Privacy Policy
Last updated: August 6, 2026
This Privacy Policy explains what information Wes Davis' "I Wanna Rock" School of Music ("we," "us") collects through i-wanna-rock.com (the "Site"), why we collect it, and how it's used, shared, and protected. It reflects what the Site actually stores today — not a generic template.
1. Information we collect
| What | When | Why |
|---|---|---|
| Name, email, phone | Creating an account, booking a lesson/class, or submitting the "Request a lesson" contact form | Identify you, contact you about lessons, send confirmations and receipts |
| Guardian name | Roster entry for a student under 18, entered by staff (this field is not editable by parents through the Site) | Contact the responsible adult for a minor student |
| Date of birth (for a moment) and the resulting age bracket | Creating an account for a student under 18. We ask for a date of birth once, to confirm the account needs to be a parent/guardian account, then discard it — only the adult/minor result is kept | Route a minor's account through the parent/guardian path required by §2 of our Terms of Use |
| Records that you agreed to our Terms of Use, Privacy Policy, and (for an in-person session) the Liability Waiver — timestamp, IP address, browser information, the exact document version shown, and, for a minor's account, the guardian's name and relationship to the student | Creating an account, or booking an in-person lesson/class | Prove who agreed to what, and, for a minor's account, who had the authority to agree on their behalf |
| Anything you type into the “Request a lesson” message box (up to 2,000 characters) | Submitting the contact form on the home page | Understand what you’re asking for and reply. Please don’t include sensitive details (medical, financial, or a child’s school/address) — only tell us what you want us to know |
| Instrument, preferred lesson format, and assigned instructor | Enquiring, enrolling, or being added to the roster | Match you to the right lesson type and teacher |
| Attendance records — marked present, absent, late, or excused, plus whether the lesson itself ended up recorded as a no-show | Each lesson or class session | Track participation, apply the cancellation policy, and answer billing questions |
| Staff notes about a student, lesson, class, attendance, or payment | Written by staff as free text while running lessons and billing | Remember what a student is working on and record billing context. You may ask us what notes we hold about you — see §7 |
| Newsletter subscription — email, optional name, sign-up date, and where you signed up from | Signing up for the email newsletter | Send the newsletter. Every newsletter we send carries a one-click unsubscribe link. Your IP is not stored on the subscription itself — it is used only in the separate rate-limit record described below |
| Rate-limit records — your IP address paired with the action you took (booking, enquiry, newsletter sign-up, login) | Using a form or signing in | Stop automated abuse and password guessing |
| Sign-in attempt log — IP address, the username tried, whether it succeeded, and when | A staff sign-in attempt. Student portal sign-ins are throttled by IP only and are not individually logged this way | Detect and slow down password-guessing attacks against the staff account |
| Spam score for your enquiry | Submitting the contact form | Automatically filter junk submissions. A low score is never used to refuse you lessons — a human reviews anything filtered |
| Account verification code | Creating a portal account. The code is emailed to you, and also texted if you gave us a phone number | Confirm you control the email address on the account |
| Password | Creating an account | Stored as a one-way bcrypt hash — we never see or store your actual password |
| Lesson/class booking & payment history | Booking and paying for lessons or classes | Run the scheduler, track what's owed/paid, provide records for accounting |
| Payment confirmation details (amount, payment method, processor transaction ID) | Paying via PayPal or self-reporting a Venmo payment | Reconcile payments; we do not receive or store your card or bank account number — see §3 |
| IP address | Every request to the Site | Security (spam/abuse prevention, rate limiting on booking and the "Request a lesson" form); not linked to your account for marketing purposes |
| AI chat rate-limit log (IP + timestamp only) | Using the "Axel" chat assistant | Prevent abuse of the chat feature; the content of your messages is not stored after the reply is sent |
We do not run advertising trackers, sell data to data brokers, or use the Site to build advertising profiles.
2. Cookies and similar technology
See our Cookie Notice for the full list. In short: we set one functional cookie to keep you signed in, and no advertising or analytics cookies.
3. Payments — what we do and don't see
When you pay with PayPal, your payment is processed entirely by PayPal; we receive confirmation that payment was made, the amount, and PayPal's own transaction ID — never your card or bank details. See PayPal's Privacy Statement.
When you pay with Venmo, you send the payment directly in the Venmo app; you then tell us (self-report) that you sent it, and staff confirm it once the transfer arrives in Wes's Venmo account. See Venmo's Privacy Policy.
Confirmed payment records (date, amount, gross/fee/net, method, and a transaction reference) are kept for bookkeeping and are exportable by staff to accounting software (QuickBooks-compatible CSV).
4. Who we share information with
- PayPal, Inc. — processes PayPal payments.
- Venmo (a PayPal service) — processes Venmo payments you send directly.
- Our email provider, and Twilio for text messages — send booking confirmations, verification codes, payment receipts, and the email newsletter if you subscribed. SMS is only used if you provide a phone number and texting is enabled.
- Our web host — stores the Site and its database, and therefore holds everything described in §1 on our behalf.
- Groq — powers the "Axel" AI chat assistant; your message text for a single chat session is sent to Groq to generate a reply and is not stored by us afterward.
- Cloudflare — sits in front of the Site for security and performance and sees standard web traffic (IP address, request metadata) for every visitor.
- Google Fonts — the Site loads typefaces from Google's font CDN, which can see the requesting IP address as a normal part of serving the font files.
We do not sell your personal information. We do not share it with anyone else except: (a) as described above to operate the Site, (b) if required by law or a valid legal process, or (c) with your explicit consent.
5. How long we keep information
| Record | Kept for |
|---|---|
| Account details (name, email, phone, password hash) | While your account is active, then deleted on request — see §7 |
| Payment and booking records | At least four years after the transaction, for tax and accounting purposes. These are kept even if you close your account, because we are required to be able to substantiate our records |
| Attendance records and staff lesson notes | While the student is enrolled and for a reasonable period afterward, so a returning student’s history makes sense |
| Contact-form enquiries | Two years, then deleted automatically |
| Newsletter subscription | Until you unsubscribe. Unsubscribing removes you from future sends |
| Sign-in attempt log and the AI chat rate-limit log (both IP-based) | 30 days, then deleted automatically. They are only ever used for a much shorter window — 15 minutes and one hour respectively; the rest of the period exists only so we can look back at a suspected break-in attempt |
| Rate-limit records (IP-based) | 7 days, then deleted automatically |
| The age-bracket result (adult/minor) for your account | While your account is active. The date of birth used to work it out is never stored |
| Records that you agreed to our Terms of Use, Privacy Policy, or Liability Waiver | Kept as long as needed to prove consent, including after an account is deleted — see §7 |
The periods for enquiries and for the three IP-based logs above are enforced by software: a purge routine runs on our server and deletes rows once they pass the limit, so those records go whether or not anyone remembers to clear them. The remaining periods are commitments rather than automatic rules — account, payment, and attendance records are kept while they are needed and cleared by hand, because whether a record is still needed is a judgement no timer can make. If that matters to you, ask us and we will tell you exactly what we still hold.
6. Marketing email
We only send the newsletter to people who asked for it. We do not add lesson customers to the newsletter automatically — booking a lesson does not subscribe you. Every newsletter includes a one-click unsubscribe link, and you can also unsubscribe any time by emailing info@i-wanna-rock.com. We do not rent, sell, or trade the subscriber list.
7. Your choices and your rights over your information
We are a one-teacher music school, not a technology company, and we are not large enough to fall under California’s Consumer Privacy Act — that law applies to businesses above thresholds we are nowhere near. We are not going to dress this policy up with rights we borrowed from a statute that does not govern us. What follows is what we actually commit to, and we mean all of it.
Whoever you are and wherever you live, you can ask us to:
- Tell you what we hold about you — the categories are listed in §1, and who receives them in §4. You can also ask for the specific details on file, including any staff notes about you or your student.
- Correct anything that is wrong.
- Delete your information. We will delete what we can. Payment and accounting records have to survive for the period in §5 because we are required to be able to substantiate them, and so does a record that you (or, for a minor's account, your parent or guardian) agreed to our Terms of Use and Liability Waiver — deleting an account does not erase proof that something was agreed to. We will tell you plainly what we kept and why.
- Unsubscribe from the newsletter — one click in any newsletter, or just email us.
Email info@i-wanna-rock.com or call (707) 273-3345. Before we act we will check you are who you say you are, normally by confirming you control the email address or phone number on the account. A parent or legal guardian may make any of these requests for their under-18 student. There is no charge, and asking will never affect your lessons, your price, or how you are treated.
We would rather promise a realistic turnaround than an impressive one: we aim to respond within 30 days. One person handles these alongside a full teaching schedule, so if something is going to take longer we will tell you it is taking longer rather than go quiet.
We do not sell or share your information
We do not sell your personal information, we have never sold it, and we do not share it with anyone for advertising purposes. There is no opt-out process on this Site for the simple reason that there is nothing to opt out of. If that ever changes, this policy changes first — see §11.
Reviewing and changing your information
If you have a portal account, your account page currently shows your name and email, and the classes you are signed up for. It does not yet show everything §1 says we hold — attendance, lesson and payment history, and staff notes are not visible there — and nothing on that page is editable yet. Until that changes, just email us: we will tell you anything we hold about you and make any correction you ask for.
How we respond to “Do Not Track” signals
California law asks websites to say plainly how they treat Do Not Track signals, so here is the plain answer. This Site does not track you across other websites, and it does not change its behaviour when it receives a Do Not Track or Global Privacy Control signal — there is nothing for such a signal to switch off. We run no advertising trackers, no analytics package, and no cross-site profiling of any kind. Rather than honour a signal in name only, we simply do not do the thing the signal exists to stop.
Tracking by other companies through this Site
We do not permit any third party to collect information about your activity across other websites through this Site. The outside services this Site loads are listed in §4 and in our Cookie Notice: they see the request needed to do their job — serve a font, protect the Site, process a payment — and none of them builds an advertising profile of you on our behalf.
8. Children’s and students’ privacy
We teach students of all ages, including children, so this section matters. Please read it alongside our Studio Policy.
- Accounts belong to adults. A Site account for a student under 18 must be created and controlled by a parent or legal guardian, who is responsible for it. Signing up for a minor asks for their date of birth once, up front, so the account is created correctly as a guardian account in the adult’s name — not the student’s. The Site is not designed for a child to register themselves.
- Under 13 — please set the account up yourself. This Site is built for adults booking lessons, and it is not intended for children under 13 to sign up on their own. We do not knowingly collect personal information online from a child under 13. If we learn that a child under 13 has created an account or sent us information without a parent or guardian doing it, we will delete that information promptly and, where we can, contact the parent. If you think that has happened, email info@i-wanna-rock.com and we will deal with it straight away rather than ask you to fill in a form.
- We do not sell or share anyone’s information, at any age. A child’s details are used to teach them music and to bill their parent. That is the whole list.
- What we hold about a minor student is deliberately minimal: their name, their instrument and lesson history, attendance, and their guardian’s contact details. We ask for a date of birth only once, at sign-up for a minor’s account, purely to confirm it needs to be a guardian account — we do not store the date of birth itself, and we do not ask for a student’s home address or school.
- A parent or guardian may ask what we hold about their child, have it corrected, or have it deleted, using the process in §7.
9. Lesson recordings and photographs
The Site itself has no recording feature — it does not record, upload, or store audio, video, or photographs of lessons or students, and there is no facility for anyone to do so through your account. Recording is instead something that may come up during a lesson, and the rules for it are in §10 of our Terms of Use. In short: nobody records a lesson without everyone in it agreeing first, a parent or guardian decides for a student under 18, and we will never use a student’s image, name, or playing in marketing without asking for separate written permission that you are free to refuse.
10. Security
Passwords are stored as bcrypt hashes, never in plain text. Payment card and bank details never reach our servers — they're handled entirely by PayPal/Venmo. We use industry-standard practices (encrypted connections, parameterized database queries, rate limiting) to protect the data we do hold, but no system is 100% secure.
11. Changes to this policy
We may update this Privacy Policy from time to time; the "Last updated" date at the top always reflects the latest revision. If we make a change that materially affects how we handle your information — a new company receiving your data, a new category of information collected, or any change to the promises in §7 — we will say so in a notice at the top of this page for at least 30 days, and email account holders and newsletter subscribers directly. We will not make a material change quietly and let the date stamp do the work.
12. Contact
Questions or requests about your data: info@i-wanna-rock.com or (707) 273-3345, or write to Wes Davis’ “I Wanna Rock” School of Music, Eureka, CA 95501.