Privacy Policy
Last updated: August 20, 2026
Musichaus is a lesson management service for independent music teachers and small music studios, operated by 1001674563 Ontario Inc. (“Musichaus”, “we”, “us”), a corporation registered in Ontario, Canada. This policy explains what personal information we handle, why, who we share it with, and the choices you have. It applies to the Musichaus application, our website at musichaus.org, and the notifications we send.
1. Who is responsible for your information
Two different relationships run through Musichaus, and it matters which one you are in.
- Teachers and studios decide what happens to their students’ information. A teacher chooses which students to add, what lesson notes to write, what files to upload, and how long to keep them. For that information the teacher or studio is the controller, and Musichaus acts as their service provider (processor), handling it on their instructions.
- Musichaus is responsible for its own relationship with you. Account registration, subscription billing, security, support, and the messages we send you are ours, and we are the controller for those.
If you are a student or parent and want a lesson record changed or removed, the fastest route is usually your teacher. You can always contact us directly and we will help.
2. The three kinds of account
| Account | Who holds it and what it can see |
|---|---|
| Teacher | The teacher or studio owner. Sees their own students, schedule, lesson records, uploads, invoices and payouts. Cannot see any other studio’s data. |
| Parent / guardian | Sees their own children’s schedule, lesson notes shared with them, uploads, invoices and payment history. Gives consent on behalf of a child. |
| Student | Sees their own schedule, assignments, practice records and materials. A student under 13 receives access only through an invitation link issued after their parent or guardian has consented (see section 6). |
3. What we collect
| Category | Examples |
|---|---|
| Teacher account | Name, email, phone number, studio name, business address, time zone, login credentials, subscription and payout details |
| Parent account | Name, email, phone number, billing details, relationship to the student |
| Student record | Name, age or date of birth, instrument and level, lesson schedule, attendance, teacher’s lesson notes, practice logs, assignments, progress and reward records |
| Uploaded files | Audio recordings, video, sheet music and other lesson materials uploaded by a teacher, parent or student |
| Payments | Invoices, amounts, packages and credits, payment status and payout records. Card numbers are handled by Stripe and never stored by Musichaus. |
| Communications | Messages sent inside the app between teacher, parent and student, and the email or SMS notifications we send |
| Technical | Device and browser type, IP address, timestamps, and log and error data needed to run and secure the service |
We ask for what the service needs and no more. In particular, we do not ask students for information that is not relevant to their lessons.
4. Recordings, video and sheet music
Musichaus provides general-purpose file storage as part of a lesson management tool. We do not select, supply or curate lesson materials, and we host no library of our own — teachers, parents and students upload whatever their lessons need, such as practice recordings, video, sheet music and notes. These files are private by default: they are visible only to the student, that student’s parent or guardian, and the student’s own teacher. They are not public, not indexed by search engines, and never shown to another studio. Files are served through time-limited links, and are deleted when the person who uploaded them, or the teacher who owns the studio, deletes them.
A recording of a lesson or performance may capture a child’s face and voice. Where the student is a minor, recording and any sharing beyond the people listed above requires the parent or guardian’s consent.
Anyone uploading sheet music or other copyrighted material is responsible for having the right to do so; this is covered in our Terms of Service.
5. Why we use it, and our legal bases
| Purpose | Legal basis (where GDPR/UK GDPR applies) |
|---|---|
| Running the service: scheduling, attendance, notes, uploads, messaging, invoicing | Performance of a contract |
| Sending account notifications by email | Performance of a contract |
| Sending text message notifications | Consent |
| Taking payments and paying teachers out | Performance of a contract; legal obligation |
| Security, abuse prevention, troubleshooting | Legitimate interests |
| Improving the product using aggregate, non-identifying usage data | Legitimate interests |
| Tax, accounting and other legal requirements | Legal obligation |
We do not use personal information for behavioural advertising or profiling, we do not sell personal information, and we do not use students’ information to build advertising profiles.
6. Children
Most music students are children, so this section matters more here than in most software.
How a child gets access
A child never creates their own account. A teacher adds a student record and invites the parent or guardian. The parent or guardian creates the account, reviews what Musichaus collects, and gives consent. A student record stays inactive until they do.
The Student Portal — the child’s own view of their lessons — is off by default. After consenting, the parent or guardian decides separately whether to turn it on. If they do, they open it and hand the access to their child themselves; they can switch it off again at any time. A child cannot sign up, request access, or be given access by anyone other than their parent or guardian.
What we do and do not do
- A child’s account is limited to their own lessons, materials and practice records.
- Contact details on file for a student under 13 are the parent’s or guardian’s. Text messages and billing notices go to the parent or guardian — never to a child’s own number.
- Recordings, video and photos of a student are private by default and shared only with that student’s teacher and parent unless the parent consents to more.
- We do not show advertising to children, build advertising profiles, or allow public profiles, public posting, or contact between children in different studios.
- We do not condition a child’s participation in lessons on giving more information than is necessary.
Parent and guardian rights
A parent or guardian may at any time review the information held about their child, ask for it to be corrected, refuse further collection, or ask that it be deleted — through their own account, through the teacher, or by writing to us at the address in section 15. If a parent withdraws consent, we deactivate the child’s access and delete the child’s information, except anything the teacher must keep for tax or accounting reasons.
These practices are designed to meet the requirements of Canadian privacy law (including Quebec’s Law 25), the U.S. Children’s Online Privacy Protection Act, and, where they apply, the GDPR and UK GDPR rules on children’s consent.
7. Text messages
We send SMS only to people who have given express consent by ticking a dedicated consent checkbox and providing their own mobile number. Messages are limited to lesson reminders, schedule changes, and invoice notifications. Message frequency varies; message and data rates may apply. Reply STOP at any time to unsubscribe, or HELP for help — every message we send carries opt-out instructions. Opting out does not affect your ability to use Musichaus.
We keep a record of each consent: who gave it, when, by what method, and the wording they agreed to, along with a record of every opt-out. We keep those records for as long as we message the number and for a reasonable period afterwards, because messaging rules in Canada and the United States require a business to be able to demonstrate consent. The numbers we send from are registered with the carriers as required.
Teachers can also message students and parents through Musichaus. Teachers are responsible for what they send and are prohibited from using our messaging for advertising or promotional purposes — and in particular from sending any marketing to a student who is a minor. See section 10 of our Terms of Service.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party, except with our messaging provider strictly to deliver the messages you asked for.
8. Payments
Two kinds of payment run through Musichaus, and both are processed by Stripe.
- Teacher subscriptions. Teachers pay Musichaus for the use of the software.
- Lesson fees. Parents may pay their teacher’s invoices by card inside the app. The money is collected by Stripe and paid out to the teacher’s connected account.
Card numbers, expiry dates and security codes are entered directly into Stripe and are never stored on Musichaus systems. We keep the invoice, the amount, the date, the status, and the last four digits of the card so that teachers, parents and we ourselves can keep proper records. Teachers who accept card payments also provide Stripe with the identity information Stripe requires to comply with financial regulations.
9. Who we share information with
We share information only where it is needed to run the service. We do not sell it, and we do not give it to anyone for their own marketing. The table below names every company that handles personal information on our behalf, exactly what reaches them, and why. Each one may use that information only to provide its service to us, under a written contract.
| Who receives it | What we share | Why |
|---|---|---|
| The student’s own teacher or studio | The student’s record: name, contact details, schedule, attendance, notes, files, invoices | To deliver and manage the lessons |
| The student’s parent or guardian | Their own child’s schedule, shared notes, materials, invoices and payment history | To follow their child’s lessons and pay for them |
| Twilio (messaging provider, USA) | The recipient’s mobile number and the text of the message being sent — nothing else. No lesson notes, no files, no payment details. | To deliver the SMS notifications the recipient asked for. Twilio may not use the number for its own purposes. |
| Email delivery provider | The recipient’s name and email address, and the content of the email being sent | To deliver account and lesson emails |
| Stripe (payments) | Payer name, email, invoice amount and reference; card details are entered directly into Stripe and never pass through us. For teachers accepting card payments, the identity and bank details Stripe requires by law. | To take subscription and lesson payments and pay teachers out |
| Supabase (database and file storage, hosted in Canada) | All account, lesson and file data, stored encrypted on our behalf | To store and serve the data the application runs on |
| Hosting and error-monitoring providers | Technical logs, IP addresses and error reports; not lesson content | To run the application and diagnose faults |
| Professional advisors, authorities, acquirers | Only what is necessary in the circumstances | Where required by law, to protect rights and safety, or in connection with a merger or sale — in which case this policy continues to apply until you are notified otherwise |
We do not share children’s information with anyone beyond this list, and none of these providers may use a child’s information for advertising, profiling, or any purpose of their own.
Each studio’s data is kept logically separate. One studio cannot see another studio’s students, lessons, files or records.
10. Cookies and analytics
We use cookies and similar technologies that are necessary to keep you signed in, remember your settings, and keep the service secure. We may use privacy-respecting analytics to understand how the product is used in aggregate. We do not use advertising cookies or third-party trackers for advertising, and we do not track users across other websites. Where the law requires consent for non-essential cookies, we ask for it.
11. Where information is stored
Our database and file storage are hosted in Canada. Some service providers listed in section 9 process information in the United States or elsewhere. Where personal information leaves the country it was collected in, we rely on appropriate safeguards — including the European Commission’s standard contractual clauses and the UK addendum where those apply — and the information remains subject to this policy. Information handled in Canada or the United States may be accessible to courts and authorities in those countries under their laws.
12. How long we keep it
| Active accounts | For as long as the account is open |
| Deleted student records | Removed from the studio immediately; purged from backups within 90 days |
| Closed teacher accounts | Exportable for 30 days after closure, then deleted or de-identified |
| Invoices and payment records | Retained as long as tax and accounting law requires |
| Security and access logs | Typically 12 months |
13. Security
We use encryption in transit, row-level access controls that separate each studio’s data, time-limited links for uploaded files, hashed credentials, restricted administrative access, and logging of administrative actions. No system is perfectly secure. If a breach affects your information, we will notify affected users and the relevant regulators as the law requires.
14. Your rights
Wherever you live, you can ask us to:
- tell you what information we hold about you, and give you a copy
- correct information that is wrong or out of date
- delete information, subject to records we must keep by law
- stop sending email or SMS notifications
- withdraw a consent you previously gave
If the GDPR or UK GDPR applies to you, you also have the right to restrict or object to processing, the right to data portability, the right not to be subject to decisions based solely on automated processing (we do not make such decisions), and the right to complain to your supervisory authority. If Canadian federal or provincial privacy law applies, you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner. Residents of U.S. states with privacy legislation have the rights those laws give them, including the right not to be discriminated against for exercising them.
Write to us at the address in section 15 and we will respond within the time the applicable law allows. We may need to verify your identity first.
15. Other sites, changes, and contact
Musichaus may link to other websites, such as our payment provider. We are not responsible for their privacy practices; please read their policies.
If we make a material change to this policy we will post the updated version here, update the date at the top, and notify users directly where required.
1001674563 Ontario Inc. (Musichaus)
8 Wellesley St. W, Unit 1702
Toronto, Ontario M4Y 0J5, Canada
support@musichaus.org
Musichaus is a product of 1001674563 Ontario Inc., Toronto, Ontario, Canada.