Privacy Policy

Information You Provide to Us

• Account and authentication information, such as your name and email address, including when you sign in using a third-party provider such as Google or Apple;
• Transaction and billing information when you make a purchase; payments are processed by our payment processors (such as Square on the web, and Apple for in-app purchases), which handle your payment card details (we receive confirmation and limited transaction information, not your full card number);
• Communications and support requests, including the contents of messages and feedback you send us; and
• Any other information you choose to provide.

Information We Collect Automatically

• Device and technical information, such as device or browser type, operating system, language and region, and app or site version;
• Log and usage information, such as pages and screens viewed, features used, referring pages, and interactions;
• Cookies and similar technologies on our websites (see “Cookies” below), and identifiers used for analytics and fraud prevention;
• Approximate location derived from your IP address. Our websites and games do not collect precise location. Lyric Ai collects precise location only when you allow it, as described in Part 2; and
• Diagnostic and performance information used to keep the Services stable and secure.

Information From Third Parties

We receive information from authentication providers (such as Google and Apple), payment processors (such as Square and Apple), and analytics and advertising partners, consistent with their policies and your settings.

• Provide, operate, maintain, secure, and improve the Services;
• Create and manage accounts and authenticate users;
• Process and validate transactions and purchases;
• Measure and understand how the Services are used through analytics;
• Communicate with you, including responding to inquiries and sending service-related messages;
• Detect, investigate, and prevent fraud, abuse, and security incidents; and
• Comply with legal obligations and enforce our agreements.

Our websites use cookies and similar technologies for essential functionality, security, and analytics. You can control cookies through your browser settings; disabling some cookies may affect functionality. Where required, we obtain consent for non-essential cookies.

We use analytics providers (such as Cloudflare and, in our apps, Google Firebase/Google Analytics) to understand usage.

We do not sell personal information for money. We disclose personal information:

• To service providers and processors who perform services on our behalf (such as hosting and content delivery, payment processing, authentication, analytics, and support), under contracts that limit their use of the information;
• To comply with law, enforce our terms, or protect the rights, safety, and security of our users, the public, or Dominion Labs;
• In connection with a merger, acquisition, financing, reorganization, or sale of assets; and
• With your consent or at your direction.

• Account: review and update your information, or request deletion, by contacting us;
• Communications: opt out of non-essential emails via the unsubscribe link or by contacting us;
• Cookies: control cookies through your browser; and
• Access and deletion: contact us to exercise the rights described in Part 4.

We keep personal information for the periods set out in our Data Retention Policy, which lists each category of information, how long we keep it, and how we destroy it. When a period ends, we delete the information or make it anonymous.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction, appropriate to its sensitivity. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Services are not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect their personal information. Lyric Ai is available only to people 18 and older. If you believe a child has provided us personal information, contact us at [email protected] and we will take appropriate steps to delete it.

Dominion Labs is based in the United States, and we and our service providers may process personal information in the United States and other countries whose data-protection laws may differ from those in your country. Where required, we implement appropriate safeguards for such transfers, as described in Part 4.

The Services integrate and link to third-party services (such as authentication, payments, advertising, analytics, and app stores). This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Services after changes become effective constitutes acceptance of the revised Privacy Policy.

For questions or requests regarding this Privacy Policy or your personal information, contact us at [email protected].

Depending on your plan and settings, Lyric collects information from:

• What you give it directly: messages, files, instructions, feedback, and answers to its questions;
• Services you connect: such as email, calendar, contacts, files, messaging, and work tools, within the permissions you grant when you connect them;
• Devices you connect: device type and settings and, where you allow it in your device settings, the device’s precise location, including while the app is closed;
• Listening: on Lyric Pro, Lyric Max, and Lyric Enterprise, where you turn it on, speech addressed to Lyric by name. Other audio is processed as it arrives and is not stored;
• Camera and images: images and video you share with Lyric or allow it to see; and
• Your use of the platform: the tasks, workflows, projects, approvals, and settings you create.

From this information Lyric builds your context: its working understanding of your commitments, schedule and routines, the places you go, the people and organizations in your life, and the preferences it has learned, with the evidence each rests on. Lyric uses your context only to do its work for you.

Your context includes information about people who appear in your connected services or conversations, who have no agreement with us. We use it only to provide Lyric to you.

Precise location, voice templates, and any sensitive information contained in your connected services are used only to provide the Services you request. We do not use sensitive information to infer characteristics about you for any other purpose. Voice templates are created only with written consent, and Lyric does not create voice or face templates of people who have not consented. We never sell precise location or biometric information.

Lyric records every action it takes for you, including what it perceived, what it decided and why, what it did, and the result. You can review these records under Activity.

If your organization provides your account, or you link your account to your employer’s, your Work context belongs to the organization. Its administrators can manage your account and access your Work context and activity records under the organization’s own policies, and we process that information on the organization’s behalf. When you sign in through your organization’s single sign-on, its identity provider shares your name, email address, and role or group information with us, and we record each sign-in for security.

While shared learning is on, Lyric may add to its general knowledge how it carried out tasks, actions, projects, and workflows, what succeeded or failed, how it overcame failures, and what the work required. This never includes your context or anything that identifies you or your organization. You control shared learning under Settings › Context and privacy. Turning it off stops future contribution and does not stop Lyric learning for you. For government and defense deployments, shared learning is off unless the organization turns it on.

In addition to the uses in Part 1, we use Lyric information to:

• Provide Lyric’s work for you: build and keep your context, carry out tasks and actions within your settings, and keep activity records; and
• Improve Lyric through shared learning while it is on, which never includes your context.

In addition to the disclosures in Part 1, we disclose Lyric information:

• To the people and services Lyric contacts on your behalf, at your direction and within the permissions you set; and
• To your organization, if it provides your Lyric account or you link your account to it.

We do not use your Lyric context for advertising, and we do not sell it.

Lyric Ai is an artificial intelligence system. We tell you when you are interacting with Lyric, and Lyric identifies itself as an AI system when it communicates with other people on your behalf. Lyric is not designed to make decisions that have legal or similarly significant effects on you without human review.

• Disconnect services and devices under Connectors;
• Set Lyric’s operating mode and action boundaries under Settings › Autonomy;
• Control shared learning under Settings › Context and privacy;
• Turn off location, listening, or camera access in your device or Lyric settings; and
• On Lyric Starter, Lyric Pro, and Lyric Max, delete items from your context or delete your account. Work context is managed by your organization.

Lyric information is kept for the periods in our Data Retention Policy. Among them: a context item you delete leaves Lyric’s use at once and is permanently deleted within 30 days; raw location points are kept for 90 days; and activity records are kept for 1 year.

In our mobile games, we and our advertising partners collect advertising identifiers (such as the IDFA, where you grant permission through Apple’s App Tracking Transparency prompt) and ad-interaction data.

In our games, we serve, mediate, measure, and, where permitted, personalize advertising.

Our games are supported by advertising and use AppLovin MAX to mediate ads across networks that may include AppLovin, Google AdMob, Unity Ads, Meta Audience Network, Mintegral, Liftoff/Vungle, DT Exchange, InMobi, Chartboost, and Ogury. Advertising partners receive identifiers and ad-interaction data to serve and measure advertising; depending on your jurisdiction, some of this activity may be considered “sharing” or a “sale” for cross-context behavioral advertising (see Part 4).

On Apple devices we request permission through App Tracking Transparency before using the IDFA for cross-app tracking; if you decline, we and our partners will not use the IDFA to track you across apps and websites, and you may receive less relevant (contextual) advertising. You can control ad personalization through App Tracking Transparency, your device’s advertising settings, and our partners’ opt-out mechanisms.

Legal Basis

Where the EU or UK General Data Protection Regulation or the Swiss Federal Act on Data Protection applies, we process personal information on the following legal bases:

• Consent: for advertising identifiers, personalized advertising, non-essential cookies, and non-essential analytics, and in Lyric Ai for precise location, listening, and voice recognition; you may withdraw consent at any time;
• Performance of a contract: to provide the Services and process the transactions you request, including building your Lyric context and carrying out actions within your settings;
• Legitimate interests: to secure and improve the Services, prevent fraud and abuse, perform essential/aggregated analytics, serve non-personalized advertising, keep security logs and activity records, and improve Lyric through shared learning, where not overridden by your rights;
• Legal obligation: to comply with applicable law.

You have the rights to access, rectify, erase, restrict, and object to processing, to data portability, and to withdraw consent, as provided by applicable law.

International Transfers

When we transfer personal information out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and the Swiss addendum, or another lawful transfer mechanism. You may request a copy at [email protected].

Supervisory Authorities

You have the right to lodge a complaint with your local supervisory authority: in the UK, the Information Commissioner’s Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EEA, the authority in your country of residence. We would appreciate the chance to address your concerns first at [email protected].

Depending on your state of residence (for example, California, Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws), you may have the following rights, subject to applicable law and exceptions.

Additional Rights

• The right to know and access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it;
• The right to delete personal information we collected from you;
• The right to correct inaccurate personal information;
• The right to data portability.

Right to Opt Out of Sale/Sharing

We do not sell personal information for money. However, our use of advertising identifiers and ad-interaction data for cross-context behavioral advertising in our games may be considered a “sale” or “sharing” under certain U.S. state laws. You may opt out by declining Apple’s App Tracking Transparency prompt, disabling personalized ads in your device settings, and transmitting an opt-out preference signal such as Global Privacy Control (GPC) where supported. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive Personal Information

Some state laws treat precise geolocation and biometric information as sensitive. We collect precise location only with your opt-in permission and use it only to provide the Services you request. We collect voice templates only with your written consent. We do not sell precise location or biometric information, and we do not use sensitive personal information to infer characteristics about you.

Authorized Agents

You may use an authorized agent to submit a request on your behalf. We may require proof of your written authorization and may require you to verify your identity directly with us.

Non-Discrimination

We will not discriminate against you for exercising your privacy rights, including by denying goods or services, charging different prices, or providing a different level or quality of service, except as permitted by law.

Appeals

If we decline to act on your request, you may appeal by contacting us at [email protected] with the subject line “Privacy Appeal.” We will respond within the period required by applicable law. If your appeal is denied, you may contact your state attorney general.

If you are in Brazil, the General Data Protection Law (LGPD) applies to our processing of your personal data.

Legal Basis

We process personal data under the legal bases set out in the LGPD, including your consent, the performance of a contract or preliminary procedures, compliance with a legal or regulatory obligation, and our legitimate interests, balanced against your rights and freedoms.

International Transfers

We may transfer your personal data to countries outside Brazil, including the United States. Where we do, we implement transfer mechanisms and safeguards recognized under the LGPD, such as your consent, contractual clauses, or another lawful basis.

Additional LGPD Rights

• Confirmation of the existence of processing and access to your data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
• Portability of your data to another provider;
• Deletion of personal data processed with your consent;
• Information about the entities with which we have shared your data;
• Information about the possibility of refusing consent and its consequences; and
• Withdrawal of consent.

You may exercise these rights at [email protected], and you may also contact the National Data Protection Authority (ANPD).

If you are in the Republic of Korea, the Personal Information Protection Act (PIPA) applies.

Legal Basis

We process personal information based on your consent and as otherwise permitted by PIPA, including as necessary to perform a contract with you and to comply with legal obligations.

Outsourcing (Entrustment) of Processing

We entrust the handling of certain personal information to service providers so we can operate the Services, including hosting and content-delivery providers (e.g., Cloudflare), payment processors (e.g., Square), authentication providers (e.g., Google and Apple), analytics providers, and advertising and mediation providers (e.g., AppLovin and its mediated networks). We require these entrustees to handle personal information safely and only for the entrusted purposes, and we supervise them as required by PIPA.

International Transfers

Where we transfer personal information overseas (for example, to the United States) for the purposes described in this Policy, we provide the items transferred, the country and timing/method of transfer, the recipient and its contact, the recipient’s purposes and retention period, and, where required, obtain your consent. Contact [email protected] for details.

Additional Rights Under PIPA

• The right to request access to your personal information;
• The right to request correction or deletion;
• The right to request suspension of processing; and
• The right to withdraw consent.

Destruction of Personal Information

When personal information is no longer needed because the retention period has elapsed or the purpose of processing has been achieved, we destroy it without delay. Electronic files are deleted by a method that prevents recovery, and printed materials are shredded or incinerated.

If you are in Japan, the Act on the Protection of Personal Information (APPI) applies.

International Transfers

We may provide personal information to third parties located in foreign countries (including the United States) for the purposes described in this Policy. Where required by the APPI, we obtain your consent and/or ensure that recipients implement measures equivalent to those required under the APPI, and we will provide information about such measures on request.

Additional APPI Rights

• The right to request disclosure of your retained personal data;
• The right to request correction, addition, or deletion; and
• The right to request cessation of use or third-party provision.

Security Management Measures

We take organizational, human, physical, and technical security management measures to protect personal information, including internal policies and responsible personnel, employee guidance, access controls to devices and systems, and technical safeguards against unauthorized access and malware.