Privacy policy

The short version

• We collect what we need to teach lessons, schedule them, bill for them and keep students safe. Nothing more.
• Many of our students are children. A parent or guardian is in charge of a child’s information, and no child under 13 is given their own login at all.
• We never sell your information, and nothing from inside the studio app ever reaches an advertiser.
• There is no analytics service on the website or in the app. When we are paying for an advertisement, the public website shows a cookie banner, and only if you press Accept does it tell Facebook that a page was viewed or a form was submitted. Section 7 says exactly what that does and does not include. When no advertisement is running there is no banner and nothing from Facebook on the site at all.
• We never store card numbers.
• We do not send text messages.
• The tuner and sight reading tools use your microphone inside your own browser. Nothing is recorded, saved or sent to us.
• You can see, correct, export or delete your family’s information at any time by emailing us.

1. What this policy covers

The public website, launchpadmusicacademy.com, including the signup form; and the studio app, app.launchpadmusicacademy.com, used by our owner, manager, teachers, parents and students.

Video cameras inside the building are covered by our separate Recording and Media Consent form, summarised under “Cameras in the building” below.

2. What we collect

When you fill in the signup form

• student name, and parent or guardian name
• email address and phone number
• instruments of interest and playing experience
• the student’s age, school or grade, and whether the student is homeschooled
• days and times that could work
• how you heard about us, and who referred you

This becomes an enquiry in our studio database so we can contact you about lessons. The form is for parents, guardians and adult students. If you are under 18, please ask a parent to fill it in.

When your family has an account in the app

Accounts are created by the studio by invitation. There is no open signup.

• Account details: name, email, role, and a password stored only as a scrambled hash we cannot read.
• Student details: name, birthdate, instrument, level, and the family the student belongs to.
• Lessons: the schedule, attendance, cancellations and reschedules.
• Teacher lesson notes: what was covered and what to practise. Some notes are for parents only and are not shown on a student’s own login.
• Practice and progress: practice logs, curriculum progress, level checkpoints, and results from the sight reading and ear training tools.
• Billing: invoices, payments, account credits, and whether you are on monthly tuition or weekly pay.
• Your lesson agreement: which version you signed, the name you typed as your signature, the date and time, and the internet (IP) address it was signed from, so there is a clear record of exactly which terms you agreed to.
• Email we send you: a record of reminder and account emails, and whether the mail server accepted them.

Collected automatically

• A sign in cookie, which keeps you signed in and expires on its own.
• A cookie that remembers which link brought you here, on the public website only, and only when the link you arrived on was tagged, for example a link in an advertisement or on a flyer. It holds the tag and nothing else, lasts 30 days, and is ours: it does not follow you to any other website. It is how we can tell which advertisement or flyer actually brought a family to the studio. If you sign up, the tag is kept on our record of your enquiry.
• Your answer to the cookie banner, on the public website only, and only while an advertisement is running. One cookie of ours holding Accept or Reject, the version of this notice you answered, and the day. It lasts 180 days. You can change your answer from “Cookie choices” at the foot of every public page.
• Server logs. Our hosting provider records basic technical information when a page is requested, such as IP address, browser type and time, to keep the service running and secure.

Our typeface is served from our own domain, so loading a page does not tell anyone else you were here.

What we do not collect

• Card numbers. Card payments are handled by Stripe. Your card number goes straight to them. We keep only a reference and at most the brand and last four digits.
• Microphone recordings. The tuner and sight reading tools process sound inside your own browser to show a pitch or check a note. It is never recorded, stored or uploaded, and we never receive it. You can withdraw microphone permission in your browser at any time.
• Text messages. We do not text, and we use no texting service.
• Location tracking, contact lists, or social media logins.

3. How we use it

• to reply to enquiries and set up lessons
• to schedule lessons, match a student with a teacher, and run the studio calendar
• to teach: lesson notes, practice assignments and progress
• to send lesson reminders and account emails
• to bill tuition, record payments, and handle refunds and credits
• to keep a record of the lesson agreement each family signed
• to keep students, teachers and the building safe
• to run, secure and fix the website and app
• to meet legal, tax and accounting duties

We may send occasional studio news, such as recital dates. Every one of those emails has a way to opt out, and opting out never stops lesson reminders or billing emails.

We do not sell personal information. We do not use it to build profiles for anyone else. We do not use it to train any automated system, and no feature here sends it to one. The one thing we send an advertising company, and only if you pressed Accept while an advertisement is running, is set out in full in section 7.

4. Children under 13

We follow the Children’s Online Privacy Protection Act (COPPA).

No child under 13 gets their own login. The app will not create one, and it will not create one for a student with no birthday on file either. Children under 13 take lessons through their parent’s account, which shows the schedule, the notes and the invoices. A child cannot sign the lesson agreement; only a parent, guardian, adult student or studio staff can.

Where information about a child comes from. Mostly from the parent, through the signup form, at enrollment, and in the parent’s own account. The rest comes from the child’s teacher, as lesson notes and progress.

Nothing a child enters is public. There is nowhere in the app to post publicly, families cannot see each other, and students cannot message anyone. Messages in the app run one way, from the studio to you.

Who can see it: the child’s parent or guardian, the child’s teacher, and studio management. Outside the studio it reaches only the service providers listed below, who store and deliver it for us, or where the law requires. We disclose children’s information to nobody for advertising or for any purpose of their own.

A parent or guardian of a child under 13 can at any time review what we hold about their child, ask us to correct it, ask us to delete it, or tell us to stop collecting and using it. Email us from the address on your family account, or ask Grant Fithen in person. We will confirm you are the child’s parent or guardian before acting, and we will respond within 30 days.

5. Teens 13 to 17

Students aged 13 to 17 are still minors. A parent or guardian signs the lesson agreement, manages billing, and may exercise the same review, correction, export and deletion rights on their teen’s behalf.

6. Who we share it with

Only the companies we rely on to run the studio, and each gets only what it needs.

• Railway hosts the website and app, on servers in the United States.
• Turso hosts our database, on Amazon Web Services servers in the United States.
• Google delivers our email.
• Stripe processes card payments under its own privacy policy. That includes paying for a group class term on the signup form: your card details are typed on Stripe’s own page and never reach us. Your name, email address and phone number go with the payment so Stripe can send you a receipt.
• Facebook, and only while we are paying for an advertisement, receives the signal described in section 7. It gets nothing from the studio app, and nothing at all when no advertisement is running.

Inside the studio, a teacher sees their own students only, and never a family’s billing or contact details. Our manager sees students, scheduling and billing, but never teacher pay.

We may also share information:

• when required by law, a court order, or a government request we are bound to follow
• to report suspected child abuse or neglect, as Texas law requires
• to protect the safety of a student, teacher or anyone else in an emergency
• with our lawyer or insurer, if needed to handle a claim
• if the business is sold or reorganised, in which case this policy continues to apply to information collected under it, and we will tell families first

7. Advertising

We sometimes pay for an advertisement, usually on Facebook or Instagram, to tell people in Amarillo that the studio exists. None of what follows happens inside the studio app. The app where your lessons, teacher notes and invoices live carries no advertising tag of any kind, and never will.

When no advertisement is running, which is the normal state, there is nothing from Facebook on this website at all. No tag, no script, no request. You can check by viewing the page source.

When one is running, the public pages show a banner with two equal buttons, Accept and Reject. Nothing from Facebook loads until you press Accept. Closing the page, scrolling past the banner or pressing Reject all mean no, and the signup form works exactly the same either way. If you press Accept, the public pages carry Facebook’s measurement tag. It tells Facebook that a page was viewed, and separately that somebody submitted the signup or the group class waiting list form. That second message is the only way we can find out whether an advertisement produced any enquiries at all. Our own server sends its copy of that message only if you pressed Accept.

What goes with that message: the fact that a form was submitted, the address of the page it was on, and the email address and phone number from the form turned into an irreversible string of letters and numbers before they leave our server. Facebook can use that string to tell whether it already knows you. It cannot read your address or your number back out of it.

If you pay for a group class term on the signup form and you pressed Accept, one further message goes to Facebook once the payment has actually cleared: that a purchase happened and what it cost. It carries the same hashed email address and phone number and nothing else. It is sent from our server rather than from your browser, and it is not sent at all if the card does not go through.

What is never sent: your email address or phone number as you typed them, anybody’s name, a child’s age, instrument, school or anything else about them, anything a teacher wrote, anything about lessons, attendance, practice or billing, and anything at all from inside the studio app.

If you accepted, Facebook’s tag also sets its own cookie on the public website, and uses what it receives under its own privacy policy. You can withdraw that at any time from “Cookie choices” at the foot of every public page, and blocking third party scripts in your browser stops all of it too. The signup form works exactly the same either way. The cookies we set ourselves, the sign in cookie, the link cookie and your banner answer, need no consent and are the only ones the site sets on its own.

8. Cameras in the building

Spacecamp Studios has security cameras in the lesson rooms and common areas, there for the safety of students and teachers alike. That footage is not part of the website or app, and it is never posted and never used for marketing.

Photographs and video for promotion are a separate thing entirely, and happen only with a parent’s permission, asked first.

9. How long we keep it

• Enquiries that do not enroll: deleted 24 months after our last contact.
• Active families: kept while a student is enrolled.
• Practice logs, tool results and curriculum progress: deleted 12 months after the student leaves, or sooner if a parent asks.
• Teacher lesson notes and attendance: deleted 12 months after the student leaves, unless needed for a billing question or a safety matter.
• Invoices, payments and refunds: kept 7 years for tax and accounting, then deleted.
• Signed lesson agreements: kept 4 years after the last lesson.
• Safety or incident records involving a minor: kept until the student turns 20, or longer while a claim is open.
• Sign in sessions: expire on their own.
• Former staff and teacher accounts: access removed the day they leave.

When a period ends we delete the information, or strip out everything that identifies a person.

10. How we protect it

• All traffic to the website and app is encrypted.
• Passwords are stored as hashes, never as text anyone could read.
• Access follows role: a teacher sees only their own students, and pay records are the owner’s alone.
• Two factor sign in is on for every account that can reach family information, and is checked each quarter.
• Only a small number of people can reach the database directly.
• A teacher’s access is removed the day they stop teaching with us.
• We keep a written information security program describing all of this.

No system is perfectly secure. If a breach affects your information we will tell you without unreasonable delay and within the time Texas law requires, and we will notify the Texas Attorney General where the law requires it. Parents of children will hear from us in days, not at the outer edge of what the law allows.

11. Your choices and rights

Any parent, guardian or adult student can:

• see what we hold about you or your child
• correct anything wrong, much of it yourself in the app
• export a copy of your family’s records
• delete your information or your child’s
• opt out of studio news using the link in the email
• turn off microphone access in your browser

Email launchpadmusicacademy@gmail.com with the subject “Privacy request” and the student’s name. We confirm your identity using the email on your account and respond within 30 days.

When we delete a family’s information we may still keep the few records we are required or allowed to keep, such as invoices for tax, or a signed agreement while money is owed or a dispute is open. We will tell you what we kept and why.

12. Where it is stored

Everything is stored in the United States. Launchpad is a local studio in Amarillo, Texas and does not offer its services outside the United States.

13. Changes to this policy

If we change this policy we will update the date at the top. If a change affects how we use children’s information, or uses your information in a way you have not agreed to, we will email families first and, where the law requires, ask again.

14. Contact

Launchpad Music Academy
Attn: Grant Fithen, Owner
818 SW 7th Avenue, Amarillo, TX 79101
launchpadmusicacademy@gmail.com

See also our terms of service and our accessibility statement.