Privacy Policy of LalaLearn

Version 1.1 — Effective from July 8, 2026

This English version is provided for reference purposes only. The legally binding version of this document is the Spanish version. In case of any discrepancy, the Spanish version shall prevail.

At LalaLearn we take privacy seriously. This Privacy Policy explains what personal data we process, for what purpose, on what legal basis, with whom we share it and what rights you have in relation to your data.

This Policy applies to all Users of the service offered through https://lalalearn.ai and forms an integral part of the Terms and Conditions.

⸻

1. Data Controller

The controller for the processing of your personal data is LalaLearn (hereinafter, "LalaLearn", "we" or "the Controller").

Email for general contact and privacy inquiries: legal@lalalearn.ai
Address for notification purposes: Avenida de Madrid 31, Madrid, Spain

LalaLearn has not appointed a Data Protection Officer (DPO), as the cases of mandatory designation under article 37 of Regulation (EU) 2016/679 (hereinafter, "GDPR") do not concur. LalaLearn will periodically review this circumstance and will proceed to the designation when legally appropriate.

⸻

2. Personal data we process

Depending on your use of the Service, we may process the following categories of personal data:

2.1. Account and authentication data

Login identifiers managed through our authentication provider (email, name, unique identifier, language, country, city, username and, where applicable, profile picture).
Technical account and session identifiers.
Account status and configuration preferences.

2.2. Usage and technical data

Service usage events (song creation, plays, downloads, share actions, interactions with the interface).
Security and performance logs (IP address, timestamp, device and browser, errors, user agent).
Technical device identifiers used for simultaneous use detection, fraud prevention and rate-limiting.

2.3. Contributed content and generated results

Texts, notes, prompts, images, titles and other materials you contribute to generate content.
Metadata associated with your songs (title, status, technical identifiers).
Results generated by the Service (lyrics, audios, voices, images) and stored in your library.

2.4. Payment data

Payment status, amount, currency, transaction identifier and product purchased.
We do not store bank card data: it is processed directly by our payment processing provider.

2.5. Creator Program data (where applicable)

When the User voluntarily participates in the Creator Program described in the Terms:

Accumulated balance, accrued rewards, conversions, collection requests and payments made.
Account identifier of the payment processor (not full bank data, which are managed by said processor).
Identifying and tax data necessary for compliance with legal obligations applicable to operators of digital platforms (including, among others, tax identification number, fiscal address and, when legally appropriate, other data required by the regulations transposing Directive (EU) 2021/514).
Data verified by the payment processor for KYC purposes (identity verification), accessible through the processor and retained by LalaLearn only to the extent strictly necessary for the management of the Program and compliance with legal obligations.

2.6. Audit data and legal traceability

Version of the Terms and Policy accepted, with date, time, IP address and user agent.
Technical record of informed decisions (for example, account deletion with awareness of balance loss, waiver of the 14-day right of withdrawal in Credit purchases).
Snapshots of Creator Program balance for reconciliation and audit purposes.

2.7. Communications

Content of the messages you send us (inquiries, complaints, abuse reports) and associated contact data.

2.8. Demographic and profile data (when applicable)

When applicable, we collect the User's declared date of birth and gender. This data is processed for: (a) minimum age validation (14 years) per the LOPDGDD; (b) analytics segmentation and non-discriminatory personalization; (c) compliance with minor protection regulations.

The User may also voluntarily provide their level of studies, field of study, public examination or degree of interest, learning objectives and country, which we use to personalise the experience, adapt content and analyse use of the Service on an aggregated, segmented basis. Where applicable, this data may be used to determine eligibility for Service programs, such as the referral program.

Audit data for the Referral Program (applied codes, reward flow events and the associated IP address) is retained for 24 months from creation. After that, it is automatically deleted via a scheduled monthly process.

In addition, we record the IP address when your account is created and when you apply a referral code, solely to prevent abuse of the Referral Program (for example, farms of accounts created to accumulate rewards). The legal basis is legitimate interest (Art. 6(1)(f) GDPR, balancing test described in the "Legal basis for processing" clause). This information is accessible only to the administration team for fraud-investigation purposes, is retained for at most 24 months, and is deleted when you delete your account.

⸻

3. Purposes of processing

We process your data for the following purposes:

Purpose	Description
Service provision	Create and manage your account, allow you to generate songs, store content, share and download, offer the functionalities of the Service.
Payment and credit management	Process purchases, allocate and deduct Credits, manage refunds where applicable.
Creator Program	Calculate valid reproductions, attribute rewards, execute payments and conversions, prevent fraud and apply the rules of the program.
Security and anti-fraud	Prevent, detect and investigate abusive, fraudulent, automated or unlawful uses of the Service; apply rate limits; preserve technical integrity.
User support	Address inquiries, complaints and incidents.
Legal compliance	Comply with applicable legal obligations, address requirements from authorities, manage rights infringement and abuse reports, keep evidence of acceptance of Terms and of informed decisions with specific consequences.
Operational communications	Send essential communications about the operation of the Service, changes to Terms and Policy, security notices.
Measuring our communications	Recording the delivery, first open and first click of the emails we send you, to confirm they arrive, detect delivery issues and improve their content and frequency.
Service improvement	Analyze the technical operation to correct errors and improve the experience, on the basis of aggregated or pseudonymized data.

⸻

4. Legal basis for processing

We process your personal data on the following legal bases of article 6 of the GDPR:

Performance of contract (art. 6.1.b GDPR): to provide you with the Service, manage your account, process your payments and, when you participate in the Creator Program, calculate and pay the accrued rewards.
Legitimate interest (art. 6.1.f GDPR): to ensure the security of the Service, prevent and detect fraud and abuse, technically improve the platform, analyze use in aggregate form, measure the delivery, opens and clicks of our email communications, retain evidentiary records of acceptance of Terms and of informed decisions (account deletion, withdrawal waiver), and protect our rights in eventual claims. We have carried out the corresponding balancing test: the processing is proportionate, minimally intrusive, responds to reasonable expectations of the User in the context of a digital platform and is essential for the legitimate functioning of the Service. We consider that these interests are not overridden by your rights and freedoms.
Consent (art. 6.1.a GDPR): for non-essential processing —when we implement them— such as analytical or marketing cookies, or the sending of commercial communications. You may withdraw your consent at any time, without affecting the legality of the prior processing.
Compliance with legal obligation (art. 6.1.c GDPR): to retain the information that legislation requires us (accounting, tax, reporting obligations to authorities, judicial requirements, duties arising from regulations on operators of digital platforms).

LalaLearn does not make automated individual decisions with significant legal effects on the User, within the meaning of article 22 of the GDPR. The automated measures of the anti-fraud system are complemented with human review before adopting definitive decisions affecting significant balances or the continuity of the account.

⸻

5. Recipients and processors

To operate the Service we rely on specialized providers acting as processors under our instructions, with whom we have signed or will sign the corresponding agreements pursuant to article 28 of the GDPR:

Category	Function
Authentication and identity	Account, login and session management.
AI content generation	Processing of inputs and return of Results.
Payment processing	Collections and, where applicable, transfers of the Creator Program, including KYC verification.
Infrastructure and hosting	Hosting, database, object storage, observability and logging.
Email communications	Sending of transactional and operational notifications.

LalaLearn will provide the User, upon reasonable request through the contact channel, the updated list of sub-processors and the essential information about the processing.

LalaLearn does not sell personal data to third parties.

LalaLearn may communicate data to public authorities, courts, tribunals or third parties when there is a legal obligation or legitimate requirement.

⸻

6. International transfers

Some of our providers may process personal data outside the European Economic Area. In such cases, we adopt the adequate guarantees provided in Chapter V of the GDPR, in accordance with the instrument applicable in each case, which may include:

Adequacy decisions of the European Commission, when available for the receiving country or regime at the time of the transfer;
Standard contractual clauses approved by the European Commission;
Other guarantees recognized by the GDPR, supplemented with technical, contractual or organizational supplementary measures as appropriate following the corresponding impact assessment.

You may request a copy of the applicable guarantees through the contact channel.

⸻

7. Retention

We retain personal data for the following periods:

Account data: while the account is active. After voluntary deletion, the data is deleted or anonymized within a maximum of thirty (30) calendar days from confirmation, except for legal retention obligations.
Contributed content and Results: while they are in your library or until you request their deletion, except for legal obligation or need to defend against claims.
Security and anti-fraud logs: up to twenty-four (24) months, extendable if there is an open investigation or evidence need.
Tax and accounting data: for the legally required periods (in general, at least four years from accrual in accordance with the General Tax Law, extendable to six years in accordance with the Commercial Code).
Creator Program data and reporting obligations: for the periods required by the regulations applicable to digital platform operators and, in general, ten (10) years when the regulation transposing Directive (EU) 2021/514 applies.
Evidence of acceptance of Terms and Policy and records of informed decisions: while the User is a customer and, subsequently, during the limitation period of the actions derived from the contractual relationship.
Support communications: up to twenty-four (24) months after the closure of the incident.
Email delivery and measurement records: measurement markers (opens, clicks and delivery) and your email address are deleted at most twenty-four (24) months from sending; we keep only a minimal record of which essential communications we have sent you, so we do not repeat them. When your account is deleted, all these records are removed entirely, unless a legal retention obligation applies.

After the periods, the data is deleted in a secure manner or anonymized, except for legal blocking.

⸻

8. Cookies and tracking technologies

LalaLearn uses cookies and equivalent technologies for the correct functioning of the Service. We distinguish:

Strictly necessary cookies: essential for authentication, session, security and fraud prevention. They do not require prior consent. They are, as of today, the only cookies we use.
Cookieless analytics: we use a product-analytics tool configured in cookieless mode, which does not store identifiers or information on your device. As it does not use cookies or local storage for tracking purposes, this processing does not require prior consent and relies on our legitimate interest (art. 6.1.f GDPR) to analyse the functioning of the Service on an aggregated basis.
Marketing or third-party cookies: we currently do not use marketing cookies, advertising pixels or third-party trackers in web browsing. If in the future we introduce such technologies (for example, for advertising campaigns), we will do so only upon the User's prior express consent through a cookie banner, and we will publish and link the corresponding Cookies Policy. The tracking of our emails is described in the following point.
Tracking of our emails: the emails we send you include a pixel and links redirected through our email provider that let us record the date of the first open and the first click, linked to your account, to measure the effectiveness and correct delivery of our communications. The legal basis is our legitimate interest (art. 6.1.f GDPR). You can object to this processing and exercise your other rights as set out in the rights section of this Policy, and unsubscribe from non-essential emails via the link included in each one.

You can configure your browser to block or delete cookies, without prejudice to the fact that this may affect the functioning of the Service.

⸻

9. User rights

As an interested party, you have the following rights over your personal data:

Access: obtain confirmation of whether we process your data and, where appropriate, a copy of it.
Rectification: have inaccurate or incomplete data corrected.
Erasure ("right to be forgotten"): request deletion when the legally provided causes concur.
Restriction of processing: request the suspension of processing in certain cases.
Objection: object to processing based on legitimate interest, except for compelling reasons on our part.
Portability: receive your data in a structured and commonly used format and, where technically possible, transmit it to another controller.
Not to be subject to automated decisions with significant legal effects, in accordance with article 22 of the GDPR.
Withdraw consent when this is the legal basis for processing, without affecting the legality of the prior processing.

You can exercise these rights by sending an email to legal@lalalearn.ai with the reference "Exercise of rights – GDPR", indicating the right you wish to exercise and, when necessary to verify your identity, the data that allows you to be located. LalaLearn will respond within one month, extendable in accordance with the GDPR.

If you consider that the processing does not comply with the regulations, you have the right to file a complaint before the Spanish Data Protection Agency (www.aepd.es) or before the supervisory authority of your habitual residence.

⸻

10. Informed decisions with specific consequences

10.1. Account deletion

If you decide to delete your account, we remind you that this decision is irreversible and entails, among other consequences, the total and irrevocable loss of any unconsumed Credits and of any Creator Program balance, in accordance with the Terms.

LalaLearn technically records —for evidentiary purposes, on the basis of the legitimate interest of the Controller and, where applicable, the compliance with legal obligations— the fact that the User was informed of these consequences and still confirmed the deletion, including date, time, IP address and user agent at the time of confirmation. This record is retained for the limitation period of any potential claims.

10.2. Waiver of the right of withdrawal in purchases

LalaLearn records, on the same basis, the express provision of the User's consent to the immediate execution of the supply of Credits and to the acknowledgment of the loss of the right of withdrawal, as described in the Terms.

10.3. Acceptance and re-acceptance of Terms

LalaLearn technically records the version of Terms and Policy accepted by each User, along with date, time, IP address and user agent, for the purpose of evidencing the consent given.

⸻

11. Minors

The Service is directed to Users of at least 14 years. Minors under 14 may not register or contribute personal data to the Service.

Users older than 14 but under the legal age of majority in their country of residence declare to have the prior, express and informed consent of those holding parental authority or legal guardianship over them, both for the use of the Service and for the processing of their personal data.

If you become aware that a minor under 14 has provided personal data to the Service, please notify us immediately through legal@lalalearn.ai and we will proceed to delete it without undue delay.

Participation in the Creator Program and the receipt of payments in euros is reserved for Users over 18 years of age.

⸻

12. Security

LalaLearn applies reasonable technical and organizational measures proportionate to the risk, including encryption in transit, access controls, monitoring, event logging, environment segregation and breach notification procedures. No system is absolutely secure: in case of a breach affecting your rights and freedoms significantly, we will inform you in accordance with articles 33 and 34 of the GDPR.

⸻

13. Modifications of the Policy

LalaLearn may modify this Privacy Policy when justified by changes in regulations, in the operation of the Service or in its providers. Substantial modifications will require express re-acceptance of the User before continuing to use the affected functionalities, in accordance with the versioning policy described in the Terms. Minor modifications will be published with the update date and notified to the User through the usual Service channels.

LalaLearn keeps the previous versions of this Policy, accessible upon User request through the contact channel.

⸻

14. Languages

The binding version of this Privacy Policy is the one drafted in Spanish. Versions in other languages are merely informative. In case of discrepancy, the Spanish version shall prevail.

⸻

15. Contact

For any inquiry related to this Policy or the processing of your data:

Email: legal@lalalearn.ai
Address: Avenida de Madrid 31, Madrid, Spain

Last updated: July 8, 2026

← Back to home