The short version
- We are an Australian company and we handle your personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
- Your records are stored in Australia. Our database runs in Sydney. Student records, lesson notes and invoices stay onshore. See section 14.
- We never sell your personal information. We don't sell it, rent it, or trade it. We take a flat subscription fee from teachers. That is our entire business model.
- We never see your card number. Payments run through Stripe. We store the last four digits and a payment reference, nothing more.
- Two different people are responsible for your data. For the public directory, TeachMusic is responsible. For a student's lesson records inside a teacher's studio, the teacher or school is responsible and we hold that data on their behalf.
- We handle children's information. Students are often under 18. We treat their information with extra care, and we explain exactly how in section 9.
- We use automated systems that affect you: Profile Score, badges, search ranking, and the under-18 booking gate. We explain each one in section 11, and you can always ask a human to look at it.
- You can get your data out. One click, any time, full export. That is a product promise, not just a legal one.
- Questions or complaints:
privacy@teachmusic.com.au.
1. Who we are and what this policy covers
TeachMusic is operated by Eric Kuang trading as Sounds of Music (ABN 84 785 256 878) ("TeachMusic", "we", "us", "our"), a sole trader registered in Australia and based at 18 Caroline Crescent, Blackburn North VIC 3130.
This policy explains how we collect, hold, use and disclose personal information. It applies to:
- teachmusic.com.au and all its subdomains;
- the public directory: teacher profiles, search, maps, enquiries and bookings;
- the Studio app at
/studio: the subscription software teachers and music schools use to run their teaching business; - the family portal and our mobile apps (when released); and
- our emails, SMS messages, and customer support.
Together we call these the Platform.
"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable: the definition in section 6 of the Privacy Act 1988 (Cth) (the Privacy Act).
We handle personal information in accordance with the Privacy Act and the Australian Privacy Principles (APPs), and with the Spam Act 2003 (Cth) for our email and SMS messaging.
Note on scope: Some small businesses are exempt from the Privacy Act. We do not rely on that exemption. Given that we handle children's information and Working With Children Check details, we have chosen to comply with the Privacy Act and the APPs in full.
2. The two roles: ours and your teacher's
This is the single most important thing to understand about data on TeachMusic, so we'll put it plainly.
TeachMusic runs two connected products, and responsibility for personal information sits in a different place in each.
2.1 The public directory: we are responsible
When you browse teachers, search a suburb, look at a profile, send an enquiry, or leave a review, TeachMusic decides what happens with that information. We are the entity accountable to you under the Privacy Act. This policy governs it.
2.2 A teacher's or school's studio records: they are responsible
Once you enrol with a teacher or school, that teacher or school uses our Studio software to keep their own records: your child's name and date of birth, lesson notes, attendance, practice logs, invoices, and messages.
Those records belong to the teacher or school, not to us. They decide what to collect, what to write in a lesson note, how long to keep it, and who on their staff can see it. We hold and process that information on their behalf and under their instructions, as their service provider.
What this means in practice:
| If you want to… | Contact |
|---|---|
| See, correct or delete your child's lesson records, attendance, notes or invoices | Your teacher or school in the first instance |
| See or correct your directory profile, enquiries, reviews, or account | TeachMusic: privacy@teachmusic.com.au |
| Complain about how a teacher handled your information | The teacher or school, then us, then the OAIC |
| Complain about how TeachMusic handled your information | Us: section 16 |
If you ask us for something that belongs to a teacher's records, we will tell you promptly and, where we reasonably can, put you in touch with the right person. We will not hand a teacher's student records to a third party without that teacher's instruction or a legal obligation to do so.
Teachers and schools have their own obligations under the Privacy Act and under state child-safety law. Our agreement with them requires them to meet those obligations. See the Terms of Service, Part C.
3. What we collect, and why
We only collect what we actually need. Below is the real inventory, grouped by who you are.
3.1 If you're just browsing (no account)
| What | Why |
|---|---|
| IP address, approximate location derived from it, browser and device type, operating system, screen size | Serve the site, show teachers near you, prevent abuse, security |
| Pages viewed, time on page, referring site, search terms (instrument, suburb, price band, filters) | Understand what families are looking for; decide which location pages to build |
| Map interactions: pan, zoom, pins opened | Improve the browse experience |
Clicks on a teacher's own website link (via our /out/ redirect) | Count and report to that teacher how much traffic we sent them; the click is logged and we append tracking parameters so it also appears in their own analytics |
| Cookies and similar technologies | See section 12 |
You do not need an account to browse or to send an enquiry.
3.2 If you enquire about or book a lesson
| What | Why |
|---|---|
| Your name, email address, phone number | So the teacher can reply to you |
| Your message, and the instrument, student age, preferred time slot and lesson length you selected | So the teacher can give you a useful answer |
| Whether the student is under 18 | To apply the child-safety gate in section 9 |
| The enquiry's status and timestamps (sent, read, replied) | To measure teacher response times, which feeds published badges |
We pass your enquiry to the teacher you chose. That is the entire point of sending it. Once the teacher receives it, they hold your details as their own record. See section 2.2.
3.3 If you create an account (family, guardian or student)
Account identifier and login credentials (handled by our authentication provider; we never store your password in readable form), name, email, phone, contact preferences (whether you want reminders and invoices, and whether by email or SMS), and which students you are the guardian of.
3.4 If you are a teacher or a music school
Your listing (public): display name, headline, biography, instruments, ages and levels taught, teaching modes (studio, mobile, online), travel radius, suburb, indicative pricing, trial offer, years of experience, qualifications, website address, photo, video introduction, and gallery images.
Your account and business: legal or trading name, contact details, timezone, plan and subscription status, staff members and their roles, rooms and locations.
Your Working With Children Check: the state or territory, the check number, the name and date of birth as they appear on the check, the expiry date, the verification status, and any notes our verification team makes. This is sensitive to you and to the families who rely on it, and we treat it accordingly. See section 8.
Your payments setup: your Stripe Connect account identifier and whether Stripe has enabled charges and payouts for you. We do not hold your bank account details: Stripe does.
Your integrations: if you connect Xero or Google Calendar, we store an encrypted access token and the name of the connected organisation or calendar. Tokens are encrypted at rest and are never shown to any user, including you.
Computed about you: your Profile Score, your badges, your response-rate and cancellation statistics, and your position in search results. See section 11.
3.5 Studio records: held on a teacher's behalf
When a teacher or school runs their studio on TeachMusic, we hold the following for them:
- Students: full name, date of birth, pronouns, active status, and free-text notes. Those notes are written by the teacher and may contain health, disability, learning-support or other sensitive information. See section 7.
- Guardians and families: name, email, phone, relationship to the student, who is the billing contact, and communication preferences.
- Teaching: lessons, terms and enrolments, attendance, make-up credits, waitlists, lesson notes, practice logs, repertoire, forms and recital RSVPs.
- Money: invoices and line items, payment plans, memberships, payments (amount, method, date, reference, and the Stripe payment identifier), refunds, and an append-only ledger. We never store full card numbers, CVCs, or bank account numbers.
- Communications: in-app messages, and the content and delivery status of emails and SMS sent through the Platform.
- An audit log: who did what, when, to which record. We keep this to protect both teachers and families when there is a dispute about money or a record.
3.6 If you leave a review
Your name (or the display name you choose), your rating, your review text, and the booking it relates to. We only publish reviews connected to a real booking or enquiry on the Platform. Reviews are public. Do not put personal details in a review that you don't want the world to read.
3.7 If you contact support
Your messages, the channel you used, and enough account context to help you. We keep support correspondence so we can handle follow-ups and complaints.
4. How we collect it
Mostly directly from you: when you type it into a form, upload a file, or send us a message. That's our default and our preference.
We also collect information:
- automatically, as you use the Platform (see section 3.1);
- from a teacher or school, when they add you or your child as a student, or import their existing student list from another system such as My Music Staff or Teachworks;
- from a guardian, about a student in their care;
- from Stripe, about the status of a payment or a payout (never the card details);
- from state and territory government check services, when we verify a teacher's Working With Children Check against the public register; and
- from Google, if a teacher chooses to import their existing Google reviews to their profile.
If we collect your information from someone other than you (most commonly, when a teacher adds you as a guardian or adds your child as a student) we take reasonable steps to make sure you're notified, normally through the portal invitation email you receive.
5. Why we use it (and our legal basis)
Under Australian law, we may use personal information for the primary purpose we collected it for, and for a related secondary purpose you'd reasonably expect. Here is the honest list:
- To run the Platform: show you teachers, take enquiries, book lessons, run a studio, send invoices, take payments.
- To connect families with teachers: the core function of the directory.
- To keep children safe: verify Working With Children Checks, enforce the under-18 booking gate, keep first contact inside our messaging so there is an audit trail.
- To make money move correctly: invoicing, autopay, dunning, payouts, refunds, GST-aware documents, teacher payroll.
- To send you service messages: booking confirmations, lesson reminders, invoice notices, password resets, security alerts. These are not marketing and you cannot opt out of the essential ones while you hold an account.
- To send you marketing, if you have consented or if it's within the narrow bounds the Spam Act 2003 allows: always with a working unsubscribe. See section 13.
- To rank, score and badge listings. See section 11.
- To improve the product: understand which features get used, fix bugs, decide which location pages to build.
- To prevent fraud and abuse: rate limiting, review-fraud detection, spam filtering, account security.
- To meet our legal obligations: tax and financial records, responding to a lawful request, mandatory data breach notification.
- To resolve disputes: between a family and a teacher, or between either and us.
We do not use your personal information to train third-party artificial intelligence models, and our AI provider is contractually prohibited from training on the data we send them. See section 11.4.
6. Who we share it with
We never sell your personal information, and we never share it with a third party for that party's own marketing.
6.1 The teacher or school you chose
When you enquire, book, or enrol, we share what that teacher needs to serve you. This is the point of the Platform.
6.2 Service providers who help us run the Platform
Each of these is bound by contract to protect your information, use it only to provide their service to us, and not to use it for their own purposes.
| Provider | What they do | Personal information they handle | Where |
|---|---|---|---|
| Supabase | Our database, file storage and login system | Effectively all Platform data | Sydney, Australia (ap-southeast-2) |
| Vercel | Hosts and serves the website; performance and traffic analytics | IP address, request metadata, page views | United States / global edge network |
| Stripe | Card and BECS direct debit payments, teacher payouts, our own subscription billing | Name, email, payment details, bank details for teacher payouts | Australia and United States |
| Twilio | Sends SMS | Mobile number, message content, delivery status | United States |
| Resend | Sends email | Email address, message content, delivery status | United States |
| Anthropic | AI-assisted drafting of teacher biographies | Only the answers a teacher gives in the onboarding flow. Not student data. See section 11.4 | United States |
| CARTO and OpenFreeMap | Map tiles for the browse map | IP address and the map area being viewed | United States / Europe |
| Google Analytics 4 (only if enabled, public pages only) | Traffic analytics | Pseudonymous identifier, IP address, page views | United States |
| Microsoft Clarity (only if enabled, public pages only) | Session replay and heatmaps on public pages | Interactions with public pages | United States |
| Xero (only if a teacher connects it) | Accounting sync: invoices, payments, contacts | Contact and invoice data from that teacher's studio | Australia / New Zealand |
| Google Calendar (only if a teacher connects it) | Two-way calendar sync | Lesson times and titles from that teacher's calendar | United States |
Google Analytics and Microsoft Clarity never run on the Studio app, the portal, or any login page. We block them by route. A session that starts inside /studio loads no analytics tag and no session recorder at all. We did this deliberately, because those screens show children's records.
6.3 Other situations
- Professional advisers: lawyers, accountants and auditors, under confidentiality.
- Law enforcement, courts and regulators: where we are required or authorised by law, or where we reasonably believe it is necessary to prevent a serious threat to a person's life, health or safety. This includes reporting a child-safety concern to the police or a state child-protection authority, which we will do without hesitation.
- A buyer or successor: if we sell, merge, restructure or transfer the business, personal information may transfer with it. The buyer would be bound to handle it under a policy at least as protective as this one, and we would tell you before anything about your information changed.
6.4 Google user data: our Limited Use commitment
If you connect a Google account to TeachMusic, what we may read and write is narrow and it is described here in full.
TeachMusic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What we ask for, and why:
| Google permission | What we do with it |
|---|---|
See and edit events on your calendars (calendar.events) | Write your TeachMusic lessons into the calendar you choose, and update or remove those events when a lesson moves or is cancelled. |
Your email address (email) | Show you which Google account is connected, so you can tell one from another before you disconnect it. |
What we will never do with it. We do not sell Google user data. We do not transfer it to anyone except as needed to provide the calendar feature you asked for, or where you direct us to, or where the law requires it. We do not use it for advertising, and we do not use it to train any generalised artificial intelligence or machine learning model. No human at TeachMusic reads your calendar data, except where you have explicitly asked us to help with a support problem, where it is necessary for security purposes such as investigating abuse, or where the law requires it.
How long we keep it. We do not keep a copy of your calendar. We store an access token, encrypted at rest, and the identifier of each event we created, so that a lesson we wrote can be found and updated later. Disconnect Google in Settings and we revoke the token with Google and delete it at our end. You can also revoke our access at any time from your Google account permissions page, which stops the sync immediately without touching anything else in your studio.
7. Sensitive information
Sensitive information is a special category under the Privacy Act. It includes health information, disability, racial or ethnic origin, religious beliefs, sexual orientation, and criminal record. It gets stronger protection, and we generally need your consent to collect it.
Sensitive information can reach the Platform in three ways:
- Lesson notes and student notes. A teacher may record that a student has autism, ADHD, an anxiety condition, a hearing impairment, a physical injury affecting their playing, or a dietary or medical need for a recital. This is health information.
- Working With Children Checks. See section 8.
- Whatever you choose to tell us in an enquiry, message or support request.
How we handle it:
- These fields are free text controlled by the teacher, not structured fields we ask for. We do not require, prompt for, or mine health information.
- Where sensitive information is entered into a teacher's studio records, the teacher is the entity responsible for having a lawful basis to collect it: normally your consent, given to them, as part of enrolling. Our Terms of Service require teachers to obtain that consent.
- We hold it under the same security controls as everything else, with row-level database isolation so it can never be read across studio boundaries.
- We do not use it for ranking, marketing, analytics, or AI processing of any kind.
Please don't send us sensitive information we didn't ask for. If you send us something we don't need, we'll delete it.
8. Working With Children Checks
Verification is the reason a parent can trust this directory, so we'll be specific about it.
What we collect: the state or territory, the check or card number, the full name and date of birth exactly as they appear on the check, the expiry date, and the outcome of our verification.
Why: every Australian state and territory requires a valid check for people in child-related work, and private music teaching is expressly captured in every one of those schemes. We collect this because we're required or authorised by law to, and because a directory that lets unverified adults teach children isn't one we're willing to run.
How we verify it: a member of our team checks the details against the relevant state or territory's public online verification service. No state offers an API for this, so it is a manual check by a person. Nothing is automated in the verification step itself, though the consequences of the result are. See section 11.2.
What's public and what isn't:
| Public on the profile | Never public |
|---|---|
| A "Verified to work with children" badge | The check number |
| The state or territory of the check | The date of birth |
| Whether the check is currently valid | Our verification notes |
Who inside TeachMusic can see the full record: only the small number of platform administrators who run the verification queue. Access is logged.
Re-verification: we re-check periodically, matched to each scheme's renewal cycle (Northern Territory every 2 years; Queensland and Western Australia every 3 years; the others every 5 years). We also handle mid-term suspensions and revocations, because New South Wales, Victoria and Tasmania can cancel a clearance at any time. When a check expires or is revoked, the badge is removed automatically and the teacher can no longer take new under-18 bookings.
How long we keep it: for as long as the teacher is listed, and for 7 years afterwards, so we can answer a child-safety question about a past listing.
A limit you should know about: a verified check means that, on the date we checked, the relevant government register said this person held a valid clearance. It is not a guarantee of a person's conduct, and it is not a substitute for your own judgement as a parent. Please read section 5 of the Terms of Service on what our verification does and does not promise.
9. Children and young people
Music teaching involves children. We designed for that from the start.
Accounts. A person must be at least 18 to create a TeachMusic account in their own name. Children do not sign up. A student under 18 is always attached to a parent or guardian's family account, and the guardian controls it.
Who provides the information. A student's personal information is provided by their parent or guardian, or by the teacher with the guardian's authority. We do not collect information directly from children through the public directory.
Who can see it. A student's records are visible only to their guardians, the teaching staff at their studio who need them, and the small number of TeachMusic staff who provide support: never to other families, never to other studios. This is enforced in the database itself, not just in the interface.
No analytics on children's screens. As described in section 6.2, no third-party analytics or session recording runs on the Studio app or the family portal.
No marketing to children. We do not send marketing to anyone under 18, and we do not use children's information for advertising or profiling.
Capacity. Where a young person has the capacity to make their own decisions about their information (generally from around 15, assessed individually) we will deal with them directly on request. Below that, we deal with the guardian.
Coming change we are watching. The Office of the Australian Information Commissioner must register a Children's Online Privacy Code by 10 December 2026. It will apply to online services likely to be accessed by children, which includes us. The commencement date and transition period are not yet confirmed. This section will need review against the final Code once registered.
10. How we protect your information
- Encryption in transit (HTTPS/TLS everywhere) and at rest.
- Row-level security in the database itself. Every record carries the studio it belongs to, and the database refuses cross-studio reads. This is enforced at the data layer, so a bug in the application cannot leak one studio's students to another.
- Role-based access. Owners, administrators, teachers and front-desk staff each see only what their role needs. Financial records are restricted to owners, administrators and front-desk staff.
- Payment isolation. Card and bank details go directly to Stripe. They never touch our servers. We hold a reference and the last four digits.
- Encrypted integration tokens. Xero and Google credentials are encrypted at rest with AES-GCM and are never exposed to any user.
- Audit logging of money movements and record changes.
- Least privilege internally. Very few TeachMusic staff can access production data; access is logged and reviewed.
Notifiable data breaches. If a data breach occurs that is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner as required by Part IIIC of the Privacy Act. Where the breach involves a teacher's studio records, we will notify that teacher promptly so they can meet their own obligations.
No system is perfectly secure. We work hard at this, but we can't promise absolute security, and you should use a strong, unique password and turn on any additional protections we offer.
11. Automated decisions and artificial intelligence
This section exists because from 10 December 2026, the Privacy Act requires us to tell you about automated decisions that could significantly affect your rights or interests. We think you should know regardless.
We use computers to make or substantially assist several decisions. Here is each one, what goes into it, and what it affects.
11.1 Profile Score and search ranking
Applies to: teachers and schools.
What it does: we compute a Profile Score from 0 to 100 based on how complete and useful your listing is: whether you have a photo, a video introduction, a written biography, published availability, and pricing. We show you the score and what would improve it.
What it affects: the Profile Score is one input into where your listing appears in search results. Others include how well you match the search (instrument, suburb, ages, mode), your distance from the searched location, your response rate, your rating, and your recency of activity.
Why this matters to you: ranking affects how many families find you, so it affects your income. We publish our ranking factors rather than hiding them. If we ever sell placement, it will be labelled "Featured" and capped.
11.2 Badges and the under-18 booking gate
Applies to: teachers and schools.
Three badges are awarded and removed automatically:
- "Verified to work with children": granted when a human verifies your check, then removed automatically when the check expires or is recorded as revoked.
- "Responds within 24h": computed from your actual enquiry response times.
- "Top Teacher": response rate of 90% or more, average rating of 4.8 or above, and a low cancellation rate.
The under-18 booking gate is the most consequential automated decision we make. Unless your Listing states that it teaches adults only, the system refuses to create a booking against it while your child-safety credential is unverified. It is applied automatically, in the database, and it directly restricts your ability to trade on the Platform. We apply it because we are not willing to be the reason an unverified adult was booked to teach a child.
Correction, 2026-08-12. This section described that automated decision before it existed. The gate was built the same day the gap was found (migration
0186) and this disclosure now matches the software. The discrepancy is recorded rather than erased.
11.3 Money automations
Applies to: families and teachers.
Automatic invoice generation from the calendar, autopay attempts, payment retries after a failure, dunning sequences, late fees where the teacher's policy provides for them, and make-up credit issue and expiry. The teacher sets the policies; the system applies them. Every invoice line traces back to a specific lesson on the calendar: if you don't understand a charge, you're entitled to see exactly where it came from.
11.4 AI-assisted writing
Applies to: teachers, during onboarding.
We use Anthropic's Claude to draft a first version of your listing biography from the answers you gave: your instruments, experience, ages you teach, and qualifications. Nothing is published without you reading and approving it. You can rewrite or discard the draft entirely.
Limits we hold ourselves to:
- We never send student data, guardian data, lesson notes, health information, or Working With Children Check details to any AI provider.
- Our AI provider is contractually prohibited from training its models on the content we send.
- No AI system makes a decision about verification, ranking, money, or child safety.
11.5 Fraud and abuse prevention
Automated rate limiting on enquiries, signups and reviews; detection of review patterns that suggest fraud; and spam filtering on messages. A false positive here could stop you sending an enquiry or publishing a review: tell us and we'll look.
11.6 Your right to a human
For any automated decision described in this section, you can ask a person to review it. Email privacy@teachmusic.com.au, tell us which decision and why you think it's wrong, and a human will look at it and respond. There is no charge.
The one exception we won't override on request is the under-18 booking gate: the way to lift that is to get your check verified, not to have us waive it.
12. Cookies, analytics and tracking
What we use:
| Type | Purpose | Can you refuse? |
|---|---|---|
| Essential | Keeping you logged in, security, remembering your consent choices | No: the Platform can't work without them |
| Preference | Remembering your search filters, map position, light or dark theme | Yes |
| Analytics | Understanding how public pages are used | Yes |
| Session replay (Microsoft Clarity, if enabled) | Watching anonymised interactions on public pages to find usability problems | Yes |
Where they run. Analytics and session replay run on public pages only. They are blocked on /studio, /portal, /login, /signup and /auth: at the point of rendering, on client-side navigation, and in the analytics library's own send hook. Three independent layers, all failing closed. No tracking tag ever loads on a screen showing a child's records.
Vercel Analytics is cookieless. It doesn't set a cookie or track you across sites.
Map tiles. Our maps load tiles from CARTO and OpenFreeMap. Loading a tile reveals your IP address and the area you're viewing to those providers. There's no way to show a map without this.
Managing cookies. Use the cookie preferences control in the site footer or your browser settings. Blocking essential cookies will break the Platform.
Do Not Track. Browsers send this signal inconsistently and there's no agreed standard for honouring it, so we don't currently respond to it. We'd rather say that than claim otherwise.
13. Marketing and how to opt out
We will send you marketing only if:
- you consented; or
- you're an existing customer, the message is about something related to what you already use, and it's the kind of message you'd reasonably expect, which is what the Spam Act 2003 allows.
Every marketing email and SMS carries a working unsubscribe. We action unsubscribes within 5 working days, which is the statutory maximum, and usually within minutes.
Service messages are different. Booking confirmations, lesson reminders, invoices, receipts, password resets and security alerts are not marketing. While you hold an account you'll keep receiving the essential ones, though you can control reminder channels in your notification settings.
Messages your teacher sends you (lesson reminders, invoice notices, studio newsletters) are sent by your teacher, using our software, under their own name. Opt out with them, or use the unsubscribe in the message. Teachers are required by our Terms of Service to comply with the Spam Act for everything they send, including having consent and honouring opt-outs.
We never sell your details to advertisers or list brokers. Never have, and the business model gives us no reason to start.
14. Sending information overseas
Your records live in Australia. Our database, our file storage and our login system run in Supabase's Sydney region (ap-southeast-2). That means the substance of what we hold about you, including every student record, lesson note, invoice and Working With Children Check detail, is stored in Australia and stays in Australia at rest.
We chose it deliberately. A directory that holds children's records should keep those records under Australian law and within reach of Australian regulators.
Some information still travels. Certain providers operate overseas, and using them necessarily discloses some information to them. See the table in section 6.2 for exactly who and what. In summary:
| Destination | What goes there | Why |
|---|---|---|
| United States | Email and SMS content and recipient details (Resend, Twilio); page requests and IP addresses (Vercel); teacher onboarding answers for bio drafting (Anthropic); analytics on public pages only, if enabled (Google, Microsoft) | These categories of service have no comparable Australian-hosted provider we're prepared to rely on |
| United States and Australia | Payment and payout details (Stripe) | Stripe processes Australian card and BECS payments through its global infrastructure |
| United States / Europe | Your IP address and the map area you're viewing (CARTO, OpenFreeMap) | Serving map tiles requires it |
| Australia / New Zealand | Contact and invoice data, only if a teacher connects Xero | The teacher initiates it |
Before we disclose personal information overseas, we take the reasonable steps APP 8 requires to ensure the recipient handles it consistently with the Australian Privacy Principles: principally through contractual commitments, and by choosing providers with recognised security certifications.
What never goes overseas for AI processing: student data, guardian data, lesson notes, health information, and Working With Children Check details. See section 11.4.
15. How long we keep it, and how to get it back
15.1 Retention
| Data | How long |
|---|---|
| Financial records: invoices, payments, ledger | 7 years, as required by the Income Tax Assessment Act and the Corporations Act |
| Working With Children Check records | While listed, then 7 years. See section 8 |
| Student and lesson records | Controlled by the teacher or school; on subscription cancellation, see section 15.2 |
| Directory listings and reviews | While published; removed listings are retained for 12 months to handle disputes |
| Enquiries and messages | 2 years after the last message in the thread |
| Support correspondence | 2 years |
| Server and security logs | 12 months |
| Anonymised, aggregated statistics: e.g. "the median piano rate in Brunswick is $48" | Indefinitely. This is no longer personal information and cannot be traced back to you |
Where we no longer need personal information and no law requires us to keep it, we destroy it or de-identify it, as APP 11.2 requires.
15.2 When an account closes
If a teacher or school cancels: we keep their studio data for 90 days so they can export it, then delete it, apart from what tax law requires us to keep. We will send at least one reminder before deletion. The exact process is in Part C of the Terms of Service.
If a family closes their account: we delete or de-identify what we hold about you in the directory. Records held on your teacher's behalf are theirs to delete: ask them.
15.3 Getting your data out
"Your students, your data (full export, any time, one click" is a product promise. Teachers can export their full studio) students, families, lessons, invoices, payments, notes: as CSV, without asking us, without a fee, and without cancelling first. Families can export their own records from the portal.
We built it that way on purpose. We've watched teachers get stranded when a platform shut down, and we're not going to be the reason it happens again.
16. Your rights
16.1 Access
You can ask for a copy of the personal information we hold about you. We'll respond within 30 days. It's normally free; if a request is genuinely large or repetitive we may charge a reasonable cost-recovery fee, and we'll tell you the amount before doing any work. We'll never charge you just for making the request.
16.2 Correction
If something's wrong, out of date, incomplete or misleading, tell us and we'll fix it. Most things you can fix yourself in your settings. If we disagree that a correction is needed, we'll tell you why, and you can ask us to attach a statement noting your view, and we will.
16.3 Deletion
You can ask us to delete your personal information. We'll do it unless we're required to keep it: for tax records, for a child-safety record, for an unresolved dispute, or because it belongs to a teacher's studio records rather than to us. We'll always tell you what we kept and why.
16.4 Opt out of marketing
See section 13.
16.5 Human review of an automated decision
See section 11.6.
16.6 Anonymity and pseudonymity
You can browse the directory and use search without telling us who you are. You can't send an enquiry anonymously (the teacher needs to be able to reply) and you can't run a studio anonymously, because of the child-safety verification.
16.7 How to exercise any of these
Email privacy@teachmusic.com.au. Tell us what you want and enough for us to find your records. We may need to verify your identity first. That's to protect you, and we'll ask for the least we can get away with.
17. Complaints
If you think we've mishandled your personal information, tell us first. We'd like the chance to fix it.
Step 1: Us. Email privacy@teachmusic.com.au with "Privacy complaint" in the subject line, or write to 18 Caroline Crescent, Blackburn North VIC 3130. We'll acknowledge within 5 business days and give you a substantive response within 30 days. If it'll take longer, we'll tell you why and when to expect an answer.
Step 2: The regulator. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner:
- Online: oaic.gov.au/privacy/privacy-complaints
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
The OAIC generally expects you to have raised it with us first.
If your complaint is about a teacher or school, raise it with them first. They're responsible for their own studio records. If they don't resolve it, tell us at privacy@teachmusic.com.au. We take it seriously: a teacher who mishandles family data is in breach of their agreement with us, and we can suspend or remove a listing.
18. Third-party sites
Teacher profiles may link to a teacher's own website, and we track that click so we can report the referral to the teacher. Once you leave teachmusic.com.au, this policy stops applying. We don't control those sites and aren't responsible for their privacy practices. Read their policy.
19. Changes to this policy
We'll update this policy as the Platform and the law change. The version and date at the top always tell you what you're reading.
For minor clarifications, we'll update the page and the date.
For changes that materially affect how we handle your personal information, we'll give you at least 30 days' notice by email or an in-app notice before they take effect. If you don't accept a material change, you can close your account, and teachers can cancel and receive a pro-rata refund of any prepaid subscription, as set out in the Terms of Service.
Every version of this policy is kept. Ask us at privacy@teachmusic.com.au for an earlier one and we will send it.
20. Contact us
| Privacy enquiries and complaints | privacy@teachmusic.com.au |
| General support | support@teachmusic.com.au |
| Postal | Eric Kuang trading as Sounds of Music, 18 Caroline Crescent, Blackburn North VIC 3130 |
| Privacy Officer | Eric Kuang |
| ABN | 84 785 256 878 |
Related documents
- Terms of Use: the rules for using the website and apps
- Terms of Service: the agreement covering bookings, payments and subscriptions
- Cookie Policy
- Data Processing Terms for schools: available on request at
legal@teachmusic.com.au - Child Safety Policy