Privacy Policy

Vittoria Music Studio, LLC is a Florida limited liability company. It operates this website and the Vittoria Music Studio application. Throughout this policy, “we” and “us” mean that company.

For anything to do with privacy, write to hello@vittoriamusicstudio.com or 3948 3rd St S, PMB 418, Jacksonville Beach, FL 32250.

This site collects almost nothing. There is no advertising network, no session recording, no cross-site tracking, and no third-party analytics. Web fonts are served from our own servers rather than from Google, so that loading a page does not hand your IP address to anybody else.

If you give us your email address to hear about early access, we store that address along with anything else you chose to tell us — the size of your studio, and what software you use now. We use it to write to you about Vittoria Music Studio and for nothing else. Every message has an unsubscribe link, and asking us to delete the record removes it entirely.

Our hosting provider keeps ordinary server logs, including IP addresses, for a short period for security and abuse prevention.

Vittoria Music Studio has four kinds of user, and they are not treated the same.

• Teachers give us a name, email address, and the details of the studio they run — students, schedule, lesson notes, assignments, repertoire, invoices. A teacher is the account holder for their studio.
• Parents and guardians give us a name and email address, and are linked to the students they are responsible for.
• Students have a first name, a last name or initial, a date of birth (used to determine whether they are a minor and to route consent correctly), and the record of their own work: practice sessions and their length, pieces assigned and mastered, theory results, streaks, and any media they or their teacher record.
• Adult students are treated as their own account holder and do not require a guardian.

A student’s account for a minor is created by a teacher and activated only after a parent or guardian approves it. There is no public sign-up for a child. The children’s privacy page sets this out in full.

This list matters more than the one above, and it is a design constraint in the software rather than a promise about our intentions.

• Location. Not precise, not approximate, not from the network.
• Contacts, photo libraries, or anything else on a device beyond what is deliberately recorded in the app.
• Advertising identifiers, and no advertising or attribution SDKs of any kind.
• Third-party analytics inside the student experience.
• Biometric data. The microphone is used only for note and practice detection while a student is actively running a drill, and audio is processed for that purpose.
• Any information about a child beyond what the product needs to teach them music.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is no version of this business that involves doing so.

• Running the studio: scheduling, lesson records, assignments, repertoire tracking, and messages between a teacher and a student or guardian.
• Showing a student their own progress, and showing their teacher and their guardian that same progress.
• Invoicing and taking payment for lessons.
• Sending the notifications each person has asked for — practice reminders a student or parent set themselves, a weekly summary to a guardian, a digest to a teacher.
• Keeping the service working and secure: diagnosing faults, preventing abuse, and making backups.
• Understanding, in aggregate, whether the product does what it claims. Where we look at usage to answer that, we do it on our own infrastructure and not through an advertising company.

We do not use a student’s work to train machine-learning models, and we do not use it for any purpose outside their own studio.

Inside a studio, information flows in one shape only: between a teacher, their student, and that student’s guardian. Students cannot message each other. Nothing is public. Nothing is visible to another studio.

Outside that, we use a small number of service providers who process data on our instructions and are not permitted to use it for their own purposes.

• Supabase

  Database, authentication, and file storage

  SeesAll application data, encrypted at rest

• Stripe

  Tuition payments and teacher subscriptions

  SeesPayment details and billing contact. We never see or store full card numbers.

• Our video provider

  Storing and streaming lesson video

  SeesVideo and audio recordings only

• Our email provider

  Transactional email and digests

  SeesName and email address

• Vercel

  Website and application hosting

  SeesServer logs, including IP address

We will also disclose information if the law genuinely requires it. If that ever happens and we are permitted to tell the person affected, we will.

If the company is ever sold or merged, this policy travels with the data, and we will say so before anything changes.

Lesson payments run through Stripe. Each teacher connects their own Stripe account, and money settles to the teacher directly rather than passing through us. Card details are entered into Stripe and are never stored on our systems. We keep the record of what was invoiced, what was paid, and when.

Video is one of the most useful things in the product and the most sensitive thing in it, so it has its own rules.

• For a student under 18, a guardian must give separate, explicit consent before any video or audio of that student is recorded or uploaded. Consent to use the app is not consent to be recorded.
• That consent can be withdrawn at any time. Withdrawing it deletes the stored media, not just the permission.
• Recordings are encrypted at rest and are never public. Any share link is signed and expires.
• Sharing is limited to the teacher, the student, and that student's guardian.
• Original uploads are deleted after a retention window — twelve months by default — while the compressed streaming copy is kept for as long as the account is active.

While an account is active, we keep its data, because the whole point of the product is a record that accumulates over years. A collection of mastered pieces is worthless if it is periodically erased.

• Close a studio and we delete its data within 30 days, except where we are legally required to keep financial records.
• Financial records — invoices and payment history — are kept for seven years, which is what tax law requires.
• Server logs are kept for a short period, typically 30 days.
• Deleting a student removes their personal information and their media. Aggregate, non-identifying counts may remain.

You can ask us to do any of the following, at any time:

• Show you what we hold about you or about your child.
• Correct anything that is wrong.
• Export it. Full export is available on every plan, at any time — your studio's records are yours, and this is not a paid feature or a retention lever.
• Delete it. Deletion cascades: it removes the database records and the stored media, not just the account's ability to log in.
• Stop emailing you. Every non-essential email has an unsubscribe link.

A parent or guardian holds these rights on behalf of their child, and exercising them costs nothing and does not require a reason. Write to hello@vittoriamusicstudio.com. We will verify that the request is really coming from you, and we aim to respond within 30 days.

Depending on where you live, you may have additional statutory rights — for example under the California Consumer Privacy Act or the UK and EU General Data Protection Regulation. We extend the rights above to everyone regardless of location, and we will honour any further right the law gives you.

Data is encrypted in transit and at rest. Access to production data is limited to people who need it, authentication is required for every request, and the database enforces at the row level that one studio cannot read another’s data. Backups are taken nightly and restoring from them is tested rather than assumed.

No system is perfect. If there is ever a breach affecting personal information, we will notify the people affected and the relevant authorities as the law requires, and we will tell you what actually happened.

We operate in the United States and store data there. If you use the service from elsewhere, you are sending information to the United States, and its privacy laws are different from your own.

If we change this policy in a way that matters, we will say so in the app and by email before the change takes effect, and we will not apply a material change retroactively to information already collected under the old policy. The effective date at the top of this page always reflects the current version.

Vittoria Music Studio, LLC
3948 3rd St S, PMB 418, Jacksonville Beach, FL 32250
hello@vittoriamusicstudio.com

For anything specific to a child’s account, see Children’s Privacy, which explains what a parent can ask for and how to ask for it.