Privacy Policy

Echoes Piano Studio, operated by Edel Vazquez in Amman, Jordan, provides private piano instruction and operates this service for students, parents or guardians, and authorized studio staff.

Privacy questions and requests may be sent to echoes.piano.studio@icloud.com.

Depending on how you use the studio and portal, we may collect:

• student and parent/guardian names, contact details, and relationships;
• lesson schedules, attendance, notes, progress information, and make-up credits;
• invoices, payment records, account balances, and receipt information;
• messages, notification preferences, portal activity, IP addresses, device information, and security records;
• profile photos and learning materials that authorized users upload; and
• trial-booking details and information voluntarily provided to the studio.

The CRM does not store full payment-card details. Payments handled outside the CRM remain subject to the payment provider's own privacy practices.

We use information to:

• schedule and deliver lessons and studio services;
• provide secure parent and student portal access;
• send lesson reminders, portal codes, invitations, invoices, receipts, and lesson communications;
• manage billing, attendance, materials, support requests, and studio records;
• protect the service, investigate errors, and prevent unauthorized access; and
• comply with legal, accounting, and safeguarding obligations.

When you have agreed to receive studio communications, Echoes Piano Studio may use WhatsApp Business Platform, provided by Meta, to send the relevant lesson, scheduling, billing and studio messages to your WhatsApp number. Meta/WhatsApp processes the destination number, message content, attachments and delivery information needed to provide that service, under its own terms and privacy practices.

The CRM keeps outgoing communication and delivery records to manage the requested service and investigate delivery problems. It does not import WhatsApp chat history or store incoming message content or incoming contact numbers from webhook events. Messages you send to the studio may still be available to the studio in its separate WhatsApp Business App. PDFs sent in chat are separate copies; protected lesson links follow the portal’s existing access and retention rules.

Contact the studio through its published support details to change communication preferences or stop WhatsApp notifications. The studio handles these requests manually; its CRM does not monitor incoming WhatsApp messages automatically.

A portal user may optionally subscribe to a private calendar feed using Google Calendar, Apple Calendar, Outlook, or another compatible calendar application. The subscription does not require the user to authorize Echoes Piano Studio to access their calendar account, and Echoes Piano Studio never receives or stores the user's calendar password.

The private feed contains only studio events visible to that portal account. It is one-way and read-only: calendar applications retrieve Echoes lesson information, but changes made inside a subscribed calendar do not change studio records. The CRM does not receive unrelated events or other data from the user's calendar account.

The feed URL includes a private token and should not be shared. Users can disable the feed or reset its token from the portal at any time, which prevents the previous link from receiving future data.

Portal users may optionally enable device notifications in a supported browser or Home Screen web app. The browser creates a device-specific push subscription that Echoes Piano Studio stores only to deliver requested portal alerts. Users can disable the subscription from Portal Account settings or their device settings.

Lock-screen alerts use privacy-conscious wording and do not include student names, lesson details, invoice amounts, or message contents by default. Opening an alert requires the user's normal authenticated portal session to view the underlying information.

We share information only as necessary to operate the studio and service, including with hosting, database, email-delivery, file-storage, and calendar-integration providers. These providers process information on our behalf for the requested service. We may also disclose information when required by law, to protect safety or rights, or during a legitimate business transfer.

We do not sell personal information.

We use access controls, encrypted connections, private storage, private calendar-feed tokens, backups, and operational monitoring to protect information. No online system can guarantee absolute security.

We keep studio records for as long as needed to provide services, maintain legitimate educational and accounting records, resolve disputes, and meet legal obligations. Data that is no longer required is deleted or anonymized where reasonably possible.

Security audit records retain email, IP-address, and browser metadata for up to 90 days, after which those fields are removed while the event history remains available for accountability. Expired login codes, expired invitation tokens, and obsolete signed-in device sessions are removed after 30 days.

The studio serves children as well as adults. Information about a child is collected in connection with lesson services and managed through the child's parent or guardian where appropriate. Guardians should contact the studio if information is inaccurate or portal access should change.

You may ask to access, correct, export, or delete personal information, subject to identity verification and any records the studio must retain. You may also change reminder preferences, disable or reset a private calendar feed, or ask the studio to disable portal access.

To request access, correction or deletion of information held by Echoes Piano Studio, use the studio contact details on this privacy page. Identify the student or guardian account concerned; do not send passwords, login codes or payment-card details. The studio will verify your authority and respond to the request. Information needed for accounting, legal obligations or another legitimate retention requirement may need to be retained. Deleting CRM records does not remove copies of messages or attachments already held by recipients or external messaging services.

We may update this policy when the service or legal requirements change. The current version and its update date will remain available on this page.