Data protection for schools

Who we are

Play Music From Within Ltd provides online music theory, ear-training and sight-reading tools. When a school uses the service for its students, the school is the data controller and we act as its data processor under UK GDPR. We only process student data on the school's instructions and to provide the service.

ICO registration number: [to confirm].

What we collect about students

• A display name chosen by the teacher (a first name or initials is enough).
• Login codes, which are stored only as one-way hashes, and sign-in session records.
• Practice and assessment results: which activities a student did, their answers and scores, and when.
• The class or teacher they belong to.

What we don't collect about students

• No email address, phone number, home address or date of birth.
• No password: students sign in with printed login codes.
• No advertising, no advertising cookies and no profiling for marketing.
• We never sell student data or share it for anyone else's marketing.

What we collect about teachers

Name, school email address and account details, the classes and assignments you create, and messages you send us. We use your email for service messages about your account and pilot. We only send marketing email if you opt in, and you can unsubscribe at any time.

How we use it

• To run the tools and show students their own progress.
• To show teachers their students' progress and assignments.
• To keep the service secure and fix problems.
• To improve the tools, using aggregated or de-identified usage figures.

Sub-processors

We use a small number of providers to run the service. Each is bound by data protection terms. [Owner to confirm list, hosting provider and data locations.]

• Supabase: database and sign-in. Region: [to confirm].
• [Hosting provider]: serves the website and app.
• MailerSend: service emails to teachers (never to students).
• Plausible Analytics: cookie-free, aggregated website statistics.
• Mux: streams lesson videos.

Security

• All traffic is encrypted in transit (HTTPS).
• Login codes are stored hashed, and student sessions are time-limited.
• Database access is restricted with row-level security, and students' results are shown only to the student and their linked teachers. [Owner to confirm]

Retention and deletion

Student data is kept while the school's account is active. When a school asks, or its licence ends, we delete student accounts and results within [period to confirm], unless the school asks us to return them first.

Rights requests

Because the school is the controller, students and parents should make access, correction or deletion requests to the school. We will help the school respond promptly. Teachers can contact us directly about their own data.