Privacy Policy

1. Who we are

mymusic.academy is operated by [COMPANY NAME] ("we", "us", "our"), registered in England and Wales. We are the data controller for personal data processed through this platform.

ICO registration number: [ICO REGISTRATION NUMBER]

Contact: [email protected]

2. What data we collect

Teachers and school administrators

• Name and email address (account registration)
• Profile information (biography, photo, instrument specialisms)
• Availability and scheduling preferences
• Payment and billing information processed via Stripe (we do not store card details)
• Stripe Connect account details if you accept payments through the platform
• Communications sent through the platform

Students

• Name and email address
• Parent or guardian email address (where the student is under 18)
• Instrument, grade level, and lesson history
• Challenge submissions (audio and video recordings)
• Practice logs, XP points, and progress data
• Teacher feedback and assessment notes

Technical data

• Login session data
• Server access logs (IP address, browser type, pages visited)
• Cookies necessary for authentication and security

3. How we use your data

• Providing the service — scheduling, booking, lesson management, and the student challenge and progress system
• Billing — processing subscription payments and, where applicable, lesson payments via Stripe
• Communications — sending booking confirmations, lesson reminders, and challenge notifications via email
• Platform safety — fraud prevention, security monitoring, and audit logging
• Platform improvement — aggregate, anonymised analytics to improve features

4. Legal basis for processing

• Contract performance — processing necessary to deliver the service you have signed up for
• Legitimate interests — platform security, fraud prevention, service improvement
• Legal obligation — where we are required to retain data by law
• Consent — where we explicitly ask for your consent (e.g. optional AI assessment features)

5. Children's data

Many students using mymusic.academy will be under 18. We take the protection of children's data seriously.

• Student accounts for under-18s require a parent or guardian email address at registration
• Audio and video recordings submitted as challenge responses are stored securely and are only visible to the student's teacher within the platform
• We do not use children's data for advertising or share it with third parties beyond those listed in section 6
• Parents and guardians may request access to, correction of, or deletion of their child's data at any time by contacting [email protected]
• Teachers are responsible for obtaining appropriate consent from parents or guardians before enrolling students and before enabling any optional features (such as AI assessment) that involve processing student recordings

6. Who we share data with

We do not sell your data. We share data only with the following sub-processors where necessary to provide the service:

• Stripe — payment processing and teacher payout (Connect). Stripe's privacy policy: stripe.com/gb/privacy
• Resend — transactional email delivery. Resend's privacy policy: resend.com/legal/privacy-policy
• Cloudflare — DNS, SSL, and network security. Cloudflare's privacy policy: cloudflare.com/privacypolicy
• Hosting infrastructure — your data is stored on servers located in the United Kingdom

We may disclose data if required to do so by law, court order, or to protect the safety of any person.

7. Data retention

• Active account data is retained for as long as the account remains open
• Challenge submission recordings are deleted from our servers once approved or rejected by the teacher
• On account closure, personal data is deleted within 30 days, except where retention is required by law (e.g. financial records are retained for 7 years under UK law)
• Server access logs are retained for up to 90 days

8. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data (subject to legal retention obligations)
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use only essential cookies required for authentication and security. No advertising or third-party tracking cookies are used. Session cookies are deleted when you close your browser; authentication cookies persist for the duration of your login session.

10. Changes to this policy

We may update this policy from time to time. We will notify account holders of material changes by email. The date at the top of this page shows when it was last updated. Continued use of the platform after changes are notified constitutes acceptance.

11. Contact

For any privacy-related questions or data requests, contact us at [email protected].