Start here
The short version
- We collect what we need to run music lessons: who you are, who your child is, when the lessons are, what happened in them, and how you pay.
- Our account and lesson tools use information to provide the service, not to sell it or target advertising. Some older marketing pages also load analytics, advertising, marketing and social-media services, as described below.
- Payments are handled by Stripe. Your card number never reaches our servers.
- A parent or guardian holds the family account. A learner added to a family as a dependent has no login of their own, and messaging between families and teachers is adults only.
- A small number of outside companies help us run the service. They are named below, along with the main types of information they receive from us.
- You can ask us what we hold about you, ask us to correct it, or ask us to delete your account, and appeal if we say no. Write to info@music4humans.com.
The rest of this page is the detail behind those six lines. Where a practice is still changing, we say so rather than describing an intention as if it were already true.
Controller
Who we are
Music 4 Humans LLC runs Music 4 Humans, a place to find a music teacher and take private lessons, and school and community music programs. We are responsible for the personal information described here, except where we handle information solely on behalf of a school or other organisation under a separate agreement with them.
Post: 1111 S Pierce St., Lakewood, CO 80232, United States. Email: info@music4humans.com.
This policy covers music4humans.com, the family and teacher areas of the app, and the emails we send. It does not cover a teacher’s own website or social accounts, or anything you do off the platform.
Information
What we collect, and why
| What | Examples | Why we have it |
|---|---|---|
| WhatAccount and family | ExamplesName, email address, phone number, time zone, which family you belong to, and whether you manage it | Why we have itTo create an account, place a learner with a teacher, and reach you about lessons |
| WhatLearner details | ExamplesName, date of birth or age, instrument, goals and the notes a teacher keeps about progress | Why we have itSo a teacher can plan lessons and you can follow along |
| WhatLessons | ExamplesSchedules, attendance, cancellations, practice logs, badges, homework a household sends in, and lesson reports | Why we have itTo run the lessons, bill correctly and show you what happened |
| WhatSchool and community programs | ExamplesRegistration forms, emergency contacts, allergies and medical notes when you provide them, authorized pickups, pickup signatures | Why we have itTo keep children safe during a program, and to release them only to the right adult |
| WhatWaivers | ExamplesThe signed waiver, the guardian’s name and contact details, participant age, any medical information you enter, a media-release choice, your signature image and the signed PDF, plus the IP address and browser the signature came from | Why we have itBecause a waiver is only worth anything if we can show who signed it and when |
| WhatPayments | ExamplesA Stripe customer reference, the card brand, its last four digits, its expiry, and a fingerprint Stripe gives us that identifies a card without revealing its number | Why we have itTo charge for lessons, keep a card on file when you ask us to, and stop the same card claiming a free trial repeatedly |
| WhatMessages | ExamplesMessages between a family’s adults and a teacher, including a copy of the original text when details were withheld before a booking | Why we have itTo let you talk to your teacher, and to be able to look into a report of something wrong |
| WhatTeachers | ExamplesProfile, photo, intro video, rates, instruments, availability, payout account reference, service area, and for in-person teaching the studio address | Why we have itTo show a profile families can book, and to pay the teacher |
| WhatWebsite use | ExamplesWhere you landed, what page referred you, and campaign tags in the link you followed, kept in your browser and stored with an enquiry if you send one | Why we have itTo know which of our own pages brought people here |
| WhatEmail | ExamplesThe address we sent to, the subject, the message itself, and whether it was delivered, bounced or marked as spam | Why we have itTo prove what we told you, and to stop emailing an address that rejects our mail |
Health information
Some forms ask about allergies, medical notes or conditions, because a teacher or program leader may need to know. Please give us only what we ask for and what is needed to run the lesson or program safely. We treat health information as sensitive: it is visible to the people running that lesson or program and to our own staff, as needed for their work. Service providers that host or process these records also handle that information on our behalf.
We do not collect card numbers
When you enter a card, it goes from your browser to Stripe directly. Our servers never see the number or the security code, and neither does our database.
Under 18
Children
Most of our learners are children, and their information is here because a parent or guardian put it there. We collect it to teach them music, keep them safe during a program, and tell you how they are getting on.
- A learner added to a family as a dependent has no password and cannot sign in. An adult who takes lessons themselves does hold their own login.
- Messaging is adults only. A child is never a participant in a conversation with a teacher, not even to read it.
- A child’s record is visible to the adults who manage their family, the teachers and assistants assigned to them, and our own staff.
- If you ask us to share a progress page by link, anyone holding that link can see that learner’s progress until you revoke it. Treat it like a key.
- We rely on the adult who adds a learner being their parent or legal guardian, or authorised by one.
- If you believe a child’s information reached us without a parent or guardian’s involvement, write to info@music4humans.com and we will remove it.
Messages
Messaging, and how it is checked
Messaging lets the adults in a family and a teacher talk on the platform.
- Every message is checked automatically before it is delivered. Most are delivered immediately.
- A message that trips a risk rule is held back and looked at more closely before it goes anywhere. That closer look can involve an outside AI service, or a person at Music 4 Humans, or both.
- A message that is clearly abusive can be blocked and kept as evidence, and a conversation can be frozen.
- Before a family has booked a lesson with a teacher, phone numbers, email addresses, links and social handles in a message are withheld from the recipient. We keep the original text so we can review it.
- Talk of paying outside the platform is delivered, but flagged for us to look at.
- You can report a message. Doing so puts that conversation in front of a reviewer.
- Access to conversations is limited to authorised reviewers, and is used for safety, moderation, reports, support and enforcing our terms. Every time a reviewer opens a conversation, and every time one views text that was withheld, it is recorded.
What the AI check receives
Only a message already held back for review is sent for AI review, together with a few preceding messages for context. Contact details we can detect are replaced before it is sent. Under OpenAI’s current terms for business use, that text may be held by them for up to 30 days for abuse monitoring, and is not used to train their models. We intend to apply for zero retention, and this page will only say it is in place once it actually is.
Sub-processors
Who else touches your information
These are the companies that hold or handle personal information on our behalf. Each one only receives what it needs for the job next to its name.
| Company | What reaches them |
|---|---|
| CompanySupabase | What reaches themHosts our database, logins and stored files, including signatures and signed waiver PDFs |
| CompanyVercel | What reaches themServes the app and migrated public pages; sees the ordinary request information a web host sees |
| CompanyCloudflare | What reaches themRoutes and protects public website traffic and caches public content; processes request information such as IP addresses, URLs and headers |
| CompanyStripe | What reaches themCard details you enter, the payment itself, and a customer record identified only by an internal family reference. Teacher payouts run through Stripe too |
| CompanyResend | What reaches themSends our email: the recipient’s address and name, the subject and the message |
| CompanyOpenAI | What reaches themSupports messaging review and draft lesson reports or parent updates. Depending on the feature, inputs can include held message text, teacher notes, first names, lesson dates and program details, activities and badge progress |
| CompanyUnited States Census Bureau geocoder | What reaches themA teacher’s typed studio address, turned into a map location. We do not store it there and it is not stored by us at that step |
| CompanyGoogle Fonts | What reaches themLoads the fonts on this site and in our emails, so Google sees the request your browser or mail app makes |
| CompanyGoogle | What reaches themIf you choose “Sign in with Google”, Google confirms who you are |
| CompanyYouTube and Vimeo | What reaches themPlay a teacher’s intro video, in their privacy-preserving embed modes |
| CompanyWP Engine | What reaches themHosts our older marketing site and still serves some teacher photos |
| CompanyGoogle Analytics, Google Tag Manager and Google advertising services | What reaches themOlder marketing pages load Google tags and advertising scripts. They can receive page visits, referral information, IP addresses, browser or device details and cookie identifiers for measurement and advertising |
| CompanyBrevo | What reaches themOlder marketing pages load Brevo marketing scripts, which can receive page visits, browser information and identifiers; information you submit through a connected form can also reach Brevo |
| CompanyWonderPush | What reaches themOlder marketing pages load its notification scripts. They can receive technical browser information and, if you enable notifications, a browser push subscription |
| CompanyMeta / Facebook | What reaches themSocial features on older marketing pages load Facebook scripts, which can receive page and browser information and recognize an existing Facebook session |
Each company receives what is described next to its name, plus the technical information any provider handles in the course of the job, such as IP addresses, request headers and server logs. We also share information when we have to: with a teacher about the learners they teach, with a family about their own learners, and with authorities when the law requires it or where someone’s safety is at stake.
Cookies, marketing pages and your choices
Our account and lesson tools use browser storage to keep you signed in, provide security and remember preferences such as a saved teacher. They do not use account or lesson information for sale or targeted advertising. Older marketing pages still load the third-party services listed above; these services may use cookies or similar identifiers for analytics, advertising and social features. This can involve sharing browser activity for advertising under some privacy laws. You can block or clear cookies in your browser, manage advertising preferences with the relevant provider, and revoke push-notification permission in your browser. Some features may stop working when cookies are blocked. To request an opt-out from sale, sharing or targeted advertising where applicable, write to info@music4humans.com with the subject Privacy opt-out. Automatic handling of browser opt-out signals, including Global Privacy Control, on older marketing pages has not yet been verified; we do not represent those pages as tracking-free.
Access
What our own staff can see
- Our staff can see the records needed to run the business: accounts, lessons, billing, waivers and program registrations.
- An administrator can open the app as another user to diagnose a problem. Each time that happens it is recorded.
- Message conversations are handled more narrowly: only a person holding the reviewer role can open them, and each time one does it is recorded alongside the conversation.
Retention
How long we keep things
| What | How long |
|---|---|
| WhatYour account and lesson history | How longWhile your account is open, and afterwards while we need it for tax, accounting and dispute records |
| WhatMessages | How longDeleted automatically two years after the last activity in that conversation, unless a report or a safety review still needs them |
| WhatText withheld before a booking | How longDeleted automatically after 90 days, or 90 days after an open safety or moderation review ends |
| WhatRecords of a review | How longKept so a decision can still be explained, then deleted automatically after three years |
| WhatSigned waivers and their signature images | How longKept, including the IP address and browser recorded at signing. No fixed deletion period is currently applied; we retain these records as evidence of participation and consent and review requests individually |
| WhatEmail we sent you, and its delivery result | How longKept as our record of what we told you |
| WhatOne-time codes and rate-limit records | How longHours to days |
Planned limits are not current deletion guarantees. You can request deletion now, and we review requests individually, including any legal obligation or unresolved dispute requiring us to keep particular records. We will update this policy when the planned retention schedule is in operation.
Rights
Your choices
Depending on where you live, you may have privacy rights under your local law, including the ones below. We try to honour a reasonable request even where the law does not require us to.
- Ask for a copy of what we hold about you or your child, or for it in a portable form.
- Ask us to correct anything wrong. Most of it you can edit yourself in your account.
- Ask us to close your account and delete your information. We keep what the law requires us to keep, and we assess messages already shared with another person separately, taking their rights and any necessary safety records into account.
- Stop promotional email at any time using the unsubscribe link in it. You will still get the essential messages about your lessons, your payments and your account.
- Ask us not to use a particular piece of information, and we will tell you plainly whether we can still provide the service without it.
Write to info@music4humans.com. We answer these ourselves, so tell us plainly what you want. We may need to check who you are first, and where a request is about a child, that you are entitled to make it. We answer within the time the law allows, which in Colorado is 45 days, extendable once where a request is complex.
If we say no
You can appeal. Reply to our answer, or write to info@music4humans.com with “Privacy appeal” in the subject line. We look at it again and tell you the outcome and the reasons in writing, within 45 days of your appeal, or up to 60 days longer if it is complex and we tell you why. If you are still not satisfied with how the appeal turned out, you can raise it with the Colorado Attorney General at coag.gov.
Security
How we protect it
- Traffic to the site and the app is encrypted.
- The database refuses to hand a family another family’s records; that rule is enforced by the database itself, not only by the app.
- Signatures, signed waivers and pay documents sit in private storage that is not reachable by a public link.
- Card numbers are never stored by us.
No service can promise perfect security, and we will not pretend otherwise. If a security breach affects your personal information, we will investigate it promptly and give whatever notice the law requires. We would rather tell you than wait to be made to.
Location
Where your information lives
We are based in the United States. Our service providers may process information in the United States and other countries where they operate, including when routing website traffic. If you use Music 4 Humans from another country, your information may be transferred internationally; privacy protections can differ between countries.
Contact
Changes, and how to reach us
When we change this policy we change the date at the top. If a change matters to you, such as a new company receiving your information, we will say so rather than leave you to spot it.
Music 4 Humans LLC, 1111 S Pierce St., Lakewood, CO 80232, United States. info@music4humans.com.
