Acceptable Use Policy

Last updated: 16 September 2025

Applies to: All users of My Music Studio (teachers, students, parents, accompanists, administrators)

1. Purpose

This Acceptable Use Policy (“AUP”) sets out the rules for using My Music Studio (the “Service”). By using the Service, you agree to follow this AUP.

2. Prohibited Content

You must not upload, share, or transmit any content that:

• Is unlawful, offensive, defamatory, obscene, or discriminatory
• Contains nudity, sexual material, or violence
• Infringes copyright, trademarks, or other intellectual property rights
• Contains malware, viruses, or harmful code
• Promotes spam, scams, or fraudulent activity

3. Prohibited Conduct

You must not use the Service to:

• Harass, bully, threaten, or abuse other users
• Impersonate any person, teacher, student, or organization
• Create fake accounts or misrepresent your identity
• Attempt to access, modify, or delete data without authorization
• Interfere with the security or operation of the Service
• Circumvent payment obligations (e.g., trying to use premium features without a subscription)
• Collect or harvest data about other users without consent

4. Student & Child Safety

Special rules apply when dealing with minors:

• Teachers/schools must obtain appropriate parental consent before creating or managing student accounts.
• No user may attempt to contact a student outside the scope of lesson-related communication authorized by the student’s parent or school.
• Sharing of inappropriate, harmful, or non-educational content with students is strictly forbidden.

5. Reasonable Use of "Unlimited" Features

Some subscription plans (including the Free Forever plan) may state that certain features, such as the number of students, are "unlimited." "Unlimited" means without a fixed numerical cap, within the normal and reasonable operation of a single teacher or studio using the Service for their own students.

Accounts that attempt to exploit "unlimited" features for purposes outside of normal studio teaching (for example, by enrolling excessive numbers of fake or unrelated accounts, or using the Service for non-teaching purposes) may be reviewed, and we reserve the right to restrict, suspend, or terminate access where necessary.

6. Enforcement

We reserve the right to:

• Suspend or terminate accounts that violate this AUP
• Remove any content that breaches this policy
• Report unlawful activity to appropriate authorities

7. Reporting Violations

If you become aware of any misuse of the Service, please report it to info@mymusicstudio.app.

Data Processing Addendum (DPA)

Effective Date: [Insert Date]

Between: Data Controller: The school, teacher, or educational institution using the Service (“Controller”) Data Processor: My Music Studio App, operated by Hildy Essex, sole trader (ABN 95 193 197 623) (“Processor”)

This Data Processing Addendum (“DPA”) forms part of the Terms & Conditions and Privacy Policy of My Music Studio (the “Service”).

1. Subject Matter & Duration

The Processor will process Personal Data on behalf of the Controller in connection with provision of the Service. Processing will continue for as long as the Controller uses the Service, unless otherwise terminated.

2. Nature & Purpose of Processing

The Processor processes Personal Data solely to:

• Provide the Service (lesson management, practice logs, scheduling, exams, performances, communication tools).
• Maintain and improve the Service.
• Meet legal obligations.

The Processor will not use Personal Data for advertising or marketing without the Controller’s explicit consent.

3. Categories of Data Subjects

Data subjects may include:

• Students (including minors)
• Parents/guardians
• Teachers and accompanists
• School administrators

4. Categories of Personal Data

The Processor may process:

• Identification data: names, email addresses, phone numbers, school affiliation, role (teacher, parent, student)
• Student data: date of birth, gender, enrollment details, instruments studied, lesson times and schedules, attendance, assessments, practice logs, uploaded media, notes, shared files
• Parent/guardian data: contact details, relationship to student, emergency contact designation
• Teacher/accompanist data: contact details, instrument/role, status, rates, notes
• School-level data: lesson types, attendance rules, events, exams, performance details (date, time, location, program notes)

No special categories of data are intentionally collected, unless entered at the Controller’s discretion.

5. Obligations of the Processor

The Processor shall:

• Process only on documented instructions from the Controller, unless required by applicable law.
• Ensure persons authorized to process Personal Data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see Appendix B – Annex II).
• Assist the Controller in responding to data subject requests (access, correction, deletion, portability, restriction, objection).
• Assist with data protection impact assessments (DPIAs) and prior consultations where required.
• Notify the Controller of any personal data breach without undue delay and in any case within 72 hours.
• Delete or return all Personal Data at the end of the provision of services within 30 days, unless retention is required by law.
• Allow for and contribute to audits and inspections, subject to reasonable notice and confidentiality.

6. Sub-Processors

The Controller authorizes the Processor to engage trusted sub-processors (e.g., Supabase, Stripe, Brevo) as necessary to provide the Service. The Processor shall ensure sub-processors are bound by obligations equivalent to this DPA. A current list is included in Appendix A.

7. International Transfers & Standard Contractual Clauses

7.1 General Rule

The Processor may transfer and process Personal Data outside the jurisdiction in which the Controller or Data Subjects are located where necessary to provide the Service.

7.2 EU / EEA Transfers

For transfers from the EEA to a third country without an adequacy decision, the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module 2 – Controller→Processor) including the Docking Clause are incorporated by reference. Annexes are in Appendix B.

7.3 UK Transfers

For transfers subject to UK GDPR, the UK Addendum to the EU SCCs (vB.1.0) applies. Completed tables are in Appendix C.

7.4 Swiss Transfers

For transfers subject to Swiss FADP, the SCCs apply as adapted for Swiss law (see Appendix D).

7.5 Transfer Impact Assessments

The Processor will conduct/document TIAs and implement supplementary measures (encryption, access controls, minimisation) where required.

7.6 Sub-Processor Flow-Down

The Processor will ensure sub-processors used for transfers are bound by equivalent obligations to the SCCs and this DPA.

8. Controller Obligations

The Controller shall:

• Obtain necessary parental/guardian consent where required.
• Ensure data provided is accurate and lawful.
• Use the Service in compliance with applicable data protection laws.

9. Liability

Each party’s liability under this DPA is subject to the limitations of liability set forth in the Terms & Conditions.

10. Governing Law

This DPA is governed by Victoria, Australia, except the SCCs/addenda are governed as specified in Appendices B–D.

11. Signatures

This DPA is entered into by the parties as of the Effective Date.

Controller By clicking “I Agree” (or equivalent) in the Service, the Controller is deemed to have executed this DPA as of the Effective Date recorded in the Processor’s systems.

Processor My Music Studio App — Hildy Essex, Sole Trader (ABN 95 193 197 623) Signature: Hildy Essex Date: 4th October 2025

12. Order of Precedence

If there is a conflict: SCCs prevail, then this DPA, then the Terms & Conditions.

Appendices

Appendix A – Authorized Sub-Processors

• Supabase, Inc. — 970 Toa Payoh North #07-04, Singapore 318992

Function: hosting/database/storage/logs | Locations: EU/US | Safeguards: SCCs + UK/Swiss addenda

• Netlify, Inc. — 2325 3rd St, Suite 296, San Francisco, CA 94107, USA

Function: hosting/CDN | Locations: Global (incl. US) | Safeguards: SCCs + UK/Swiss addenda

• Hostinger International Ltd. — 61 Lordou Vironos St, 6023 Larnaca, Cyprus

Function: domain/DNS/email routing | Locations: EU/global | Safeguards: N/A within EEA; SCCs if outside

• Stripe, Inc. (and affiliates) — 354 Oyster Point Blvd, South San Francisco, CA 94080, USA

Function: payments | Locations: Global (US/EU) | Safeguards: SCCs + UK/Swiss addenda

• Sendinblue SAS (Brevo) — 106 boulevard Haussmann, 75008 Paris, France

Function: email | Locations: EU (FR/DE) | Safeguards: N/A within EEA

Change Management: 15 days’ prior notice; Controller may object on reasonable data-protection grounds.

Appendix B – EU Standard Contractual Clauses (SCCs, Module 2)

The SCCs (Decision (EU) 2021/914, Module 2 — Controller→Processor) incl. Docking Clause are incorporated by reference.

Annex I – Parties & Processing

• Exporter (Controller): Any school/teacher using the Service

Address: As provided at registration | Contact: Account admin email

• Importer (Processor): My Music Studio App (Hildy Essex, ABN 95 193 197 623)

Address: PO Box 4, Holmesglen, VIC 3148, Australia | Contact: privacy@mymusicstudio.app (Subject matter, duration, categories, frequency, retention: as described above.)

Annex II – Security Measures Access controls/least privilege/MFA; TLS in transit & encryption at rest; RLS tenant isolation; monitored logging; secure backups & tested restore; sub-processor vetting; incident response (≤72h notice); secure SDLC & CI/CD.

Annex III – Sub-Processors As listed in Appendix A.

Appendix C – UK Addendum (ICO)

Applies to UK GDPR transfers. Parties as above; SCCs: Module 2; Annexes I–III apply; governing law/courts: England & Wales.

Appendix D – Swiss Addendum (FDPIC)

For Swiss FADP transfers: interpret EU/Member State as Switzerland; authority = FDPIC; governing law = Switzerland; rights enforceable in Switzerland.

Privacy Policy

Last updated: 4 October 2025

Company: Operated by Hildy Essex, sole trader trading as My Music Studio App ABN: 95 193 197 623 Service: My Music Studio (the “Platform”, “Service”, “we”, “our”, “us”)

We are committed to protecting your privacy and handling your personal information responsibly and transparently. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

At a Glance: How We Protect Your Data

• We only collect information needed to provide the Service (lesson management, practice logs, schedules, exams, performances, communication tools).
• Teachers/schools must obtain parental consent before adding student accounts.
• Student data is visible only to the student, their parent/guardian, and their teacher.
• We use trusted service providers for hosting, payments, and email (Supabase, Netlify, Hostinger, Stripe, Brevo).
• We comply with relevant privacy laws including the Australian Privacy Principles (APPs), GDPR (EU/UK), and COPPA (US).
• Parents, students, and schools can access, correct, or request deletion of data at any time.
• We will never sell your data or use it for advertising.

1. Information We Collect

1.1 Personal Information

When you sign up or use the Service, we may collect:

• Name
• Email address
• Role (teacher, parent, student, accompanist, admin)
• Phone number
• School or studio affiliation
• Relationship to student (parent, guardian)
• Emergency contact designation (if provided)

1.2 Student Data

We may store:

• Full name
• Date of birth
• Instrument studied
• Lesson status (active, paused, withdrawn)
• Enrollment date and history
• Lesson times, duration, and type
• Attendance records (present, late, absent, billing flags, quotas, make-up rules)
• Practice logs and assessment results
• Lesson notes and shared files
• Uploaded media (audio, video, images, documents)
• Embedded links
• Program participation (performances, exams, events)

1.3 Parent/Guardian Data

We may store:

• Name
• Email address
• Phone number
• Relationship to student
• Emergency contact designation

1.4 Teacher & Accompanist Data

We may store:

• Name
• Email address
• Instrument taught or role
• Employment status
• Pay rate or billing settings (if entered)
• Administrative privileges and account link status
• Notes or annotations

1.5 School & Administrative Data

We may also collect:

• Lesson type definitions (name, duration, price, category)
• Attendance type definitions (labels, codes, outcomes, billing rules, make-up rules)
• School settings and preferences

1.6 Event & Exam Data

We may store:

• Performance dates, times, and locations
• Programs, program notes, participating students
• Exam dates, times, levels, and student assignments

1.7 Usage & Technical Data

When you use the Service, we may collect:

• Browser type, device type, and operating system
• IP address
• Pages visited and features used
• Time spent in the Service
• Crash logs and diagnostics
• Analytics and usage trends

1.8 Payment Information

Payments are processed securely by third-party providers (e.g., Stripe, PayPal). We do not store full credit card numbers.

2. How We Use Information

We use information to:

• Provide, maintain, and improve the Service
• Manage lessons, schedules, attendance, and events
• Support teachers in administering studios and schools
• Allow parents and students to access lesson notes and practice tools
• Communicate with you about updates, support, or billing
• Process payments
• Troubleshoot and improve features
• Comply with legal obligations

We will never sell or share your information for marketing.

3. Sharing Your Information

We may share your information only:

• With trusted third-party providers (Supabase, Netlify, Hostinger, Stripe, Brevo) strictly as needed to operate the Service
• If required by law, legal process, or government request
• With your consent or direction (e.g., teachers sharing lesson notes with parents, schools publishing programs)

4. Children’s Privacy

We take children’s privacy seriously.

• If you are under the age of 13 (or 16 in some jurisdictions), you must have permission from a parent or legal guardian to use the Service.
• Teachers and schools are responsible for obtaining verifiable parental consent before creating student accounts or entering student data.
• We comply with relevant child privacy laws, including the Children’s Online Privacy Protection Act (COPPA) in the U.S. and the Australian Privacy Principles (APPs).
• Student information is only visible to the relevant teacher, the student, and their parent/guardian (if applicable).

5. Data Storage and Security

• Data is stored securely using encryption and access controls.
• Hosted with Supabase and other secure providers.
• Regular backups and monitoring are in place.
• No system is completely secure; we cannot guarantee absolute protection.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your data
• Correct inaccurate information
• Request deletion (“right to be forgotten”)
• Restrict or object to processing
• Withdraw consent (where applicable)
• Data portability (EU/UK users)

Requests: info@mymusicstudio.app. We may verify your identity before fulfilling requests.

7. Data Retention

• We retain data as long as your account is active.
• Teachers may delete student accounts at any time.
• Closed accounts → data deleted or anonymised within a reasonable period (unless law requires retention).
• Free accounts inactive for 12 months may be deleted (after advance email notice).

When a school account is deleted by its administrator, all associated user accounts (teachers, parents, and students) and their personal data are permanently deleted from our systems. Deletion is irreversible and includes all lesson data, files, and communications linked to that school. This deletion is initiated and authorized by the school administrator, not by My Music Studio.

8. Third-Party Links

Our Service may include links to third-party websites (e.g., YouTube). We are not responsible for their privacy practices or content.

9. International Users

• Data may be processed in Australia or other jurisdictions.
• By using the Service, you consent to transfers.
• For EU/UK customers, a Data Processing Addendum (DPA) applies (see separate document).

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the Service or email. Continued use of the Service after changes means acceptance.

11. Cookies and Local Storage

We use cookies and local storage only as necessary to:

• Maintain login sessions
• Remember settings/preferences
• Improve performance

We do not use third-party advertising cookies.

12. Contact Us

My Music Studio App Operated by Hildy Essex, Sole Trader ABN: 95 193 197 623 Email: info@mymusicstudio.app Website: www.mymusicstudio.app Address: PO Box 4, HOLMESGLEN, VIC 3148

Refund & Billing Policy

Last updated: 16 September 2025

1. Subscriptions & Billing

• Subscriptions are billed in advance, either monthly or annually, depending on the plan selected.
• Payments are processed securely via Stripe. We do not store full payment details.
• Subscription fees are inclusive/exclusive of taxes as stated at checkout.

2. Trials & Free Plans

• Free trials may be offered for limited periods.
• At the end of a trial, accounts automatically revert to the free plan unless you actively choose a paid subscription.

3. Refunds

• Subscription fees are non-refundable, except as required by law.
• Partial refunds are not offered for unused time if you cancel mid-cycle.
• If you experience service issues caused by us that prevent reasonable use of the Service, please contact info@mymusicstudio.app. Refunds may be considered on a case-by-case basis.

4. Cancellations

• You can cancel your subscription at any time from within your account settings.
• Your subscription will remain active until the end of the current billing period.
• After cancellation, your account will revert to the free plan, and premium features will no longer be available.

5. Changes to Plans

• You may upgrade or downgrade plans at any time.
• Upgrades take effect immediately, and a pro-rata charge may apply.
• Downgrades take effect from the next billing cycle.

6. Contact

For billing or refund enquiries, please contact: info@mymusicstudio.app

Terms of Service

Last updated: 16 September 2025

Welcome to My Music Studio ("the App", "we", "us", or "our"). These Terms of Service ("Terms") govern your use of the My Music Studio platform, including all content, features, tools, and services.

Company: Operated by Hildy Essex, sole trader trading as My Music Studio App ABN: 95193197623 Service: My Music Studio (the “Platform”, “Service”, “we”, “our”, “us”)

1. Acceptance of Terms

By creating an account, accessing, or using My Music Studio, you agree to be bound by these Terms & Conditions and our Privacy Policy. If you do not agree, you must not use the Service.

2. Accounts & Eligibility

• You must be at least 18 years old to create a teacher or parent account.
• If you are under 13, you may only use the Service with verifiable parental consent.
• Student accounts may only be created by, or with the consent of, a parent, guardian, or school.
• You are responsible for maintaining the security of your account credentials and for all activity under your account.
• We may suspend or terminate accounts that violate these Terms.

School Administrator Responsibility

Each school using My Music Studio designates one or more administrator accounts. Administrators are solely responsible for creating, managing, and deleting user accounts (including teachers, parents, and students) within their school.

If a school administrator deletes the school’s account, all associated user accounts and data for that school will be permanently deleted and cannot be recovered. My Music Studio does not retain backup copies of deleted school data beyond standard system logs required for security and audit purposes.

3. Subscriptions, Trials & Billing

• We offer free and paid subscription plans. Features available depend on the plan selected.
• Trials may be offered for limited periods. At the end of a trial, the account will revert to the free plan unless the user actively upgrades to a paid subscription.
• Paid subscriptions are billed at the rate shown at the time of purchase.
• Fees are inclusive/exclusive of applicable taxes as stated.
• Payments are processed by third-party providers.
• Except as required by law, fees are non-refundable.

4. Use of the Service

You agree to use the Service only for lawful purposes. You must not:

• Upload, share, or transmit content that is unlawful, offensive, defamatory, obscene, discriminatory, or infringes the rights of others
• Harass, abuse, or threaten other users
• Impersonate others or create fake accounts
• Attempt to copy, modify, reverse engineer, or distribute the Service
• Interfere with the Service’s operation or security

Teachers and schools are responsible for obtaining appropriate parental consent before creating student accounts or sharing student data.

In addition, you must comply with our Acceptable Use Policy, which forms part of these Terms. The Acceptable Use Policy contains additional rules on prohibited conduct, data security, student safety, and enforcement.

Where a plan includes "unlimited" features (such as unlimited students), usage remains subject to our Acceptable Use Policy.

5. User Content & Intellectual Property

• You retain ownership of all content you upload, including lesson notes, media, and files.
• By uploading content, you grant us a worldwide, non-exclusive, royalty-free license to host, display, and process that content solely to provide and improve the Service.
• We do not claim ownership of your content and will never use it for advertising or commercial purposes without your permission.
• All intellectual property in the Platform (including code, design, logos, and trademarks) remains our property and may not be copied or used without our permission.

6. Privacy & Data Protection

Our collection and use of personal data is governed by our Privacy Policy, which forms part of these Terms. Please read it carefully, as it explains how we collect, use, and protect your information.

For student data:

• Teachers/schools act as “data controllers” and are responsible for compliance with applicable privacy laws.
• My Music Studio acts as a “data processor” and will only process student data to provide the Service.
• We take student privacy seriously. Any personal or lesson-related data entered into the Service will be stored securely, visible only to the relevant teacher, student, and parent (if applicable), and will never be sold or shared with third parties for marketing purposes.

7. Third-Party Links

The Service may contain links to third-party websites or services (such as YouTube). We are not responsible for the content, accuracy, or security of any third-party services, and use of those services is at your own risk.

8. Service Availability & Changes

• We strive to keep the Service available and functional, but we do not guarantee uninterrupted access.
• We may modify, suspend, or discontinue features at any time without liability.
• We will provide reasonable notice of material changes where possible.

9. Termination & Suspension

• You may close your account at any time.
• We may suspend or terminate your account if you breach these Terms, fail to pay fees, or misuse the Service.
• On termination, your access will cease, and we may delete your data in accordance with our data retention policy.

10. Disclaimers & Limitation of Liability

• The Service is provided “as is” and “as available” without warranties of any kind.
• We are not responsible for the quality of lessons, outcomes of teaching, or offline interactions between users.
• To the maximum extent permitted by law, our liability is limited to the amount you paid to us in the 12 months preceding the claim.
• We are not liable for indirect, incidental, or consequential damages, including loss of data, profits, or reputation.

11. Indemnification

You agree to indemnify and hold harmless My Music Studio App, its directors, employees, and affiliates from any claims, damages, liabilities, and expenses arising out of your use of the Service, your content, or your breach of these Terms.

12. Governing Law & Dispute Resolution

These Terms are governed by the laws of Victoria, Australia.

• Any disputes will first be attempted to be resolved through good-faith negotiations.
• If unresolved, disputes must be submitted to the courts of Victoria, which shall have exclusive jurisdiction.

13. Changes to Terms

We may update these Terms from time to time. We will notify users of material changes by posting a notice on the Platform or by email. Continued use of the Service after changes take effect constitutes acceptance of the updated Terms.

14. Contact Information

If you have questions about these Terms, you can contact us at:

My Music Studio App Email: info@mymusicstudio.app Website: www.mymusicstudio.app Address: PO Box 4, HOLMESGLEN, VIC 3148