What we collect

• Account information. Your email address (or the email Google provides if you sign in with Google). Sign-in is passwordless: a one-time code emailed to you, or Google. We do not collect passwords.
• Content you provide. The sheet music you upload, the prompts and preferences you type, and the arrangements LalaScript generates for you.
• Your edit history. When you edit a piece, we automatically record the version before, your instruction, and the version after, along with which version you download and any ratings or notes you give.
• Share links. When you share a piece, we record each time you press the share button and each time the shared page is opened: when, which piece, and whether the person opening it was signed in to LalaScript (their account if so). That record never includes the IP address of the person opening the page.
• Usage data. Product analytics and session recordings (via PostHog) that show how the studio is used, plus standard server logs needed to operate and secure the service.
• Payment information. When you buy a credit pack, your payment is handled by our processor, Stripe. We receive confirmation of the purchase and limited billing details, but we never receive or store your full card number.

How your content is used

• We process your uploads and prompts on our servers to produce, play, save, and let you download arrangements.
• Your account, the pieces you create (including the original source of each piece), and your edit history are stored so you can reopen and refine your work, and so we can improve the product. You can delete any saved piece at any time.
• We use the content you upload, your prompts, and your edits and corrections to operate, improve, develop, train, and evaluate LalaScript's arrangement technology, including machine-learning models. We process uploaded scores to train and improve our OMR models. To opt out of model training, contact [email protected].
• We do not sell your personal information, and we do not use it for advertising.
• Third parties. We share only what each step requires with: Anthropic (to generate and edit arrangements), Google (PDF-to-music transcription and, if you choose it, Google sign-in), Resend (account emails), PostHog (analytics and session replay), Sentry (crash reporting), and our hosts Railway and Cloudflare. When you buy credits, your payment is processed by Stripe. Each processes data under its own terms.

Cookies and analytics

We use an essential cookie to keep you signed in, and analytics cookies (PostHog) to understand product usage. We do not use third-party advertising or cross-site tracking cookies.

Session recording

To understand and fix problems, we use PostHog session replay, which records on-screen activity in the studio. Text you type into input fields is masked in these recordings. We do not record sessions at all in the EEA, the UK, Switzerland or the Crown Dependencies, or anywhere we cannot determine your location. To opt out of session recording elsewhere, contact [email protected].

Data security

All connections to studio.lalascript.com are encrypted via HTTPS. Sign-in codes are single-use and short-lived, and processing happens in isolated containers. We follow industry-standard practices to protect data in transit and at rest.

Data retention

We keep your account and its associated pieces and edit history while your account is active. You can delete any saved piece at any time. You can delete your whole account yourself from your account page: we send a confirmation link to your account email, and the deletion happens when you confirm it there. You can also request deletion of your account and personal data by emailing us. Updated 2026-09-11: Deleting your account removes your account and everything that identifies you. Pieces and uploaded files are kept in anonymised form. If you want those removed as well, email us before you delete your account. Residual copies in encrypted backups expire within 14 days. Please note that content already incorporated into a trained model cannot be individually withdrawn from that model.

Where your data is processed

LalaScript is operated from the United States and works with service providers located in the United States and other countries. If you use LalaScript from outside the United States, your information will be transferred to and processed in countries whose data-protection laws may differ from those where you live. Where required, we rely on appropriate safeguards for these transfers.

Children

LalaScript is a general-audience product and is not directed to children. You must be at least 13 years old to use it, and if you are under the age of majority where you live, you may only use it with the involvement of a parent or guardian. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, email us and we will delete it.

Your choices and rights

You can delete any saved arrangement at any time, and you can delete your whole account from your account page (confirmed by a link we email you, so nobody else can delete it from an open browser session). Updated 2026-09-11: Deleting your account removes your account and everything that identifies you. Pieces and uploaded files are kept in anonymised form. If you want those removed as well, email us before you delete your account. Residual copies in encrypted backups expire within 14 days. You can also request access to, correction of, or deletion of your personal data, ask us to stop using your content to improve our models, or ask what we hold about you, by contacting [email protected]. When you ask us to stop, we exclude your account from the training corpus and remove the material already taken from it, though content already incorporated into a trained model cannot be withdrawn from that model. We honor applicable rights under laws such as the GDPR and CCPA.

To delete your account: it removes your account and everything that identifies you, and keeps your pieces and uploaded files in anonymised form, as described above.

Contact

Questions about privacy? Reach us at [email protected].