Privacy Policy
Last updated: July 13, 2026
This Privacy Policy explains how Lyra Library LLC (“Lyra,” “we,” “us,” or “our”) handles personal information about visitors to our website and the staff users of our library management service.
If you have questions, contact us at support@lyralibrary.com.
What this policy covers — and what it doesn’t
Lyra is a library management system for K-12 schools. Two different groups of people have personal information that flows through Lyra, and they’re handled under different rules:
- Staff users, prospective customers, and website visitors. This includes librarians and other school staff who sign up for Lyra, people who contact us through our website, and anyone who visits lyralibrary.com. This Privacy Policy governs how we handle personal information about these people. Because Lyra registration is self-service, a Customer may be an educational institution, another educational organization, or an individual acting in an educational setting. This Privacy Policy applies to the personal information of the person who creates or administers the Lyra account and other staff users or administrative users associated with that account.
- Patrons (students,teachers, and other library users) whose records are managed in Lyra by a Customer. Customer upload or enter patron records to Lyra so authorized library staff can manage circulation, holds, notifications and other library activities. Patron records may include parent or guardian email addresses if the Customer configures notification emails. We handle patron data only on behalf of the Customer, under the Customer’s instructions, as described in our Data Processing Agreement. If you are a student, parent, guardian, or other patron with questions about patron records in Lyra, please contact the Customer that manages the library account.
The rest of this policy is about the first group.
What we collect
We collect personal information about staff users, prospective customers, and website visitors in the following situations.
When you sign up for Lyra or contact us. When you create an account or get in touch with us about Lyra, we collect information you provide directly:
- Your name
- Your email address
- Your school or organization name and your role there
- Any other information you choose to include in messages to us
When you visit our website or use the Lyra staff application. Our servers and infrastructure automatically log technical information needed to operate and secure the service:
- IP address
- Browser type and version, operating system, device type
- Pages or screens viewed and actions taken
- Date and time of requests
- Referring URL
We use Cloudflare Web Analytics on our marketing website. Cloudflare Web Analytics is privacy-friendly: it does not use cookies, does not fingerprint visitors, and does not track visitors across sites. We use it to understand which pages are visited and how visitors find us, in aggregate.
When you pay for Lyra. Stripe processes payments on our behalf. We receive billing contact information and payment method metadata (card brand, last four digits, expiration) from Stripe, but we do not receive or store full payment card numbers. Stripe’s handling of your payment information is governed by Stripe’s privacy policy.
What we don’t collect. We don’t collect sensitive personal information (such as health information, government ID numbers, biometric data, or information about race, religion, or sexual orientation) about staff users or website visitors. We don’t display advertising and we don’t allow third parties to use our service to display advertising. We don’t sell personal information, and we don’t share it for cross-context behavioral advertising.
How we use your information
We use the personal information described above to:
- Provide and operate the Lyra service, including creating and managing your account, authenticating you, providing customer support, and sending service-related communications (such as billing notices, security alerts, and product updates relevant to your account)
- Improve Lyra, by understanding how the product is used in aggregate, identifying problems, and prioritizing improvements
- Communicate with you about Lyra, including responding to inquiries, sending newsletters or product announcements if you’ve opted in, and notifying you of material changes to our terms or this policy
- Secure the service, including detecting and preventing fraud, abuse, and unauthorized access
- Comply with legal obligations, including tax, accounting, and regulatory requirements
Lyra does not currently send SMS or text-message notifications. Service notifications are sent by email or through the service.
We process your personal information only when we have a lawful basis to do so — typically because it’s necessary to provide the service you’ve asked for, because you’ve consented, or because we have a legitimate interest in operating and improving our business.
Who we share information with
We share personal information about staff users and website visitors only in the following circumstances:
- With our subprocessors, who provide infrastructure and services we rely on to run Lyra. Each subprocessor is bound by contract to handle data only as needed to provide their service to us. A current list is available on our Subprocessors page.
- When required by law, such as in response to a subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of Lyra, our users, or others.
- In a business transfer. If Lyra is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We’ll notify you and provide choices where required by law.
We do not sell personal information. We do not share personal information with third parties for their own marketing purposes.
Cookies and similar technologies
We use a small number of cookies and similar technologies for essential service functions:
- Authentication cookies that keep you signed in to the Lyra staff application
- Session cookies that maintain your application state during a visit
- Preference cookies that remember your settings
We do not use advertising cookies, cross-site tracking technologies, or analytics cookies. Cloudflare Web Analytics, which we use on our marketing site, does not set cookies.
How long we keep your information
We keep personal information about staff users for as long as the associated Lyra account is active, and for a reasonable period after account closure to comply with legal obligations, resolve disputes, and enforce our agreements. After that, we delete or anonymize the information.
Server logs containing IP addresses and similar technical information are retained for a limited period (typically no more than 90 days) for security and operational purposes, then deleted.
Cloudflare Web Analytics retains aggregated visitor data according to Cloudflare’s own retention policy; we do not have access to individual visitor records.
Children
Our marketing website and the Lyra staff application are intended for adults — school staff, administrators, and people evaluating Lyra for their school. We do not knowingly collect personal information from children through the marketing site or through staff accounts.
Lyra’s patron-facing OPAC is used by students of our school customers, including students under 13. Patron data, including data about students, is handled on behalf of the school under our Data Processing Agreement with the school, not under this Privacy Policy. Where the Customer is a school or educational institution, the Customer operates under its own legal authority, including where applicable FERPA and COPPA’s school-consent framework, when it enrolls students in services like Lyra. Where the Customer is not a school or educational institution, the Customer is responsible for obtaining any parent or guardian consent required before providing information about a child to Lyra. If you are a parent or guardian with questions about your child’s records in Lyra, please contact the Customer that manages the library account.
Your privacy rights
Depending on where you live, you may have rights regarding the personal information we hold about you, including:
- The right to know what personal information we hold about you and how we process it
- The right to access a copy of that information
- The right to correct inaccurate information
- The right to delete personal information, subject to certain exceptions
- The right to opt out of the sale or sharing of personal information (we do not sell or share personal information, but you have this right regardless)
- The right to non-discrimination for exercising your privacy rights
Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia have specific rights under their state privacy laws. The rights above summarize what’s available across these states; specific entitlements vary.
To exercise any of these rights, email us at support@lyralibrary.com. We’ll respond within the timeframes required by applicable law. We may need to verify your identity before acting on your request.
If we decline a request, you may appeal our decision by replying to our response, and in some states you may also complain to your state attorney general.
Categories of personal information we collect (for US state privacy law)
Under several US state privacy laws, we’re required to disclose the categories of personal information we collect about staff users and website visitors. The following table reflects what we collect about those people only; it does not describe patron data, which is governed by our agreement with the school.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email address, IP address, account identifier | YES |
| B. California Customer Records statute information | Name, contact information, employer (school name) | YES |
| C. Protected classification characteristics | — | NO |
| D. Commercial information | Billing contact and payment method metadata (via Stripe) | YES |
| E. Biometric information | — | NO |
| F. Internet or other network activity | Pages and screens viewed, actions taken in the Lyra application | YES |
| G. Geolocation data | Approximate location derived from IP address | YES |
| H. Audio, electronic, sensory, or similar information | — | NO |
| I. Professional or employment-related information | Job title, school or organization name | YES |
| J. Education information | — | NO |
| K. Inferences drawn from collected personal information | — | NO |
| L. Sensitive personal information | — | NO |
We retain information in these categories for as long as you have an active Lyra account, and for a reasonable period thereafter as described in “How long we keep your information.”
A note about Category J. Lyra processes education records about students on behalf of school customers, but that processing is governed by our Data Processing Agreement with the school and is not subject to this Privacy Policy. The school remains the controller of those records.
Do Not Track
Some browsers send a “Do Not Track” signal. There is no industry consensus on how to interpret this signal, and we do not currently respond to it. We don’t engage in the cross-site tracking that Do Not Track was designed to address.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we’ll update the “Last updated” date at the top of the document. If we make material changes, we’ll notify staff users by email or through the Lyra application before the changes take effect.
Contact us
If you have questions about this Privacy Policy or how Lyra handles your personal information, email us at support@lyralibrary.com.
If you are a parent, student, or other patron with questions about how your school uses Lyra, please contact the school directly. We are unable to respond to requests about patron data without authorization from the school.