Privacy policy

1. Who we are

Auruments ("we", "us") runs auruments.com, a marketplace for music lessons, learning materials, events and instruments, and the Teacher Studio tools. We are responsible for the personal data described here. Contact us about privacy at support@auruments.com.

This policy is written to meet the Nigeria Data Protection Act 2023, Canada's PIPEDA, and, where they apply, the GDPR and UK GDPR.

2. What we collect

• Account: name, email, phone (optional), password (stored only as a secure hash), time zone, profile photo, and your answers to the sign-up quiz.
• Learners and children: the names, and if given the date of birth, of the students a parent or guardian manages.
• Teachers: profile, intro video, instruments, languages, prices, availability, studio and masterclass locations, and payout account status (bank details are held by Stripe or Paystack).
• Activity: bookings, lesson plans, purchases, tickets, gear orders, reviews, teachers you like or follow, your notifications, reports you make, messages sent through the platform, and practice notes, links, photos and audio clips teachers share with their students.
• Payments: amounts, currencies, dates and payment references. Never full card numbers.
• Teacher Studio: details a teacher or music school keeps about their own students: contact details, instruments and levels, lessons and attendance, lesson packages, exam preparation, recital pieces, invoices, payments, registration forms, signed studio policies (with the time, IP address and device used to sign), and progress reports. Music schools may also keep their teachers' and office staff's names, emails, roles and pay rates, pay figures worked out from lessons taught, and HR records: instruments, bio and qualifications, start date, emergency contact, weekly hours, time off, cover requests, onboarding and compliance checklist dates (for a background check, only its status and dates, never the certificate), which school policies they have read, and the owner's private notes. Never bank details.
• Studio plans: if you subscribe to Studio Pro or Studio Premium, your plan, its dates and your payments to Auruments. Cards are held by Stripe or Paystack; we keep only the card brand and last four digits.
• Invoice card payments: when a family pays a school's invoice by card, the amount, date and payment reference are recorded on that invoice. Card details are handled by Stripe or Paystack and never reach Auruments.
• School pages and enquiries: what a school chooses to publish on its page, and the teachers who agreed to be shown. Enquiries sent from a school page are emailed straight to the school; Auruments doesn't keep a copy.
• Technical: IP address and device information in server logs (for security and rate limiting), and analytics events if you allow them.

3. Why we use it, and our legal basis

• To provide the service you asked for (contract): accounts, bookings, payments, payouts, emails about your lessons and orders.
• To meet legal duties (legal obligation): tax and accounting records, responding to lawful requests.
• To keep Auruments safe (legitimate interests): checking teachers, preventing fraud and abuse, handling reports, securing accounts.
• To improve and promote Auruments (consent or legitimate interests): analytics only with your consent; occasional tips and reminders, which you can turn off at any time from the link in each email.

4. Children

Students under 18 use Auruments through a parent or legal guardian, who holds the account, manages the student's profile and gives consent, which we record with the date. Teachers' own registration forms ask a parent or guardian to confirm the same. We collect only what lessons need, never show children's full names publicly, and never sell or share children's data for marketing.

5. Who we share it with

Within a teacher's or school's Studio: a parent or adult student who signs in with the email address on their record, after confirming it, can see that student's lessons, instruments, packages, exam progress, recital pieces, progress reports sent to them and issued invoices, but never the teacher's private notes. The teacher can turn this off. A teacher who works for a music school sees the lessons they teach there (student name, instrument, time and place), not the family's contact details or what they pay. Printed recital programmes show names in the style the school chooses (by default, first name and initial). An office admin a school appoints can see and manage the school's Studio records, but not staff pay rates, payroll, the school's plan or the owner's private staff notes. Staff can see and update their own HR profile, hours, time off, the school's policies and their own pay statements, and can choose whether they appear on the school's public page. Studio analytics are worked out inside Auruments from the Studio's own records and are not sent to analytics providers.

These providers act on our instructions and must protect your data. We may also share data when the law requires it, or with a buyer if Auruments is sold, under this same policy.

6. Where your data is stored

Our database is hosted in the United States, so your data may be processed outside your country, including outside Nigeria, Canada or Europe. We use providers with recognised safeguards (such as standard contractual clauses), encrypt data in transit, and restrict who can access it.

7. How long we keep it

8. Cookies and similar storage

• Essential (always on): keeping you signed in, and remembering your currency, language, cookie choice and any invite code you arrived with.
• Analytics (only if you allow): PostHog, to see which pages help people find a teacher. Change your choice any time with "Cookie settings" at the bottom of every page.

We don't use advertising cookies.

9. Your rights

Depending on where you live, you can:

• Get a copy of your data. Download it yourself at Your privacy & data.
• Correct it, in your profile and settings, or by asking us.
• Delete your account yourself, on the same page. Some records are kept as explained in section 7.
• Object to, or withdraw consent for, analytics and tips at any time.
• Complain to a regulator: the Nigeria Data Protection Commission, the Office of the Privacy Commissioner of Canada, or your local authority in the EU or UK.

For anything else, email support@auruments.com. We reply within 30 days.

10. Security

Passwords are stored as Argon2 hashes, connections are encrypted, database access is locked down with row-level security, admin sign-in needs a second step, and nightly backups are kept for 14 days. No system is perfectly secure; if a breach puts you at risk, we will tell you and the regulators as the law requires.

11. Google Calendar

Connecting Google Calendar is optional. You can use Auruments fully without it, and disconnect at any time in Calendar sync or in your Google Account settings. If you connect it, we ask Google for two permissions:

• Create and update events (calendar.events): we add your Auruments lessons, masterclasses and tickets to your calendar, and update or remove them when they change or are cancelled. For a teacher's online lesson that has no video link, we add a Google Meet room to the lesson event and share its link with your student. We only change events Auruments created. We don't read, change or delete your other events.
• See when you're free or busy (calendar.freebusy): for teachers who turn this on, we check the start and end times of busy periods in the next 4 weeks so students can't book a lesson when you're busy. We never see the titles, descriptions, locations or guests of your events.

What we store: your Google email address (to show which account is connected), the sign-in token Google gives us (encrypted with AES-256), the ids of the events we created, the Google Meet link of an online lesson (saved on that lesson so both of you can join), and the start and end times of your busy periods.

What we never do: we don't sell Google data, use it for advertising, share it with other users or third parties, or use it to train AI models. Busy times are used only to hide lesson slots and are never shown to anyone. Auruments staff don't read this data, except with your permission, to investigate a security issue, or where the law requires it.

Removing it: when you disconnect, or delete your Auruments account, we remove upcoming Auruments events from your calendar, revoke our access with Google, and delete the token, event ids and busy times we stored.

Auruments' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Changes

We'll update the date above when this policy changes, and email you about important changes.