Privacy Policy

Welcome to Craft Music ("Company", "we", "our", "us"). We respect the privacy of our users and are committed to protecting it through our compliance with this policy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit the website craft-music.com (our "Website") and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to information we collect: on this Website; in email, text, and other electronic messages between you and this Website; and through mobile and desktop applications you download from this Website, which provide dedicated non-browser-based interaction between you and this Website.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Website.

We collect several types of information from and about users of our Website, including information:

• Personal Identity Information: By which you may be personally identified, such as name, postal address, e-mail address, telephone number, or any other identifier by which you may be contacted online or offline.
• Account Information: When you register for an account, we collect your username, password, and other credentials used to access the Service.
• Payment Information: If you make a purchase, we collect billing information, such as your billing address and payment method details. Note that we do not store full credit card numbers; these are processed by our secure third-party payment processors.
• Technical Data: About your internet connection, the equipment you use to access our Website, and usage details. This includes IP addresses, browser type, operating system, and platform.
• Lesson and Platform Data: Booking and scheduling details; teacher–student match information; Lesson Hub notes, assignments, and music-library files; chat or in-lesson messages; and, when features are used, audio/video session streams, technical call logs, and lesson recordings or session captures.

We collect this information through various methods:

• Directly from you: When you provide it to us by filling in forms on our Website, registering, booking lessons, uploading materials, or requesting services.
• Automatically as you navigate or use lessons: Usage details, IP addresses, cookies and similar technologies, and technical data from our lesson-room and infrastructure providers (for example, connection quality metrics).
• From teachers and other users: Information they share about lessons, notes, files, or communications in shared spaces such as Lesson Hub.
• From third parties: Payment processors, video/lesson infrastructure providers, analytics providers, and—when we elect to run screening—consumer-reporting or identity-verification vendors.

We use information that we collect about you or that you provide to us, including any personal information:

• To present our Website and its contents to you.
• To operate our marketplace: match students and teachers, schedule and deliver online or in-person lessons, process payments and payouts, and provide Lesson Hub / music library features.
• To process lesson audio/video and related session data so online lessons function, and—where recordings or captures exist—for quality assurance, safety, support, dispute resolution, training, and Service improvement.
• To provide customer support and service notices (including account, billing, and lesson reminders).
• To carry out our contracts and enforce our Terms, teacher agreements, and policies.
• To improve and personalize the Service, including analytics.
• To detect, prevent, and investigate fraud, abuse, or security incidents.
• Where you have consented or as otherwise allowed by law, for limited marketing communications (you may opt out of promotional emails).

We do not sell lesson recordings as a standalone consumer product. Marketing use of identifiable lesson recordings beyond ordinary Platform operation is limited as described in our Terms of Service and this Policy, or undertaken with additional consent where required.

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information. Cookies are files with small amount of data which may include an anonymous unique identifier.

Examples of Cookies we use:

• Session Cookies: We use Session Cookies to operate our Service.
• Preference Cookies: We use Preference Cookies to remember your preferences and various settings.
• Security Cookies: We use Security Cookies for security purposes.
• Advertising Cookies: Advertising Cookies are used to serve you with advertisements that may be relevant to you and your interests.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose personal information that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support our business (e.g., cloud hosting, video/lesson infrastructure, analytics, email delivery, payment processing, and—when used—identity or background-screening vendors).
• To specific third parties for the purpose of marketing their products or services to you if you have consented to such disclosures.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Craft Music's assets.
• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

Security procedures are in place to protect the confidentiality of your data. We use encryption and other technical and organizational measures to protect your information.

Our data protection mechanisms for personal and sensitive data (including account credentials, payment-related information handled by our processors, lesson and platform data, and—when used—identity or screening information) include:

• Encryption in transit: We use TLS/HTTPS encryption to protect data transmitted between your browser or app and our Service.
• Encryption at rest: Where our hosting and infrastructure providers support it, data stored on our systems is protected using encryption at rest.
• Access controls: Access to personal data is limited to authorized personnel and systems on a least-privilege / need-to-know basis, with authentication controls for administrative access.
• Credential protection: Account passwords are stored using industry-standard hashing (not in plain text). We do not store full payment card numbers; card data is processed by our PCI-compliant payment processors.
• Vendor safeguards: We use reputable third-party service providers (for example, cloud hosting, payment processing, video/lesson infrastructure, and email delivery) under contractual obligations to protect data they process on our behalf.
• Monitoring and incident response: We maintain operational monitoring and take steps to investigate and respond to suspected security incidents affecting personal data.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your Personal Data, we cannot guarantee absolute security.

Craft Music may use Google APIs when you choose to sign in with Google and/or connect Google Calendar to sync lesson events. This section describes how we access, use, store, protect, share, and delete Google user data. Google Calendar data is treated as sensitive data and is protected by the safeguards described below and in "Data Protection and Security" above.

• Access: With your authorization, we may access basic Google account identity information needed for Sign-In (such as name and email, as permitted by the scopes you approve) and, if you connect calendar sync, Google Calendar data needed to create, update, or remove lesson-related calendar events. We request only the minimum scopes required for these features, and calendar access is optional — you can use Craft Music without connecting Google Calendar.
• Use: We use Google user data only to authenticate you on Craft Music and to provide the calendar sync features you enable. We do not use Google user data for advertising, and we do not sell Google user data.
• Storage: We store OAuth tokens and the minimum calendar metadata required to keep your lessons in sync (for example, the identifiers of events Craft Music created). Google user data is stored on access-controlled infrastructure operated by our cloud hosting provider in the United States, logically separated from other users' data.
• Protection of sensitive data: Google user data, including Google Calendar data and OAuth tokens, is protected by: encryption in transit using TLS/HTTPS on every connection between your device, our servers, and Google's APIs; encryption at rest on our databases and backups; OAuth access and refresh tokens held in encrypted storage and never exposed to browsers, client-side code, or logs; least-privilege access controls that limit Google user data to the specific application services and the small number of authorized personnel who need it to operate or support the feature, with authenticated administrative access; and operational monitoring with an incident-response process for suspected unauthorized access. We do not store your Google account password at any time — authentication is handled by Google.
• Sharing: We do not share Google user data with third parties except with subprocessors that help us operate the Service (for example, secure cloud hosting) under contractual confidentiality and security obligations, when required by law, or with your direction. Transfers are limited to providing or improving user-facing features you request, security, legal compliance, or a business transfer as described elsewhere in this Policy.
• Retention and deletion: We retain Google user data only for as long as your Google Calendar connection remains active. If you disconnect Google Calendar in your Craft Music account settings, or revoke Craft Music's access at myaccount.google.com/permissions, we revoke and delete the associated OAuth tokens and stored calendar data and stop accessing your Google Calendar. You may also request deletion of your Google user data at any time by emailing support@craft-music.com; we action such requests within 30 days. Google user data is also deleted when you delete your Craft Music account.
• No AI/ML training: We do not use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models, and we do not allow humans to read your Google user data except with your explicit consent for a specific issue you have raised, where required for security or to comply with applicable law, or on data that has been aggregated and anonymized.
• Limited Use: Craft Music’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Our Service does not address anyone under the age of 13 ("Children") as an account holder without appropriate parental/guardian involvement. We do not knowingly collect personally identifiable information from anyone under the age of 13 without verifiable parental consent where required. If you are a parent or guardian and you are aware that your Children has provided us with Personal Data improperly, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent where required, we take steps to remove that information from our servers.

Parents and guardians who book lessons for minors remain responsible for supervising the minor's participation in online or in-person lessons.

When Craft Music elects to verify a teacher's identity or obtain a consumer/screening report, we may process related personal data (for example, legal name, ID document images for verification, or results returned by a screening vendor). We use this information only to evaluate Platform eligibility, display verification badges where applicable, investigate complaints, and protect users—not for unrelated marketing.

As stated in our Terms of Service, Craft Music does not guarantee that every teacher has been background-checked. Screening is discretionary and may vary by lesson type or risk factors. Screening-related data is protected under the same Data Protection and Security controls described above.

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

If you are located outside the United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to the United States and process it there. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data. If you wish to be informed what Personal Data we hold about you and if you want it to be removed from our systems, please contact us.

In certain circumstances, you have the following data protection rights:

• The right to access: You have the right to request copies of your personal data.
• The right to rectification: You have the right to request that we correct any information you believe is inaccurate.
• The right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing: You have the right to request that we restrict the processing of your personal data.
• The right to object to processing: You have the right to object to our processing of your personal data.
• The right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "effective date" at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

If you have any questions about this Privacy Policy, please contact us:

• By email: support@craft-music.com
• By visiting this page on our website: Contact Us