refunds.
Legal obligation: maintain applicable accounting records and respond to lawful requests and consumer obligations.
Legitimate interests: proportionate fraud prevention, security, licence-service abuse prevention and resolving disputes. You may object to processing based on legitimate interests.
Consent: optional non-essential cookies/marketing where used and appropriate guest publication permissions. You can withdraw consent without affecting prior lawful processing. Accepting purchase terms is not consent to marketing.
We collect only information needed for the relevant purpose. Required checkout details are needed to fulfil the order; without them we may not be able to supply the purchase.

PAYMENTS, PROVIDERS AND SHARING
The payment provider selected at checkout processes payment details under its own privacy information. We do not store full payment-card numbers or card security codes. We may receive transaction identifiers, payer/contact details and payment/refund status.
Necessary data can be handled by our hosting, email, payment and technical-support providers, professional advisers or authorities where legally required. We do not sell personal information. Providers processing outside the UK may use their own international-transfer arrangements; where we arrange a restricted transfer, applicable safeguards are required.
Optional AI services receive the prompts/media sent to them by their users under those providers' policies. WhatsApp/Messenger contact buttons open the chosen provider; sending a message is the user's action. Those providers' processing is separate from local QR generation, which does not contact an outside QR service.

COOKIES AND SIMILAR TECHNOLOGIES
The shop uses necessary cookies/session storage for baskets, checkout, login and security. External embeds or payment services may introduce provider storage. Non-essential analytics/marketing cookies, if enabled, require appropriate information and consent before they are used where the law requires it. This policy does not itself install analytics or constitute cookie consent. Browser controls can restrict storage, but essential functions may stop working.

RETENTION AND SECURITY
We keep order, financial and contractual records as needed for legal obligations and dispute periods; UK business accounting records are generally retained for six years, or longer where a particular legal requirement or live dispute requires it.
We retain licence and activation records while needed for the no-expiry entitlement, transfers, refunds, support or abuse prevention. Releasing a site clears its active binding but is not deletion of the purchase record. We review support and security records and delete/anonymise them when no longer needed. Backups may retain older data until their normal replacement cycle.
Event content should be removed when no longer needed for the event or any specifically agreed purpose; contact the host or our privacy address to request removal. We do not promise that public material copied by others can be recalled.
We use access controls, HTTPS and appropriate key protection, but no system is risk-free. Keep your credentials private. A refund can revoke activation entitlement and cause Lite fallback; it does not erase customer content or cancel GPL rights.

YOUR RIGHTS AND COMPLAINTS
Subject to applicable conditions, you can request access, correction, erasure, restriction, portability, or object to processing. Some records must be retained for legal reasons, so erasure is not unconditional. You can withdraw consent where it is the basis of processing. We may need proportionate identity information before disclosing records.
Contact admin@odinnslegacy.co.uk. We aim to respond within the applicable data-protection deadline, normally one month. If unresolved, you can complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or another competent supervisory authority.
We do not use licence validation to make solely automated decisions with legal or similarly significant effects without a route to human review. If access is incorrectly refused or revoked, contact us to review it. No marketing opt-in is inferred from purchasing.

Changes apply from their stated date; the purchase terms accepted for an existing order are retained separately. Contact us for an accessible or saved copy.