Privacy Policy

We collect the following information, directly from you:

• Trial lesson requests — when you request a free trial lesson we collect your name, email address, phone number, the address where the lesson will take place, your city, whether the lesson is for you or your child (and the child's age), your playing level, the instrument you have at home, which lessons interest you, how you heard about us, and anything else you choose to tell us. These are used only to arrange and teach the trial lesson; the 'how did you hear about us' answer is also counted, without your name, to see which of our flyers and listings work.
• Account details — your name, email address, and phone number, provided when you create an account. If you sign in with Google, we receive your name and email from Google; passwords are handled by our authentication provider and are never visible to us.
• Bookings and purchases — the lessons you book or cancel, monthly tuition and lesson credits you buy, and payment records (amount, payment method, payment status, and — for card payments — Stripe transaction references). Card numbers are NEVER stored or seen by us: card payments are entered directly on Stripe's secure checkout page and processed by Stripe.
• The lesson address — for in-home lessons we store the street address where the lesson takes place, along with any access notes you give us (gate codes, parking, which door). This is used only to get the teacher to the right place at the right time, and it is visible to the teacher alone.
• Student details — the student's name, and their age and playing level where you give them, so lessons can be planned. Where the student is a minor, the parent or guardian holds the account and provides these.
• Lesson policy agreement — before the first lesson the account holder signs our lesson policy agreement, which records the typed signature name, an emergency contact name and phone number, any information you choose to disclose, the confirmation that you are an adult signing for yourself or for your child, and the IP address and browser identifier at the time of signing.
• Contact form messages — your name, email address, and message are delivered directly to the teacher's email inbox; they are not stored in our database. To prevent abuse, we briefly retain a hashed (unreadable) form of your IP address for rate limiting, deleted within a few hours.
• Teaching notes — brief administrative notes on your account (for example, scheduling preferences or repertoire in progress) to serve you better.
• Student area usage — for each card in the student area we record when it was unlocked for you, when you first opened it, how many times you opened it, whether you downloaded it, and when it was marked done, plus the questions you send your teacher. This tells the teacher which cards work and what to plan next; it is never shared or used for advertising. You consent to this when you sign the lesson policy agreement; for a student under 18, the parent or guardian does.

Your information is used only to run the teaching practice and its booking service:

• Managing your account, bookings, lesson credits, and payments.
• Travelling to the right address at the right time for in-home lessons.
• Sending transactional emails: booking confirmations (including a calendar attachment), cancellation notices, purchase receipts, lesson reminders, and — at most once — an invitation to share feedback.
• Keeping the teacher informed about his own schedule and payments.
• Meeting our legal, tax, and record-keeping obligations.

We do not send marketing newsletters, and we do not use your information for advertising.

We rely on a small number of service providers, each processing your information only as needed to provide their service to us:

• Supabase — secure database and account authentication hosting.
• Stripe — card payment processing. Your card details go directly to Stripe and never touch our systems.
• Resend — delivery of the transactional emails described above.
• Google — the online group harmony class is held on Google Meet. Joining it means using a Google service, subject to Google's own privacy policy; we share no more than the meeting link with it.
• Vercel — hosting of this website and application.
• GitHub — storage of routine, access-restricted database backups.

We do not sell, rent, or share your personal information for advertising or any other consideration, and we have not done so in the preceding 12 months. There are no advertising networks, data brokers, or social media trackers on this site.

This site uses only functional cookies: the session cookies required to keep you signed in to your account, set by our authentication provider. We use no analytics, advertising, or tracking cookies of any kind.

• Account, booking, and payment records are kept while your account is active, and afterwards as needed for business, tax, and legal record-keeping.
• Signed lesson policy agreements are retained for as long as the law allows claims to be brought, as they document the terms you agreed to.
• Lesson addresses and access notes are kept while your account is active and deleted when you ask us to, or when lessons end and the records are no longer needed.
• Routine database backups are kept for up to about 13 months and then deleted automatically.
• Trial lesson requests are kept while the lesson is being arranged and for a reasonable time afterwards, so that a student who later enrols does not have to repeat themselves; ask and we will delete one earlier.
• Contact-form and trial-request rate-limiting records (hashed IP addresses only) are deleted within a few hours.

If you are a California resident, the California Consumer Privacy Act gives you the right to:

• Know and access the personal information we hold about you.
• Correct inaccurate personal information.
• Request deletion of your personal information, subject to legal record-keeping exceptions (for example, payment records and the signed lesson policy agreement we must retain).
• Not be discriminated against for exercising any of these rights.

To exercise any of these rights, email ado@thinkinmusic.com or call (650) 315-0834. We will verify your identity (typically by confirming control of the email address on your account) and respond within the timeframe the law requires. Because we do not sell or share personal information, there is nothing to opt out of.

Your data is stored with access controls that limit each person and system to what they need: you can see only your own information, and the teacher's access is restricted to running the lessons. Home addresses are visible to the teacher alone and are never published, shared, or sold. Payment card data is handled entirely by Stripe, a PCI-DSS certified payment processor.

Children are taught, but children do not hold accounts. Where the student is a minor, the account must be created and held by a parent or guardian aged 18 or over, who signs the lesson policy agreement and provides the student's name, age, and level. We do not knowingly allow anyone under 18 to create an account, and we do not collect personal information directly from children.

If we change this policy, we will update the effective date above. Material changes will be communicated by email or a notice on this site.

Questions about this policy or your personal information? Contact Think in Music at ado@thinkinmusic.com or (650) 315-0834.