Privacy Policy

Last updated: July 16, 2026 · Draft (pending legal review)

This Privacy Policy describes how Sonotempo collects, uses, and discloses your information, and your privacy rights. Sonotempo is operated by Vastocielo LLC.

Because Sonotempo serves music students who may be children under 13, this policy includes a Children's Privacy section that complies with the Children's Online Privacy Protection Act (COPPA). If you are a parent or guardian, please read that section carefully.

Interpretation and Definitions

Words with initial capitals have the meanings defined below, whether singular or plural.

• Company (referred to as "the Company", "We", "Us" or "Our") refers to Vastocielo LLC, 940 Tall Pine Dr, Port Orange, FL 32127.
• Service refers to the Sonotempo application and website, accessible from https://www.sonotempo.com.
• Teacher means an adult (18+) account holder who provides music instruction through the Service as an independent professional.
• Guardian means a parent or legal guardian who holds an account and manages one or more Student profiles for a minor.
• Student means a person who receives music instruction through the Service. A Student who is a minor participates through a Guardian's account structure.
• Child means a Student under the age of 13, as defined by COPPA.
• Personal Data (or "Personal Information") is any information that relates to an identified or identifiable individual.
• Service Provider means any natural or legal person who processes data on behalf of the Company to facilitate or provide the Service.
• Account means a unique account created for You to access our Service.
• Device means any device that can access the Service.
• Usage Data refers to data collected automatically, generated by use of the Service or from the Service infrastructure itself.
• You means the individual accessing or using the Service, or the legal entity on whose behalf such individual is acting.

Information We Collect

From Teachers and Guardians (adults)

• Account information: name, email address, and password credentials.
• Profile and studio information you choose to provide (e.g., bio, instruments taught, availability).
• Billing information for Teachers: payments are processed by Stripe; We do not store full payment card numbers.
• Content you author in the Service: lesson plans, feedback, notes, messages, schedules.
• Timezone (a coarse regional setting used for scheduling; not precise location).

About Students (including Children)

Student information is provided by the Guardian, the Teacher, or — where a Guardian has permitted an older Student to have their own login — by the Student. See the Children's Privacy section for the complete description of information relating to Children, how We use it, and Guardian rights.

• Student's name and date of birth (used for age-appropriate account structure and safety settings).
• Musical profile: instrument, level, interests, goals, focus areas, and teacher notes.
• Educational records created through use of the Service: lesson plans, feedback, homework, goals, milestones, practice logs, and progress/achievement data (streaks, personal bests, badges).
• Scheduling data: bookings, lesson times, titles, and notes.
• Messages within the Service's messaging feature (subject to the safety controls described below).
• For Students with their own login only: login email, and any optional profile content they add (e.g., bio, favorites). Publicly visible content (such as testimonials) is not available to minor Students — see "What Other Users Can See."

Usage Data (collected automatically)

Our application does not use advertising identifiers, device fingerprinting, third-party analytics, or cross-site tracking, and does not itself store unique device identifiers.

Our infrastructure Service Providers may automatically log standard technical data at the platform level in order to operate and secure the Service — for example, IP address, browser type and version, timestamps, and diagnostic/error data (Supabase for authentication, Vercel for hosting, Sentry for error monitoring). This data is used only to operate, secure, and debug the Service.

Cookies

We use only essential and functional cookies:

• Necessary / Essential Cookies (Session): authenticate users, maintain your signed-in session, and prevent fraudulent account use. The Service cannot be provided without them.
• Functionality Cookies (Persistent): remember choices you make (such as login persistence or interface preferences).

We do not use advertising cookies, analytics cookies, web beacons, tracking pixels, or similar tracking technologies. You can instruct your browser to refuse cookies, but parts of the Service may not function without essential cookies.

How We Use Your Personal Data

We use Personal Data only to operate the Service:

• To provide and maintain the Service, including connecting Teachers with Students, scheduling, lesson planning, practice tracking, messaging, and progress features.
• To manage Your Account and registration.
• To perform the contract for subscriptions purchased through the Service.
• To contact You with transactional communications: service emails such as lesson reminders, booking confirmations, messages notifications, security notices, and important changes to the Service or its policies. We send transactional email only; We do not send marketing or promotional email.
• To generate teaching materials: at a Teacher's request, We use an AI Service Provider (Anthropic) to help generate lesson plans and pre-lesson briefs from the relevant Student's educational records. See "Service Providers" and the Children's Privacy section.
• To keep the Service safe: enforcing the requirement that a Teacher pass a background check before being connected to or messaging a minor, security monitoring, and error diagnosis.
• To manage Your requests and support inquiries.
• For business transfers: Personal Data may be evaluated or transferred as an asset in a merger, acquisition, or sale of assets, subject to the notice commitments below and, for Children's data, the limits in the Children's Privacy section.

What We do not do. We do not sell Personal Data. We do not run advertising and do not share data with ad networks or data brokers. We do not use behavioral tracking. We do not permit any Service Provider to use Personal Data to train artificial-intelligence models or for any purpose of its own.

Service Providers (with whom data is shared)

We share Personal Data only with the Service Providers below, only so they can perform services that operate Sonotempo, and not for any independent purpose of theirs. Each is bound by contractual terms restricting its use of the data. We do not share Personal Data with affiliates, business partners, or third parties for advertising, promotional, or other outside purposes.

We may also disclose Personal Data where required by law, to respond to valid legal process, to enforce our agreements, or to protect the rights, property, or safety of the Company, our users, or the public.

What Other Users Can See

Sonotempo has no public areas and no content feed. Nothing a Student does on Sonotempo is published publicly by default.

• A Student's information is visible to their own Teacher and their linked Guardian(s).
• A Guardian manages their minor Student's participation and can review the Student's profile, schedule, and progress from their guardian account. A minor Student participates only through the Guardian's account structure.
• A Teacher must pass a background check before they can message or be connected to a minor, and the Service is built to enforce this.
• Minors do not author any publicly visible content. Public testimonials and any other publicly visible content may be submitted only by Guardians and adult (18+) Students. A minor Student's content (including any testimonial-style content) is never made publicly available and is visible only to their Teacher and linked Guardian(s). This is a deliberate design choice: Sonotempo does not make a Child's personal information publicly available, consistent with COPPA (16 CFR § 312.2).

Retention of Your Personal Data

We retain Personal Data only as long as reasonably necessary for the specific purposes for which it was collected, and We do not retain Children's Personal Data indefinitely. Our written data retention policy, including the schedule for Children's data required by 16 CFR § 312.10, is set out in the Children's Privacy section below and applies as stated there.

For adult (Teacher and Guardian) data:

• Account information: duration of the account relationship, plus up to 24 months after closure to handle post-termination issues and disputes.
• Support correspondence: up to 24 months from ticket closure.
• Platform logs (IP addresses, access logs, error data): up to 90 days for all users — platform logs are not segregated by user age, so the shorter period required for children's data governs the whole platform — unless needed for an active security investigation.
• Billing records: as required by tax and accounting law.

We may retain data beyond these periods only where required by law, to resolve disputes or enforce agreements, or in encrypted backups pending routine deletion cycles. When retention ends, data is deleted or anonymized.

Delete Your Personal Data and Your Rights

You may update or delete your information from within your Account settings, or contact Us at support@sonotempo.com to request access to, correction of, or deletion of your Personal Data. Guardians have additional rights over their child's data described in the Children's Privacy section. We may retain certain information where We have a legal obligation or lawful basis to do so.

Depending on your state of residence, you may have additional rights under state privacy law. Sonotempo does not sell or share Personal Data as those terms are defined under such laws.

Children's Privacy (COPPA)

Sonotempo is a platform where independent music teachers work with their students. Some students are children under 13, so we comply with the Children's Online Privacy Protection Act (COPPA). This notice explains — in plain language — what information we collect relating to your child, how we use it, who else touches it, how long we keep it, and the rights you have as a parent or guardian.

The short version: your child participates only through your guardian account and with your consent. You can see everything your child does on Sonotempo. We collect only what the music-lesson service needs, we never sell it, we show no ads, and no company we work with may use your child's data for its own purposes — including training AI models. You can review or delete your child's information, or stop collection entirely, at any time.

Who we are (the operator)

• Company: Vastocielo LLC (operating Sonotempo)
• Address: 940 Tall Pine Dr, Port Orange, FL 32127
• Email: support@sonotempo.com
• Phone: 386.259.2692
• Contact page: https://www.sonotempo.com/contact

Vastocielo LLC is the sole operator collecting personal information through Sonotempo and responds to all parent inquiries.

How children participate: Guardian Accounts

A child cannot sign up for Sonotempo. Instead:

• You (the guardian) create the account. You hold the login and are the consenting adult.
• Your child is a profile you manage. There is no child login — you operate everything, and your child authors nothing without you.
• A supervised login for older children may be offered in the future — only with your permission. It is not available today; every child currently participates through your guardian account.
• We ask for your child's date of birth to set the right account structure and safety settings. Children under 13 receive the COPPA protections in this notice regardless of account type.

What information we collect relating to your child

Provided by you or your child's teacher:

• Your child's name and date of birth (and the resulting age)
• Timezone (a coarse regional setting for scheduling — never precise location)
• Musical profile: instrument, level, interests, goals, focus areas, and the teacher's notes

Created through using the service:

• Lesson plans, lesson feedback, homework, goals, and milestones relating to your child
• Practice logs (what was practiced, notes)
• Progress and achievement data: streaks, personal bests, drill metrics, badges, assigned practice tools
• Lesson schedules (bookings, times, titles, notes)

Only if you have permitted your child to have their own login (collected from the child):

• Their login email address
• Messages they write (subject to the safety controls below)
• Practice log entries they write
• Optional profile content: bio, favorites, testimonials, musical journey, uploaded images/avatar

What we do NOT collect from children: audio or video recordings, precise geolocation, biometric information, government identifiers, advertising identifiers, or device fingerprinting. Our app has no third-party analytics and no advertising trackers. Our infrastructure providers do log IP addresses (a persistent identifier under COPPA) at the platform level, solely to keep the service secure and functioning. Those logs are never used to contact anyone, build profiles, or serve advertising — we ensure this by operating no advertising or profiling systems at all, and through our providers' contractual limits on how they may use the data.

For a guardian-managed child, the only email address on file is yours — we hold no contact information for the child.

How we use this information

Only to run the music-lesson service:

• Connecting your child with their teacher; scheduling and lesson management
• Practice tracking, progress, and motivational features (streaks, badges)
• Messaging between your family and the teacher, with the safety controls below
• Generating teaching materials: your child's teacher can ask our AI service provider (Anthropic) to help draft a lesson plan or a pre-lesson brief from your child's lesson records — this exists solely to help the teacher teach your child
• Safety: the background-check gate a Teacher must pass before being connected to or messaging your child, plus security monitoring
• Service operation: transactional emails (like lesson reminders — sent to you for a guardian-managed child), error diagnosis, and security

We never: sell your child's data; show ads or share data with advertisers or data brokers; use behavioral tracking; or allow anyone — including our AI provider — to train AI models on your child's data.

Can my child make information public?

No. Sonotempo has no public areas for children. Your child's information is visible only to their teacher and to you. Three structural safety rules apply to every minor and cannot be switched off:

1. A background check gates every Teacher. No Teacher can teach, message, or be connected to your child until they have passed a background check; the Service is built to enforce this and to block any Teacher who has not.
2. Your child participates through your account. For a guardian-managed child there is no separate child login — you hold and operate the account.
3. Your child authors no public content. Nothing your child does on Sonotempo is shown beyond their own Teacher and you.

Minor-authored content is never displayed anywhere beyond your child's own teacher and you.

Who else touches this data (disclosure practices)

We share children's personal information only with the service providers that operate Sonotempo, only so they can provide their service to us, and never for their own purposes. Under COPPA these are "support for the internal operations" flows, not third-party disclosures. We do not disclose children's personal information to any third party for advertising, for money or other consideration, or for AI training — under the amended COPPA Rule those disclosures are never "integral" and we simply do not make them (90 FR 16918, 16950).

Each provider is bound by written terms restricting use of the data, as required by 16 CFR section 312.8(c). We may also disclose information where the law requires it or to protect the safety of a child or other users.

If Sonotempo were ever acquired or its assets sold, children's personal information could be transferred only to a successor that assumes these same commitments in full; you would receive direct notice first, and any material change in practices would require your new consent before applying to your child.

How long we keep your child's information (retention policy)

This is our written data retention policy for children's personal information under 16 CFR section 312.10. We keep children's personal information only as long as reasonably necessary for the purposes above — never indefinitely.

• Educational records (profile, lesson plans, practice logs, progress, schedules, messages): kept while your child is actively enrolled with a teacher on Sonotempo, because lesson history is the product — teachers and families rely on it across the learning relationship. Deleted within 30 days of your deletion request, and automatically within 90 days after the account/guardianship is closed.
• Safety and moderation records (flagged-content logs): kept up to 24 months from creation, retained only as needed to protect children and the service and to comply with law.
• Consent records (that you consented, when, and to what): kept for the life of the consent plus 3 years as evidence of compliance.
• Platform logs (IP/access logs at our infrastructure providers): up to 90 days unless needed for security investigation.
• Backups: encrypted, and purge on a rolling cycle of up to 35 days after deletion from live systems.

Your consent — and your right to say no

Before we collect personal information relating to your child, we obtain your verifiable parental consent during the guardian account and per-child setup, where we show you what we collect and how your child participates.

Two important rights within consent:

• Consent to collection never requires consent to disclosure. We make no third-party disclosures that require separate consent; if that ever changes, we will ask you separately, and your child's participation will never be conditioned on that separate consent (16 CFR section 312.5(a)(2)).
• You can withdraw consent at any time (see below).

Your rights as a parent or guardian

At any time, you may:

1. Review the personal information we have about your child;
2. Delete it — direct us to delete your child's personal information; and
3. Refuse further collection or use — withdraw consent and end collection going forward.

How: most of your child's information is directly visible in your guardian dashboard. For a complete review, a deletion request, or consent withdrawal, contact us at support@sonotempo.com or 386.259.2692 from the email address on your guardian account (we verify that requestors are the child's guardian before acting). We will act on deletion requests within 30 days.

If you refuse further collection or direct deletion, your child's participation on Sonotempo may end, since the service cannot operate without the underlying records — but we will never require more information than is reasonably necessary for your child to participate (16 CFR sections 312.6(c), 312.7).

Changes to this notice

If we materially change how we collect, use, or disclose children's personal information, we will notify you directly and obtain new consent before the change applies to your child (16 CFR sections 312.4(b), 312.5).

Security of Your Personal Data

We maintain a written information security program with safeguards appropriate to the sensitivity of the data We hold, including encryption in transit and at rest, row-level access controls, and access-gated file storage. No method of transmission or storage is 100% secure; while We use commercially reasonable safeguards, We cannot guarantee absolute security.

Transfer of Your Personal Data

The Service is operated from the United States, and data is processed on infrastructure located in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

Business Transactions

If the Company is involved in a merger, acquisition, or asset sale, Personal Data may be transferred. We will provide notice before Personal Data is transferred and becomes subject to a different Privacy Policy. Children's Personal Data may be transferred only to a successor that assumes these same commitments in full; guardians will receive direct notice before any such transfer, and any material change in how a child's data would be collected, used, or disclosed requires new parental consent before it applies (16 CFR §§ 312.4(b), 312.5).

Links to Other Websites

Our Service may contain links to websites not operated by Us. We have no control over, and assume no responsibility for, their content or privacy practices. We advise you to review the privacy policy of every site you visit.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by posting the new policy on this page, updating the "Last updated" date, and — for material changes — by email and/or prominent notice before the change takes effect. Material changes to how We collect, use, or disclose Children's Personal Data require new verifiable parental consent before they apply to a Child (16 CFR § 312.4(b), § 312.5).

Contact Us

If you have questions about this Privacy Policy:

• By email: support@sonotempo.com
• By phone: 386.259.2692
• By visiting: https://www.sonotempo.com/contact
• By mail: Vastocielo LLC, 940 Tall Pine Dr, Port Orange, FL 32127