Skip to content
Lystrela

Privacy Policy

Last updated: July 31, 2026

This policy explains what data Lystrela processes, why, who it is shared with, how long it is kept, and the choices you have. Lystrela is currently an invitation-only alpha.

1. Scope and operator

Lystrela is operated by Nebojša Smrzlić PR Kaltech Software (“Lystrela”, “we”), based in the Republic of Serbia. This policy covers the Lystrela website, the songwriter dashboard, published public portfolio sites, and private pitch links. Full operator and contact details are at the end of this page.

2. What data we process

Account and workspace

  • Your login email and an encrypted password, managed by our authentication provider.
  • Your workspace, membership role, language preference, and onboarding state.
  • An invitation record used to grant access during the alpha.

Content you create

  • Songs, lyrics and their revision history, discography credits, tags, and song status.
  • Optional audio demos you upload, stored in private storage.
  • Public portfolio details you choose to publish (display name, bio, genres, public email, social link, featured works).
  • Contacts you record and notes about them, and pitch and share-link history.

Messages and requests

  • Public contact-form inquiries submitted to a songwriter site (name, email, message).
  • Early-access requests submitted from our landing page.
  • Account-deletion requests you submit.

Technical and engagement data

  • When a private link is opened or a demo is played, we record engagement events with a pseudonymized identifier derived from the visitor’s IP address (the raw IP address is not stored), the browser’s user-agent string, and a pseudonymized session identifier.
  • These identifiers do not identify a named recipient, but they are technical data about a person and are treated as personal data here.
  • Necessary cookies (see section 6).

3. Why we process it and on what basis

We process data to run the service you asked for and to keep it working and safe:

  • To provide the account, dashboard, portfolio, and private-link features - to perform our agreement with you and take steps you request.
  • To send operational email (notifications, confirmations) - to perform our agreement with you.
  • To keep the service secure, prevent abuse, and enforce access and rate limits - our legitimate interest and, where applicable, a legal obligation.
  • To respond to inquiries, support, and rights requests - to perform our agreement with you and comply with the law.

Where the law requires your consent for a specific processing activity, we ask for it and you can withdraw it. We do not treat consent as the default basis for the processing above.

4. Public portfolio vs private pitch

Your public portfolio shows only what you mark as public. Private songs, private lyrics, and private demos are never shown there. A private pitch link is not publicly listed, but anyone with the link can open it and may forward it - we cannot guarantee access only by the intended recipient.

5. Opens, Qualified listens, and access sessions

An Open is counted once per short access session when a private link is opened. A Qualified listen is a client-reported playback event, recorded at most once per song per session, after forward playback crosses a threshold (at least 10 seconds, normally about a quarter of the demo, never more than 30 seconds).

When a private link is opened we set a signed session cookie that lasts up to 30 minutes and is scoped to that link, used to count one Open per session, to de-duplicate listens, and to authorize demo playback. This is pseudonymized technical data - it does not identify a named recipient, prove attention, or track anyone across other sites. Previewing your own link records nothing.

The session cookie is also scoped to the single web address the link was opened on. A workspace on its own custom domain can have links on more than one address, and opening the same link on two different addresses creates two separate sessions - so the same person may be counted as two Opens. We do not link sessions across addresses: doing so would require an identifier that follows a recipient between sites, which we deliberately do not create.

6. Cookies and necessary storage

We use only first-party cookies and local storage necessary for the service: keeping you signed in, remembering your language, running the private-link access session, confirming a PIN, and the invitation claim. There are no advertising or cross-site tracking cookies and no third-party analytics, so we do not show a cookie consent banner. This assessment reflects the current service and may be revisited.

7. Email and public forms

Contact-form inquiries and early-access requests are stored so they are not lost if email fails, and are used to reply to you. We keep delivery metadata (whether and when a notification was sent, and any error). Message content is delivered through an email provider; Lystrela does not store a separate copy of the delivered email body beyond the request record itself.

8. Service providers

We rely on a small set of providers that process data on our behalf:

  • Supabase - authentication, database, and private file storage.
  • Vercel - hosting, delivery, and operational logs.
  • Hostinger - our current platform email and mailbox provider.
  • For email sent from your own workspace, an SMTP provider you configure in your settings.

We do not use advertising networks, third-party analytics, or tracking SDKs.

9. Where processing happens

Our providers may process and store data on infrastructure located in or outside the Republic of Serbia. Where data is transferred across borders, we rely on the provider’s applicable safeguards and configuration. We do not state specific regions or transfer mechanisms here that we cannot confirm; contact us for current details.

10. Retention and deletion

  • Workspace content (songs, contacts, pitches, links, events) is kept while your workspace exists. Archiving organizes history; it is not deletion.
  • Public contact inquiries are kept while the workspace needs them to communicate, and can be deleted individually by an authorized workspace user.
  • Early-access requests are kept while the program is active and for up to 90 days after it ends, unless deleted earlier or longer retention is needed for a specific request, abuse issue, or legal claim.
  • Account-deletion requests are kept only as long as reasonably necessary to process and document the request, resolve disputes, and meet legal obligations, after which identifying fields are deleted or anonymized.
  • Necessary cookies expire on their own (the access session within 30 minutes).

Limited residual copies may temporarily remain in provider backups and operational logs until standard retention cycles expire, after which they are overwritten or deleted according to provider operation and configuration. We cannot promise immediate deletion from every backup or log.

11. Your rights and how to ask

Subject to applicable law, you may ask to access, correct, delete, or receive a copy of your data, to restrict or object to certain processing, to withdraw consent where consent is used, and to be informed about processing. You may also lodge a complaint with the competent supervisory authority for personal data protection.

Send requests to privacy@lystrela.com. We may need to verify your identity before acting. We aim to respond without undue delay and ordinarily within 30 days, with a possible extension for complex requests. We do not currently offer a self-service data export.

Privacy and data requests: privacy@lystrela.com

12. Security and its limits

We apply reasonable technical and organizational safeguards, including server-side authorization, signed private-link access, and encryption of sensitive stored secrets. No online service can be perfectly safe, and we cannot promise that a shared link will reach only the person you intended.

13. Age

Lystrela is intended for users aged 18 or older. It is not directed at children.

14. Changes to this policy

We may update this policy as the service evolves. The effective date at the top of the page reflects the latest version. Material changes will be reflected here.

15. Contact and operator

For privacy questions, contact us at privacy@lystrela.com. Full operator details are shown below.

Operator

Operated by
NEBOJŠA SMRZLIĆ PR KALTECH SOFTWARE
Registration number (Matični broj)
65275791
Tax ID (PIB)
111233739
Registered seat
Grocka, City of Belgrade, Republic of Serbia

The operator’s full registered address is recorded in the public register maintained by the Serbian Business Registers Agency and may be provided where necessary for exercising legal rights or complying with applicable law.