WoodSong · Legal
Privacy Policy
Contents
- Who We Are
- Information We Collect
- How We Use Your Information
- Legal Bases for Processing
- Sharing Your Information
- Data Retention
- Your Rights
- Children's Privacy
- Security
- Cookies & Tracking
- International Transfers
- Canadian Residents (PIPEDA)
- EU/UK Residents (GDPR)
- California Residents (CCPA)
- Changes to This Policy
- Contact Us
Section 01
Who We Are
WoodSong Music Inc. ("WoodSong", "we", "us", or "our") operates the WoodSong platform accessible at woodsong.ca — a multi-portal SaaS application serving musicians, music students, music teachers, and luthiers.
WoodSong Music Inc. is incorporated and operating under the laws of Nova Scotia, Canada.
⚠ Lawyer review needed: Confirm legal entity name, registration number, and registered address. Verify governing jurisdiction language is correct for your incorporation.
Section 02
Information We Collect
⚠ Lawyer review needed: Draft lists the following categories — confirm accuracy and completeness:
Account data: email address, display name, portal type (Player / Student / Teacher / Luthier), subscription status, trial dates.
Instrument data: instrument make, model, year, serial number, string change logs, maintenance records, humidity readings entered by the user.
Usage data: pages visited, features used, timestamps. Collected via Microsoft Clarity (session recording and heatmap tool).
Authentication data: managed by Supabase Auth (email/password or Google OAuth). WoodSong does not store raw passwords.
Payment data: billing handled by Stripe (planned). WoodSong does not store card numbers.
Communications: support emails sent to privacy@woodsong.ca or support@woodsong.ca.
Account data: email address, display name, portal type (Player / Student / Teacher / Luthier), subscription status, trial dates.
Instrument data: instrument make, model, year, serial number, string change logs, maintenance records, humidity readings entered by the user.
Usage data: pages visited, features used, timestamps. Collected via Microsoft Clarity (session recording and heatmap tool).
Authentication data: managed by Supabase Auth (email/password or Google OAuth). WoodSong does not store raw passwords.
Payment data: billing handled by Stripe (planned). WoodSong does not store card numbers.
Communications: support emails sent to privacy@woodsong.ca or support@woodsong.ca.
Section 03
How We Use Your Information
⚠ Lawyer review needed: Draft purposes include: providing and improving the service, portal-specific features (teacher/student relationships, repair job tracking), sending transactional emails (confirmation, password reset), processing subscription billing, analytics and performance monitoring, fraud prevention, and legal compliance. Lawyer to confirm appropriate legal bases for each purpose.
Section 04
Legal Bases for Processing
⚠ Lawyer review needed: GDPR Article 6 bases to confirm: (a) consent, (b) contract performance, (c) legal obligation, (f) legitimate interests. List which basis applies to each processing activity identified in Section 3.
Section 05
Sharing Your Information
⚠ Lawyer review needed: Draft third-party processors include: Supabase (database and authentication, hosted in AWS), Stripe (billing, planned), Microsoft Clarity (analytics). Confirm whether any data leaves Canada, and whether standard contractual clauses or adequacy decisions apply.
Section 06
Data Retention
⚠ Lawyer review needed: Draft retention policy: active account data retained for the lifetime of the account; deleted account data removed within [X] days of deletion request. Lawyer to confirm appropriate retention periods and backup deletion timelines.
Section 07
Your Rights
⚠ Lawyer review needed: Rights to confirm by jurisdiction: access, rectification, erasure ("right to be forgotten"), data portability, restriction of processing, objection, withdrawal of consent. WoodSong provides an in-app account deletion flow and responds to privacy@woodsong.ca requests within [X] business days. Lawyer to confirm timelines and scope.
Section 08
Children's Privacy
⚠ Lawyer review needed: WoodSong's student portal may be used by minors under teacher supervision. Users under 13 require parental consent (COPPA / PIPEDA). Users under 16 in EU require parental consent (GDPR Art. 8). WoodSong collects a parent permission form during soft launch for minors. Lawyer to confirm consent mechanism is legally sufficient for all target jurisdictions (Canada, USA, EU).
Section 09
Security
WoodSong uses industry-standard security measures including:
- TLS encryption for all data in transit (HTTPS via Netlify)
- Supabase row-level security (RLS) policies on all database tables
- Authentication managed by Supabase Auth with bcrypt password hashing
- No storage of payment card numbers (Stripe handles all billing)
⚠ Lawyer review needed: Confirm this security description is accurate and sufficient. Add breach notification language and timelines (72 hours under GDPR; PIPEDA Breach of Security Safeguards Regulations).
Section 10
Cookies & Tracking
⚠ Lawyer review needed: WoodSong uses: localStorage (theme preference, onboarding state — no personal data); Microsoft Clarity (session recording, heatmaps — behavioural data). Lawyer to advise whether a cookie consent banner is required given Clarity's use, and what the PIPEDA / GDPR / ePrivacy Directive obligations are.
Section 11
International Data Transfers
⚠ Lawyer review needed: Supabase stores data in AWS (confirm region — likely us-east-1). Confirm whether Canada's PIPEDA adequacy provisions or GDPR Standard Contractual Clauses (SCCs) apply, and whether a transfer impact assessment is needed.
Section 12
Canadian Residents (PIPEDA)
⚠ Lawyer review needed: PIPEDA 10 principles: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use/Disclosure/Retention, Accuracy, Safeguards, Openness, Individual Access, Challenging Compliance. Confirm WoodSong's practices satisfy each principle. Include OPC (Office of the Privacy Commissioner) complaint process.
Section 13
EU / UK Residents (GDPR / UK GDPR)
⚠ Lawyer review needed: Confirm whether WoodSong is subject to GDPR (targeting EU users?). If yes: appoint EU representative if no EU establishment, confirm lawful bases, confirm supervisory authority. Include right to lodge complaint with relevant DPA.
Section 14
California Residents (CCPA / CPRA)
⚠ Lawyer review needed: Confirm whether CCPA applies (annual gross revenue >$25M, or data of 100,000+ consumers, or 50%+ revenue from selling data). If applicable: rights to know, delete, opt-out of sale, non-discrimination. Confirm "Do Not Sell My Personal Information" requirement. If CCPA does not yet apply, confirm threshold and add future-proofing language.
Section 15
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email and by updating the "Last updated" date at the top of this page. Continued use of WoodSong after a change constitutes acceptance of the revised policy.
⚠ Lawyer review needed: Confirm notice mechanism and whether 30-day advance notice is required for material changes under any applicable law.
Section 16
Contact Us
For privacy-related questions, requests, or complaints:
Privacy contact
⚠ Lawyer review needed: Add physical mailing address once registered. Confirm whether a designated Privacy Officer must be named under PIPEDA.