Privacy Policy

Most of what's in Recital is put there by a music school about its own students, families and teachers. That information belongs to the school, and the school decides what goes in and who can see it. We store and process it for the school, to run Recital on its behalf. If you're a parent or student, your school is the first place to go with questions about your information, though you're always welcome to contact us too.

Account details. The name, email address and password of school owners, teachers and parents who sign in. Passwords are stored scrambled (hashed); nobody at Recital can read them.

School details. The school's name, time zone, policies, web address on Recital, and the logo, banner and brand color it chooses.

What schools enter. Families' names, emails, phone numbers and addresses; students' names, instruments, birth year and teacher; lesson times, attendance, lesson notes and homework; messages between the school and families; invoices, payments and balances; teachers' contact details and pay rates.

Payments. Card payments are handled entirely by Stripe. Recital never sees or stores full card numbers. We keep a record that a payment or subscription exists, its amount and its status, plus Stripe's reference numbers.

Technical information. To keep you signed in, Recital sets a cookie that holds your sign-in session. Our hosting and database providers keep standard logs (such as IP address, browser type and the time of a request) for security and to fix problems. We don't use advertising cookies or third-party tracking.

• To run Recital: show each person the schedule, students, messages and invoices they're allowed to see.
• To send account emails, such as confirming a sign-up or resetting a password. Invitations and payment links are sent by the school from its own email.
• To bill schools for their subscription.
• To answer questions, fix problems, keep Recital secure and prevent misuse.
• To meet legal obligations, such as keeping billing records.

We don't sell personal information, we don't share it for advertising, and we don't use a school's information for anything other than running Recital for that school.

Inside a school. Each school's information is kept separate from every other school's. Within a school, the owner sees everything. Teachers see only their own schedule, students and the families of those students, and can't see money or settings. Families see only their own lessons, homework, messages and invoices, and can't see teacher pay or the school's private notes.

Recital's own team. The people who run Recital can see a school's account details (such as the owner's name and email, and how many teachers, students and families it has) to manage the service and bill for it. We look at the information inside a school only when we need to, for example to answer the school's question, fix a problem or keep Recital secure.

Companies that help run Recital. We use a small number of trusted providers, who may only use the information to provide their service to us:

• Supabase, for the database and sign-in;
• Netlify, which hosts the website;
• Stripe, for school subscriptions and tuition payments;
• Resend, which delivers account emails.

When the law requires it. We may share information if we must by law, or to protect people's safety or Recital from fraud or abuse. Where we can, we'll tell the school first.

If Recital changes hands. If Recital is sold or merged, information would move to the new owner under the same promises as this policy, and we'd tell schools first.

Many music students are children. Recital isn't meant for children to use: they don't create accounts, and family accounts belong to a parent or guardian. Information about a child is entered by their school or their parent, and the school is responsible for having permission to do so. A parent who wants to see, correct or remove their child's information can ask the school, or email us at hello@recitalmusic.com and we'll work with the school to sort it out.

We keep a school's information while it uses Recital. If a school cancels, we keep it so the school can pick up where it left off, unless the owner asks us to delete it. When we delete a school's information, it's removed within 30 days, apart from backups (which are overwritten on their normal cycle) and billing records we have to keep by law.

Recital is only reachable over an encrypted connection (HTTPS), every record is locked to the school it belongs to and the people that school allows, and passwords are hashed. No system is perfectly secure, but if we ever learn of a breach that affects your information, we'll tell the affected schools promptly.

• You can see and update most of your information in Recital itself.
• You can ask us for a copy of your information, or to correct or delete it, by emailing hello@recitalmusic.com. For information a school holds about you, we may pass your request to the school, since it's their record.
• Depending on where you live (for example California, or the EU and UK), you may have further rights under local privacy laws. We'll honor them, and we won't treat you differently for using them.

If we change this policy in a way that matters, we'll tell school owners by email or in the app before it takes effect. The date at the top shows when it last changed.