Privacy Policy
Last updated: July 29, 2026
This Privacy Policy explains how Luminary Education ("we," "us") collects, uses, discloses, and protects information in connection with NoteIt Music ("the App"). By using the App, you consent to the practices described here.
1. Data Controller
Luminary Education is the data controller responsible for your personal information under this Policy.
2. Information We Collect
- Account data: email address and authentication credentials, managed via Firebase Authentication. We never see or store your raw password.
- Billing data: handled entirely by Stripe, Inc. We receive only your subscription status, plan, and a Stripe customer/subscription ID — never your full card number.
- Usage data: daily App usage duration (for enforcing free-tier limits), feature interactions, and general analytics (device/browser type, approximate location via IP, timestamps).
- User Content: your music projects, audio files, and related metadata, stored so you can access your work across sessions.
- Communications: any messages you send us for support, along with your email address.
3. How We Use Information
- To create, authenticate, and maintain your account;
- To process subscription payments and enforce plan entitlements;
- To enforce free-tier usage limits;
- To provide customer support and respond to inquiries;
- To maintain, secure, and improve the App;
- To detect, investigate, and prevent fraud, abuse, or violations of our Terms of Service;
- To comply with legal obligations.
We do not use your personal information or User Content to train AI or machine learning models.
4. Legal Basis for Processing (where applicable, e.g. GDPR)
- Performance of a contract (providing the App and subscription you signed up for);
- Legitimate interests (security, fraud prevention, service improvement);
- Consent (for optional communications, where required);
- Legal obligation (tax, accounting, and regulatory compliance).
5. Third-Party Service Providers
We share limited data with the following processors, solely to operate the App:
- Stripe, Inc. — payment processing (stripe.com/privacy)
- Google Firebase — authentication and database storage (firebase.google.com/support/privacy)
- Cloudflare, Inc. — hosting, content delivery, and security (cloudflare.com/privacypolicy)
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. If we add new subprocessors that materially change how your data is handled, we will update this Policy and provide notice as described in Section 13.
6. Data Retention
- Account and User Content data is retained for as long as your account is active.
- Accounts with no login activity for 24 consecutive months are considered inactive; we may notify you and, absent a response, delete or anonymize the associated data.
- If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required for legal, tax, billing-dispute, or fraud-prevention purposes.
- Billing records may be retained for up to 7 years as required by applicable tax and accounting laws.
7. Data Security & Breach Notification
We use industry-standard technical and organizational measures (including encryption in transit, access controls, and reputable infrastructure providers) to protect your data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected users and applicable regulators without undue delay, consistent with applicable law.
8. International Data Transfers
Your data may be processed and stored in countries other than your own, including the United States, via our service providers. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for such transfers.
9. Your Rights
Depending on your location, you may have the right to:
- Access, correct, or delete your personal data;
- Object to or restrict certain processing;
- Request a portable copy of your data;
- Withdraw consent at any time (where processing is based on consent);
- Lodge a complaint with your local data protection authority (e.g., under GDPR or CCPA).
To exercise these rights, contact edu.luminary.create@gmail.com. To protect your account, we will take reasonable steps to verify your identity before fulfilling a request — for example, confirming details tied to your account. We will respond within the timeframe required by applicable law.
10. Children's Privacy
- The App may be used by children with the consent of a parent or legal guardian, as described in our Terms of Service.
- Where a child under 13 uses the App, we rely on the consent of that child's parent or guardian for the collection and use of the child's information described in this Policy.
- A parent or guardian may review, update, or request deletion of their child's information at any time by contacting edu.luminary.create@gmail.com.
11. Cookies & Tracking
The App may use essential cookies or local storage for authentication sessions and basic analytics. We do not use cookies for third-party advertising.
12. U.S. State Privacy Rights (California and Others)
- California residents may have additional rights under the CCPA/CPRA, including the right to know what personal information is collected, request deletion, correct inaccurate information, and opt out of the "sale" or "sharing" of personal information (including for cross-context behavioral advertising).
- We do not sell personal information as defined under the CCPA, and we do not share personal information for cross-context behavioral advertising.
- We will not discriminate against you for exercising any privacy rights described in this Policy.
- Residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as they take effect) may have similar rights; contact us to exercise them.
13. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via email or in-App notice at least 14 days before taking effect, and the "Last updated" date above will be revised.
14. Contact Us
Questions or requests regarding this Privacy Policy or your data may be sent to edu.luminary.create@gmail.com.