← MHAIXVeridem Holdings Inc.

Legal

Privacy Policy

A Veridem Holdings Inc. product

Last updated: September 30, 2026

Who We Are

MHAIX (Meaningful Human Authorship Index) is a product of Veridem Holdings Inc., a Delaware C-Corporation. When this policy says "we" or "us," it means Veridem Holdings Inc. You can reach us at hello@getveridem.com.

This policy explains, in plain language, what MHAIX collects, why, where it is kept, who else touches it, and how you can get a copy or delete it.

Using MHAIX as a Guest

You can start an assessment without an account. While you work as a guest, your answers are kept in your own browser (local storage) so you can close the tab and come back on the same device. If you save your progress or upload evidence files, we also store a draft on our servers, protected by a private edit key that only your browser holds. Anyone without that key cannot open or change the draft. If you later sign in, you can attach the guest draft to your account.

Clearing your browser data removes the local copy and the key. A guest draft saved on our servers is not automatically deleted — email us if you want it removed.

Accounts and Sign-In

You can create an account with an email and password, a one-time "magic link" sent to your email, Sign in with Google, or Sign in with Apple. For Google and Apple, we receive your email address and a basic account identifier from that company; we never receive your Google or Apple password.

What We Collect and Why

  • Account details — your email and sign-in method, so you can sign in and find your work on any device.
  • Creator details — your legal name, optional pseudonym, citizenship or domicile, copyright claimant, and optional PRO / publisher information, because they appear on your certificate.
  • Co-author details — names, pseudonyms, roles, citizenship, ownership splits, PRO information, and typed signatures for anyone you list. By adding a co-author you confirm you have their permission to share this. We protect it the same way as your own.
  • Song details — title, collaborators, ISRC / ISWC codes, sample status, the AI platform you used, and your answers to the assessment questions (typed or spoken).
  • Evidence files — audio files and screenshots you choose to upload (for example, in the Iteration Journal or Quick Upload), plus your notes on what changed and why.
  • Your score and certificate — the calculated score, verdict, a digital fingerprint (hash) of the certificate contents, and the digital signature.
  • Imports you ask for — if you connect Re:Writ or Compose:EP records, we store the parts you choose to import (such as lyrics, iteration notes, release title, and track list).
  • Purchases — which plan or pack you bought, how many certificates you have left, your subscription status, and which group filing packages you have unlocked.
  • Platform requests — if you ask us to add an AI platform, the platform name, your notes, and optional name and email.

We use this information only to run MHAIX: to build and save your assessment, issue and verify your certificate, keep your Evidence Vault, and manage your plan. We do not sell your information, and we do not use it for advertising.

Where It Is Stored

Your account, drafts, answers, certificates, and purchase records are stored in a secured database operated for us by Lovable Cloud (built on Supabase). Evidence files are stored in a private file store in the same service; they are not public, and access links are issued only to people with permission to see that draft. Access rules on the database limit each signed-in person to their own records.

Save and Resume

Your progress autosaves as you go. Signed-in users can resume from any device. Guests can resume on the same browser, or anywhere they still have the private edit key.

AI Processing

Some features send your content to an AI model so it can give you feedback. These features do not change your score.

  • Answer quality check — the text of an answer, to suggest whether it could be more specific.
  • Registration assistant — the details needed to draft plain-language suggestions for a U.S. Copyright Office application.
  • Evidence review — before you finalize, a summary of your answers, your uploaded screenshots, and basic details about your audio files, to flag possible inconsistencies you may want to fix.

These requests go through the Lovable AI Gateway to a Google Gemini model. We do not store the AI's responses in your record beyond what is shown to you. The AI provider and gateway may keep short-term request logs under their own policies.

Read-aloud buttons for fixed help text and public pages (including Pricing and the U.S. Copyright Office guide) play prerecorded audio made with ElevenLabs. Playing those clips does not send your answers to ElevenLabs. If a clip is unavailable, your browser's built-in speech may read the text instead. MHAIX does not currently generate live speech from your in-app answers.

Certificates, Signing, and the Veridem Authorship Registry

When you finalize a certificate, MHAIX digitally signs it (Ed25519) and registers it in the Veridem Authorship Registry, a separate Veridem database. We send the Registry the product name, the creator name, and the song title. The Registry stores these with a certificate ID, certification date, status, and private verification token. It does not store the full MHAIX assessment, score, or uploaded evidence. The Registry returns the ID and token to MHAIX, which keeps the detailed certificate and assessment in its own records.

Looking up an ID alone confirms the product, certification date, and status without showing the creator or work title. A verification link with the private token (including the certificate QR code) also shows the creator name and work title held by the Registry; it does not unlock the full MHAIX assessment or your evidence files. Registry records are permanent by design. For more on the Registry, see the getveridem.com Privacy Policy.

Amendments and Versions

If you correct a finalized certificate, we save the change as a new version and keep every earlier version as a permanent snapshot. This history is part of the certificate's integrity and cannot be deleted. Major corrections may create a new registered certificate that is linked to, and marks as replaced, the original.

Payments

Payments are handled by Stripe. Stripe collects and stores your card and billing details — we never see or store your full card number. We store your Stripe customer and subscription IDs, your plan, subscription status, renewal date, and certificate balance.

EP and Album Group Certificates

If you create a release group, we store its title, publication status and date, ordered track list, each track's certification status, score and certificate references, and the group's filing-package access and usage. Each song is assessed and certified separately and uses one certificate credit when you start a new track. A release may also receive its own Registry record. The optional Group Filing Package creates composition and sound-recording documents with per-track details for a U.S. Copyright Office group filing; it costs $15 per eligible release unless covered by Studio's five included packages per subscription year. Package purchases and use of the Studio allowance are recorded with your account.

Emails

We send account emails (sign-in links and confirmations) and service notices about your Evidence Vault — for example, when access is getting close to its end date, when a subscription is cancelled, or when access is extended or restored. We keep a log of which notices were sent. We do not send marketing email from MHAIX.

Cookies, Browser Storage, and Analytics

  • Sign-in: your browser keeps a sign-in session so you stay logged in.
  • Local storage: your in-progress assessment, an EP/album draft, and a flag that you have used MHAIX before (to shorten help text).
  • Session storage: small, temporary values — for example, where to send you after sign-in, and whether you have already seen the welcome page. These clear when you close the tab.
  • Analytics: we use Cloudflare Web Analytics, which counts page visits without using cookies and without tracking you across other websites.

We do not use advertising or cross-site tracking cookies.

Third Parties We Use

  • Lovable Cloud / Supabase — hosting, database, sign-in, file storage, and email delivery.
  • Cloudflare — website delivery and privacy-friendly analytics.
  • Stripe — payments.
  • Google and Apple — only if you choose to sign in with them.
  • Lovable AI Gateway and Google Gemini — the AI features described above.
  • ElevenLabs — production of prerecorded read-aloud clips for fixed page and helper text; no live generation from your answers.
  • Veridem Authorship Registry — certificate registration.
  • Slack — internal notification to our team when someone submits a platform request.
  • Re:Writ and Compose:EP (Veridem products) — only when you ask to import from them.

How Long We Keep Information

We intentionally do not set a fixed maximum storage period: drafts, evidence files, finalized certificates, release groups, and platform requests are kept indefinitely unless you delete eligible records or delete your account. Registered certificates and their version history remain after account deletion as described below. Guest drafts saved on our servers do not currently have automatic cleanup; contact us to request removal.

Evidence Vault access vs. storage. Your plan sets how long you can open your vault: 2 years on the free plan, 5 years on Creator, 10 years on Pro, and indefinitely on Studio or with a permanent extension. When access ends, or after a 90-day grace period following a cancellation, your evidence is not deleted — it is kept in the permanent archive, and you can restore access later.

Deleting Your Account

You can delete your account from inside the app. Here is exactly what happens:

  • Your login is deleted.
  • Every draft you never finalized is fully deleted — the answers, notes, and every uploaded evidence file.
  • Registered certificates stay. We remove your account link and email from them, but keep the certificate itself — including the creator legal name as it appeared on it, its version history, and its Registry entry — because others (rights organizations, licensees, publishers, courts) may rely on it to verify authorship.

Before you confirm, we show you every Registry ID you hold so you can copy or export the list.

Children

MHAIX is not directed to children under 16, and we do not knowingly collect information from them. If you believe a child has given us information, email us and we will delete it.

Your Rights and Requests

To ask for a copy of your information, a correction, or deletion, email hello@getveridem.com. We will respond within a reasonable time. Deletion is subject to the permanent-certificate rule described above.

Changes to This Policy

We may update this policy as MHAIX changes. We will change the "Last updated" date at the top when we do.

Contact: Veridem Holdings Inc. — hello@getveridem.com