PracticeMate — Data Protection & Privacy Policy

Version: 1.2

Date: 16 October 2026

Data Controller: Music Practice Mate (for school accounts, the school is the data controller and PracticeMate is its processor – see Section 10)

Contact: info@musicpracticemate.co.uk

DPO: No DPO appointed (not required under UK GDPR Article 37). Data protection matters: info@musicpracticemate.co.uk

---

1. Introduction

PracticeMate is a web-based music practice and education platform. This policy explains how we collect, use, store, and protect personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any applicable guidance from the Information Commissioner’s Office (ICO).

This policy has been written with schools’ data protection requirements in mind, including Data Protection Impact Assessments (DPIAs) and Data Processing Agreements (DPAs), and addresses the specific requirements of schools, trusts, and educational institutions.

---

2. Data We Collect

2.1 User Profile Data (WordPress Account)

When a user creates an account or completes the profile builder, we collect:

Data	Purpose	Lawful Basis
First name, last name	Account identification	Contract
Email address	Account login, communications	Contract
Skill level, grade	Personalised practice recommendations	Legitimate interest
Preferred musical style, favourite bands	Content personalisation	Legitimate interest
Learning goals, focus areas, struggles	Tailored practice plans	Legitimate interest
Instrument type (guitar/bass/piano)	Tool and content selection	Legitimate interest

2.2 Educational User Data (School/Institution Accounts)

For users in educational settings, additional data is collected. School accounts are described in full in Section 10.

Data	Purpose	Lawful Basis
School name, school type	Educational context for AI coaching	Legitimate interest / Public task
Role (e.g. Head of Music, Teacher)	Role-appropriate content	Legitimate interest
School context, vision, improvement priorities	Contextualised AI advice	Legitimate interest
Inspection framework (e.g. OFSTED)	Curriculum alignment	Legitimate interest
BTEC student name	BTEC evidence logs and assessment	Public task (education)
Pupil sign-in details from the school’s Google Workspace: Google account ID, first and last name, school email address, school domain	School sign-in (“Sign in with Google”) and linking the pupil to their school	Public task (school as controller)
Username and password (backup sign-in method using a school access code)	School sign-in where Google sign-in is not used	Public task (school as controller)
Teacher accounts, classes and class membership	Letting teachers create classes and pupils join their teacher’s class	Public task (school as controller)
Pupils’ practice records (signed-in school pupils only)	Letting pupils keep a practice record that their teacher can see	Public task (school as controller)
Audit log (sign-ins, refused sign-ins, staff-code sign-ups, class joins, with IP address)	Security and accountability	Public task (school as controller)

2.3 Practice & Progress Data

Data	Storage Location	Purpose
Practice session logs (timestamps, durations)	Browser localStorage + WordPress DB	Progress tracking
BTEC practice evidence logs	Browser localStorage (for signed-in school pupils, new entries are also stored on our server – see Section 10)	Qualification evidence
AI-generated practice plans	Browser localStorage (individual users can choose to save a generated plan to their account; school accounts cannot)	Session planning
Saved musical content (riffs, tabs, progressions, phrases)	Browser localStorage	User-created content
Next steps assessments (scales, chords, theory, fretboard, technique)	WordPress DB (user meta)	Learning progress tracking
Saved AI-generated content	WordPress DB (private posts)	User reference material
AI tool usage counts (how many times a tool has been used, when it was last used)	WordPress DB (user meta)	Managing use of the AI tools
School pupils’ practice entries (Practice Log, BTEC log, practice planner, warm-ups)	Browser localStorage + PracticeMate server (signed-in school pupils only)	Practice record shared with the pupil’s teacher (see Section 10)

2.4 AI Interaction Data

When users use the AI practice tools, the following is sent to OpenAI’s GPT-4o model via the Meow AI Engine WordPress plugin:

Data Sent	Recipient	Purpose
What the user types into the chat assistant	OpenAI (GPT-4o) via Meow AI Engine	Generate personalised practice advice
The user’s question or choices made in an AI tool	OpenAI (GPT-4o) via Meow AI Engine	Generate the requested content
Practice profile, for the Practice Planner (instrument, skill level, daily practice time, goals, genres, favourite artists, what the user finds difficult)	OpenAI (GPT-4o) via Meow AI Engine	Generate a personalised practice plan
Player profile (AI-written summary of strengths/challenges) – legacy feature, older individual accounts only	May use Google’s Gemini API	Continuity of coaching (never used for school accounts – see Section 7.3)

Important: OpenAI acts as a data processor. PracticeMate’s AI tools never add the user’s name, email address or account ID to what is sent. AI prompts and answers are not logged or stored by PracticeMate. See Section 7 for details.

2.5 Contact & Enquiry Data

Data	Source	Purpose	Retention
Email address, instrument	Landing page trial signup	Trial registration	Until trial ends or consent withdrawn
School name, contact name, role, email, phone, department size, message	Education enquiry form	B2B enquiry handling	12 months or until enquiry resolved

2.6 Technical Data

Data	Purpose	Notes
IP address (hashed)	Rate limiting on forms	Not stored permanently; transient (60 seconds)
AI usage figures (token counts, hashed IP address)	Monitoring use of the AI tools	Kept by the AI Engine plugin, which runs in privacy-first mode; no prompt or answer text is kept
Server error logs	Debugging and security monitoring	May contain anonymised references to user actions

2.7 Data We Do NOT Collect

• We do not use analytics or tracking tools (no Google Analytics, Mixpanel, Hotjar, or tracking pixels). WooCommerce’s order-attribution cookies are switched off.
• We do not set any custom cookies (only standard WordPress authentication cookies for logged-in users), with two exceptions for school accounts: school sign-in sets a short-lived security cookie during Google sign-in, and signing out sets a short-lived cookie that tells the browser to clear practice data
• We do not collect payment or financial data (handled by third-party payment processor if applicable)
• We do not collect biometric data, health data, or data about race, religion, political beliefs, or sexual orientation

---

3. Lawful Basis for Processing

Under UK GDPR Article 6, we rely on the following lawful bases:

Processing Activity	Lawful Basis	Justification
Account creation & login	Contract (Art 6(1)(b))	Necessary to provide the service
Personalised practice recommendations	Legitimate interest (Art 6(1)(f))	Core purpose of the platform; minimal privacy impact
AI-powered coaching	Legitimate interest (Art 6(1)(f))	Core service feature; users initiate queries
Educational context processing	Public task (Art 6(1)(e))	Supporting statutory education provision
BTEC evidence logging	Public task (Art 6(1)(e))	Supporting qualification requirements
School accounts (sign-in, classes, pupils’ practice records)	Public task (Art 6(1)(e)) – the school’s lawful basis	The school is the data controller; we process this data on its behalf under a data processing agreement
Marketing emails	Consent (Art 6(1)(a))	Only sent with explicit opt-in
Education enquiry handling	Legitimate interest (Art 6(1)(f))	Responding to institutional enquiries

3.1 Children’s Data (Under 13)

Where PracticeMate is used in schools with pupils under 13:

• Processing is undertaken under public task (Art 6(1)(e)) as part of the school’s educational provision
• The school acts as data controller for student data; PracticeMate acts as a data processor
• PracticeMate processes school account data under a Data Processing Agreement (DPA) with the school (Art 28)
• For pupils signed in with a school account, practice entries are stored on our server as well as in the browser, and their teacher can see them (see Section 10)
• Parental consent is managed by the school in accordance with their own policies
• We apply additional safeguards for children’s data (see Sections 8 and 10)

3.2 Special Category Data

We do not intentionally collect special category data (Art 9). If such data is inadvertently provided in free-text fields (e.g. AI chat), it is not extracted, categorised, or used for any purpose.

---

4. How Data is Stored

4.1 Client-Side Storage (Browser localStorage)

The following data is stored locally on the user’s own device and is never transmitted to our servers unless the user explicitly triggers an action (e.g. AI query), or the user is a pupil signed in with a school account (see below):

• Guitar/bass/piano profile preferences
• Practice plans and session logs
• Saved musical content (riffs, tabs, progressions, phrases)
• BTEC student name and practice evidence
• UI preferences (left-handed mode, colour-blind mode)

Key points:

• This data does not leave the user’s browser unless they choose to export it, with one exception: for pupils signed in with a school account, each new practice entry saved in the Practice Log, BTEC log, practice planner or warm-ups is also stored on our server (see Section 10). Older data already in the browser is never uploaded.
• Signing out of a school account clears that pupil’s practice data from the browser, so it is not left on shared computers
• Users can clear this data at any time via browser settings or the in-app Data Manager (export/import/clear)
• Data is stored as plaintext JSON (not encrypted at rest in localStorage)
• No localStorage data is transmitted to third parties

4.2 Server-Side Storage (WordPress Database)

User meta data, saved content and school account records are stored in the WordPress database hosted by SiteGround:

• Location: SiteGround’s London data centre (Google Cloud, London)
• Encryption: Data encrypted at rest (SiteGround infrastructure) and in transit (TLS/SSL)
• Access: Restricted to authenticated administrators and the user’s own account; for school pupils, their own teacher can also see their practice records (see Section 10)
• Backups: Managed by SiteGround’s automated backup system

4.3 Email Data

Contact form submissions and trial signups are sent via wp_mail() and are not stored in the WordPress database. They exist only in the recipient email inbox.

---

5. Data Sharing

We do not sell, rent, or trade personal data. Data is shared only with the following parties:

5.1 Data Processors

Processor	Data Shared	Purpose	Location	DPA Status
OpenAI (GPT-4o) via Meow AI Engine	The user’s question or tool choices, what they type into the chat assistant, and (for the Practice Planner) their practice profile. No name, email address or account ID is added.	AI-powered practice tools; moderation of pupils’ messages	United States	OpenAI Data Processing Addendum with UK transfer safeguards
Google (Gemini API) – legacy feature	Player profile data for older individual (non-school) accounts only	Legacy AI-written player profile	Google Cloud (EU/US)	See Section 13
SiteGround	All server-side data (WordPress DB, server logs)	Web hosting	UK (London)	Included in hosting agreement
WordPress / Automattic	Authentication cookies	CMS functionality	N/A (self-hosted)	N/A

5.2 Content Delivery Providers (No Account Data Shared)

We load code libraries, sound samples and a feedback form from the following providers. No account data is transmitted to these providers, though standard HTTP metadata (IP address, user-agent) is sent as part of the request:

• jsDelivr (jsdelivr.net) – alphaTab music notation library (content delivery, no account data)
• Cloudflare CDN (cdnjs.cloudflare.com) – Tone.js audio library (content delivery, no account data)
• GitHub Pages (surikov.github.io) – WebAudioFont instrument sound samples (content delivery, no account data)
• Tally (tally.so) – feedback form. It loads only when you open Feedback, and Tally receives only what you type into the form

5.3 YouTube (Google)

Backing track players embed YouTube videos in YouTube’s privacy-enhanced mode (youtube-nocookie.com). Nothing is loaded from YouTube until you press Play on a backing track. YouTube’s own privacy policy applies to this embedded content, and YouTube may set cookies once a backing track is played.

---

6. Data Retention

Data Category	Retention Period	Deletion Method
User account & profile	Duration of account + 30 days after deletion request	WordPress account deletion
Practice logs (localStorage)	Until user clears browser data or uses Data Manager (cleared on sign-out for school accounts)	User-controlled
Saved content (WordPress)	Duration of account	Deleted with account
AI prompts and answers	Not logged or stored by PracticeMate. OpenAI keeps API data for up to 30 days for abuse monitoring.	Not applicable (PracticeMate); automatic deletion by OpenAI
School pupils’ practice records (server)	400 days	Automatic deletion; removed at once if the account is deleted
School account audit log	90 days	Automatic deletion
School accounts	Decided by the school (e.g. when pupils leave)	All school data deleted or returned when the school’s licence ends
Education enquiry emails	12 months	Manual deletion from inbox
Trial signup emails	6 months	Manual deletion from inbox
Rate limiting transients	60 seconds	Automatic expiry

---

7. Third-Party AI Processing (OpenAI)

7.1 What Data is Sent

When a user uses one of the AI tools, the following data may be sent to OpenAI:

• The user’s question, or the choices they make in an AI tool
• What the user types into the chat assistant
• For the Practice Planner, their practice profile: instrument, skill level, daily practice time, goals, genres, favourite artists and what they find difficult
• School context data (for educational staff users, where a tool uses it)

PracticeMate’s AI tools never add the user’s name, email address or account ID.

7.2 OpenAI’s Data Processing

• OpenAI’s GPT-4o model processes prompts to generate responses
• OpenAI does not use API data to train its models
• OpenAI keeps API data for up to 30 days for abuse monitoring
• We use the Meow AI Engine WordPress plugin as an intermediary. It runs in privacy-first mode, keeping only usage figures (token counts, hashed IP address); AI prompts and answers are not logged or stored by PracticeMate
• Individual users can choose to save a generated plan to their account; this is not available to school accounts
• Our use of OpenAI is covered by OpenAI’s Data Processing Addendum, with UK transfer safeguards (see Section 13)

7.3 Legacy Player Profile (Google Gemini)

An older feature that keeps an AI-written “player profile” (a summary of strengths and challenges) still exists for older individual accounts. It may use Google’s Gemini API. It applies to individual (non-school) accounts only; school accounts never use it.

7.4 Safeguards

• Prompts are sanitised before transmission (HTML stripped, input validated)
• AI responses are sanitised before display (HTML tags stripped, code blocks cleaned)
• AI answers in the tools are labelled as AI-generated
• Error messages returned to users are generic; detailed errors are logged server-side only
• No raw database queries or credentials are ever included in prompts
• Additional controls apply to school accounts (see Section 10.7)

---

8. Children’s Data & Educational Use

8.1 Age-Appropriate Design

In compliance with the ICO’s Age Appropriate Design Code:

• We do not use nudge techniques or reward loops designed to extend usage
• We do not profile children for commercial purposes
• We collect only the minimum data necessary for educational functionality
• The BTEC student name field is clearly labelled and its purpose is transparent
• Pupils are told in the app (on the Practice Log and next to the notes fields) that their teacher can see what they save

8.2 School Responsibility

When PracticeMate is deployed in a school setting:

• The school is the data controller for student personal data
• PracticeMate acts as a data processor under a data processing agreement (Art 28)
• The school is responsible for:
• Obtaining any necessary parental consent
• Informing students about how their data is used
• Conducting their own DPIA if required
• Ensuring appropriate internet safety measures
• Deciding when pupil accounts are deleted (for example, when pupils leave)
• Choosing whether AI features are available to pupils (see Section 10.7)

8.3 BTEC Student Data

• Without a school sign-in, student names and practice evidence are stored only in browser localStorage on the device being used, and are not transmitted to our servers or any third party
• For pupils signed in with a school account, each new BTEC entry (unit/topic, what was practised, why it matters, what improved, what needs work and teacher feedback) is also stored on our server so that their teacher can see it (see Section 10)
• Signing out of a school account clears that pupil’s practice data from the browser. Schools should still ensure devices are appropriately secured

---

9. Individual Rights

Under UK GDPR, individuals have the following rights:

Right	How We Support It
Right of access (Art 15)	Users can view all their data in their account. Contact us for a formal Subject Access Request (SAR). We will respond within 30 days.
Right to rectification (Art 16)	Users can update their profile at any time. Contact us for corrections to server-side data.
Right to erasure (Art 17)	Users can delete localStorage data via the Data Manager. Account deletion requests fulfilled within 30 days.
Right to data portability (Art 20)	The Data Manager allows export of all localStorage data as a JSON file. Server-side data provided on request.
Right to restrict processing (Art 18)	Contact us to restrict specific processing activities.
Right to object (Art 21)	Contact us to object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
Right not to be subject to automated decision-making (Art 22)	AI coaching provides recommendations only; no automated decisions with legal or significant effects are made.

School accounts: the school is the data controller, so pupils (and parents) should make rights requests to the school. We will help the school to respond.

9.1 How to Exercise Your Rights

Contact us at: info@musicpracticemate.co.uk

We will:

• Verify your identity before processing any request
• Respond within 30 calendar days
• Not charge a fee unless the request is manifestly unfounded or excessive

---

10. School Accounts

10.1 Signing In

• Pupils sign in with their school Google Workspace account (“Sign in with Google”). We receive and store their Google account ID, first and last name, school email address and school domain
• We request only basic profile access (openid, email, profile). We have no access to Gmail, Drive, Classroom or passwords
• As a backup, a school can give pupils an access code to create a username and password account
• Website admin and editor accounts cannot use school sign-in
• Teachers join with a staff code. Teacher accounts are confirmed by the school before they can see any pupil data. Teachers create classes and share a 6-character class code, which pupils use to join their teacher’s class

10.2 Practice Records Stored on Our Server

For signed-in school pupils only, each new practice entry saved in the Practice Log, BTEC log, practice planner or warm-ups is also stored on our server. This includes the date, minutes, tool, activities and notes, and for BTEC entries the unit/topic, what was practised, why it matters, what improved, what needs work and teacher feedback. Older data already in the browser is never uploaded.

10.3 What Teachers Can See

A pupil’s own teacher can see, for their own classes only:

• Who has joined the class
• When each pupil last signed in
• Minutes practised in the last 7 and 30 days, and the last practice date
• Practice entries for the last 90 days, and only entries made since the pupil joined that teacher’s class

Teachers can download a CSV file of the records held. Pupils are told in the app (on the Practice Log and next to the notes fields) that their teacher can see what they save.

10.4 Shared Computers and Cookies

Signing out of a school account clears that pupil’s practice data from the browser, so it is not left on shared computers. School sign-in sets a short-lived security cookie during Google sign-in, and signing out sets a short-lived cookie that tells the browser to clear practice data.

10.5 Retention and Deletion

• Practice records are deleted after 400 days
• The audit log (sign-ins, refused sign-ins, staff-code sign-ups and class joins, with IP address) is deleted after 90 days
• Deleting an account removes its school records at once
• The school decides when accounts are deleted (for example, when pupils leave)
• All school data is deleted or returned when the school’s licence ends

10.6 Roles and Rights

• The school is the data controller; PracticeMate is its processor under a data processing agreement (Art 28)
• The school’s lawful basis is public task (Art 6(1)(e))
• Rights requests from pupils go through the school; we will help the school to respond
• Schools can contact us about school data at schools@musicpracticemate.co.uk

10.7 AI Controls for Schools

• Each school chooses whether AI is on for everyone, on for teachers only, or off
• For school accounts, email addresses, phone numbers, postcodes and the pupil’s own name are removed from typed text before it is sent to the AI
• Pupils’ messages are checked with OpenAI’s moderation service. If that check is unavailable, the pupil’s message is not sent
• Pupil requests include instructions to stay on music and to be age-appropriate
• AI answers in the tools are labelled as AI-generated
• The legacy Google Gemini player profile (Section 7.3) is never used for school accounts

---

11. Security Measures

11.1 Technical Measures

• All data transmitted over HTTPS/TLS encryption
• CSRF protection via WordPress nonce verification on all AJAX endpoints
• Authentication checks on sensitive endpoints (content saving, profile updates)
• Input sanitisation and output escaping on all user-provided data
• Subresource Integrity (SRI) hashes on third-party CDN scripts
• Rate limiting on public-facing forms (1 request per IP per 60 seconds)
• Generic error messages to users; detailed errors logged server-side only
• No direct database queries exposed to client-side code

11.2 Organisational Measures

• Access to the WordPress admin panel restricted to authorised personnel
• Strong password requirements for admin accounts
• Regular backups of the codebase and database
• Security patches applied promptly
• Plugin usage minimised (plugins activated only when needed, deactivated after)

11.3 Known Limitations & Mitigations

Limitation	Risk	Mitigation
localStorage data is unencrypted	Data accessible if device is compromised	Users advised to use personal/secured devices; schools to manage device security; signing out of a school account clears practice data from the browser
AI prompts contain user profile data	Data transmitted to OpenAI (US)	OpenAI Data Processing Addendum with UK transfer safeguards; API data not used for model training; no name, email or account ID added; for school accounts, contact details and the pupil’s name removed from typed text
Legacy player profile (older individual accounts)	Data may be transmitted to Google	Individual (non-school) accounts only; never used for school accounts
School pupils’ practice records stored on our server	Pupils’ notes visible to their teacher	Visible only to the pupil’s own teacher for their classes; pupils told in the app; deleted after 400 days
BTEC student names in localStorage	Name visible in browser storage	Schools to manage device access; cleared from the browser when a school account signs out

---

12. Data Breach Procedures

In the event of a personal data breach:

1. Identification & Containment – Immediately investigate and contain the breach
2. Risk Assessment – Assess the risk to individuals’ rights and freedoms
3. ICO Notification – If the breach poses a risk to individuals, notify the ICO within 72 hours of becoming aware
4. Individual Notification – If the breach poses a high risk, notify affected individuals without undue delay
5. School Notification – If the breach involves student data, notify the school without undue delay and within 24 hours of becoming aware
6. Documentation – Record all breaches, their effects, and remedial actions taken, regardless of whether the ICO is notified

Breach reporting contact: info@musicpracticemate.co.uk

---

13. International Transfers

Our website and database are hosted by SiteGround in its London data centre. Some data is transferred outside the UK:

• OpenAI (United States): data sent to the AI tools is processed by OpenAI under OpenAI’s Data Processing Addendum, which includes UK transfer safeguards
• Google Gemini (legacy player profile, older individual accounts only): Google provides safeguards through Standard Contractual Clauses (SCCs), Google’s data processing terms, and UK GDPR adequacy decisions where applicable

We will review international transfer mechanisms regularly and update this policy if transfer arrangements change.

---

14. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via:

• A notice on the PracticeMate platform
• Email notification to registered users (for significant changes)
• Updated version number and date at the top of this document

---

15. Contact & Complaints

Data Controller: PracticeMate

Email: info@musicpracticemate.co.uk

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: https://ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF