Privacy Policy
1. The short version
- We never sell personal information.
- Schools stay in control of their student records; we process them on the school’s behalf.
- You can export your data and ask to be forgotten.
- We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. See SMS / text messaging.
2. What we collect
Your contact information stays yours. Your email address, address, and phone number are used only to deliver communications you’ve chosen to receive and to sign you in. Messages are addressed to people, and bandMajor does the delivering.
Account information (name, address, email, optional phone, and photo); roster records your program creates about its members (grade, section, sizes, guardian relationships, and (encrypted and access-restricted) medical notes); content you post (messages, photos, documents, forms); financial records your program keeps (fees, payments, and fundraiser credits, though card numbers stay with our payment processor); and technical logs (IP, device, and activity records kept for security and auditing).
3. How we use it
To run the Service for your program: deliver messages, build calendars, track instruments and payments, and keep an audit trail; to keep users safe (automated content screening, guardian visibility, abuse prevention); to secure and improve the Service; and to send transactional email you expect (confirmations, notifications you opt into).
4. Student data & FERPA/COPPA
Where a school or district adopts bandMajor, we act as a “school official” with a legitimate educational interest under FERPA, processing education records only as directed by the institution. We rely on the school or program to obtain any parental consent required (including COPPA consent where applicable), and we support state student-privacy laws that prohibit targeted advertising to students and secondary uses of student data.
5. No advertising
bandMajor carries no advertising. There are no ad units anywhere in the Service, no advertising or ad-measurement scripts on any page, and no advertising profiles. We do not sell, rent, or license personal information to anyone, and we do not disclose personal information to third parties or affiliates for their marketing or promotional purposes.
6. Cookies & tracking technologies
We use a small number of first-party cookies that are strictly necessary to run the Service: to keep you signed in, remember your active organization and your light/dark theme choice, and protect against fraud and abuse. We do not use cross-site trackers or third-party analytics that follow you around the web, and no advertising or tracking scripts load anywhere in the Service. Because we don’t track across sites, there is nothing for a browser “Do Not Track” or Global Privacy Control signal to opt out of; we honor those signals as a request to limit any optional analytics on our public marketing pages.
7. When we share
With your program, according to its roles and settings; with your district, where your program belongs to one, whose administrators see program-level totals (membership counts, instrument inventory and its value, outstanding balances) and can look up instruments across programs to arrange transfers and loans, but not individual student records, messages, or payment details; with processors that help us run the Service (hosting, email and text-message delivery, payments) under contracts that limit their use of data; when the law requires it (we tell the affected organization unless prohibited); and in a merger or acquisition, where this policy continues to apply to collected data.
Mobile numbers and text-messaging consent are narrower than the above: they go only to the provider that delivers your messages, never to third parties or affiliates for marketing or promotional purposes, and are never sold.
8. SMS / text messaging
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Sharing with subcontractors that provide support services, such as the messaging provider that delivers these messages, is permitted. All other categories in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
We collect your mobile number, your name, and the date and time you gave consent, solely to deliver the messages you asked for. Message frequency varies with your program’s activity, typically 0 to 5 messages per week. Message and data rates may apply. Reply STOP to opt out or HELP for assistance.
How consent is obtained. Texts are off until you turn them on, and only you can turn them on: the consent box is ticked by you, signed in to your own account. We never buy or rent phone lists. Your consent is recorded with its date and time in an append-only audit log. Messages come from bandMajor and carry announcements from your director, schedule and call-time changes, emergency alerts, and account notices such as fee balances.
How to stop. Reply STOP to any message, or untick the box in your profile at any time. Reply HELP for assistance, or email support@bandmajor.com. Opting out of texts never affects your access to bandMajor.
Your number is passed to our messaging provider for the sole purpose of delivering these messages, under a contract that forbids any other use.
9. Security
Data is encrypted in transit and at rest; sensitive fields (like medical notes) carry additional per-person encryption; access inside a program is role-based; administrative access is logged. No system is perfectly secure. Report concerns to security@bandmajor.com.
10. Retention & your rights
We keep data while your account or program is active and as required for audit and legal obligations. You can export your data from your profile at any time. You can request erasure (“right to be forgotten”): after a grace period, personal data is anonymized in place and encryption keys for protected fields are destroyed. Schools can direct us to delete their students’ records. California, Virginia, and other state residents may have additional rights (access, correction, deletion, portability). Use the same contacts to exercise them; we do not discriminate for doing so.
11. Children
Students under 13 do not get bandMajor accounts. A parent or guardian holds the account and adds their child by name; the child never signs in, and we collect nothing from the child directly. Everything about them comes from a parent or from the program’s own records. Their director reviews and approves the child’s roster record before it becomes active, and we keep a record of which parent provided it and when.
A child under 13 still has their own roster record, because a program needs one to assign them a locker, issue equipment, and track fees. All communication about that child goes to their guardians’ accounts. There is no inbox for the child to receive it in.
Where a school or program adopts bandMajor directly, we also rely on the institution to establish any consent COPPA requires. We do not knowingly collect personal information from children outside these two paths; if you believe we have, email privacy@bandmajor.com and we will delete it.
12. Changes & contact
We will post any material changes here with a new effective date and notify organizations in the Service. Questions: privacy@bandmajor.com · Tapawingo Labs Inc., Virginia, USA.