Privacy Policy

2.1

• Account information. Name, email address, phone number, date of birth, sign-in credentials, and country when you sign up. Instructors additionally provide a payout method and authorize an identity verification check, which is performed by our third-party verification provider (Stripe Identity). The provider collects and inspects government-issued ID documents directly. RLGL receives only the verification outcome and does not store the underlying documents. Instructors who wish to teach minors also undergo a background check (see § 16).
• Profile information. For instructors: photo, gallery photos, intro video, audio tracks, headline, bio, teaching philosophy, education, performance credits, instruments, styles, techniques, languages, location, social links, lesson pricing, and availability. For students: name, age band, instrument interests, goals, and similar preferences.
• Payment information. Card details and billing address are collected directly by our payment processor (Stripe) and we do not store full card numbers on our servers. We retain transaction metadata (amount, date, status, last four of card, processor IDs).
• Communications. Messages you send through the platform, including marketplace inquiries before you have a relationship with an instructor, messages between students and instructors after booking, support requests, application responses, and reviews you write or respond to.
• Lesson content. Audio, video, and chat exchanged during live lessons, plus AI-generated transcripts and chapter markers (see § 5).
• Guardian information. For minor students, we collect the parent or guardian’s name, email, phone, relationship to the minor, and (for under-13 students) the information needed to verify parental consent.
• Optional information. Anything else you choose to share, including feedback surveys, optional profile fields, and custom availability notes.

2.2

• Device and connection. IP address, browser and OS, device identifiers, language preference, and time zone.
• Usage. Pages viewed, features used, links clicked, search queries, time spent, referring URL, and similar analytics signals.
• Cookies and similar technologies. See § 9.
• Diagnostics. Error reports and performance telemetry, which may incidentally include information you entered into a form when the error occurred.

2.3

• Identity provider. If you sign in with Google, Apple, or another supported identity provider, we receive your name, email, and provider ID.
• Payment processor. Stripe shares limited information back to us (card brand, last four, expiration, transaction outcome) and, for instructors, identity verification results.
• Background-check provider. The consumer reporting agency we use for instructor verification returns eligibility results and supporting reports (see § 16).
• Other students and instructors. Reviews about you, ratings, and message content that mentions you.

2.4

We treat the following as “sensitive” information (a defined category under California and several other state laws):

• Date of birth and age
• Identity verification outcomes received from our third-party verification provider
• Account credentials (passwords, recovery codes)
• Precise geolocation (only if you grant device permission)
• Recordings and transcripts of live lessons

We use sensitive personal information only to provide the Service, comply with the law, prevent fraud, and (where you consent) deliver the lesson-replay feature. We do not use or disclose sensitive personal information for purposes other than those permitted under applicable law, including providing the requested services, maintaining security, detecting and preventing fraud, and meeting legal obligations.

3.1

We use information about your preferences, activity, goals, instrument interests, lesson history, and similar signals to recommend instructors, content, and features. These recommendations are intended to improve your experience and do not produce legal or similarly significant effects about you. We do not use personal information to make automated decisions that would meaningfully affect your access to the Service without human review.

4.1

• Instructor profile. An instructor’s name, photo, gallery photos, intro video, audio tracks, headline, bio, instruments, styles, location (city level), language, reviews, and pricing are publicly visible on the instructor’s profile page once they go live.
• Student profile. Students are not publicly visible in the marketplace. Instructors a student books with see the student’s name, photo, instrument interests, and prior messages.
• Reviews. Reviews you post are public on the reviewed instructor’s profile, attributed by first name and last initial.

The platform does not surface one party’s email address or phone number to the other in any view or message. That is a structural property of the Service, not a content filter. In addition, we use automated and manual measures designed to detect and restrict attempts to share contact information inside message text. The intended way to reach a student or instructor through RLGL is in-platform.

4.2

We use vendors who process information on our behalf, under contract and for specific business purposes only. The categories of service providers we work with include:

• Identity and authentication providers (for example, Clerk) to create and secure accounts, enforce multi-factor authentication where offered, and manage sessions.
• Payment processors and identity-verification services (for example, Stripe) to handle charges, payouts, and (for instructors) know-your-customer checks.
• Cloud hosting, database, and media-storage providers (for example, Vercel, Neon, and Vercel Blob) to operate the Service and store platform data, including lesson recordings.
• Email and SMS delivery providers (for example, Twilio for SMS) to send transactional and (where you opt in) marketing communications. Mobile information and text messaging opt-in consent are never shared with third parties or affiliates for marketing or promotional purposes.
• Error monitoring and performance analytics providers that help us detect, diagnose, and fix problems; these may incidentally receive your IP address and the information you entered when an error occurred.
• Consumer reporting agencies that screen instructor applicants (with your authorization) as described in § 16.

We update the categories and example vendors above as our vendor relationships change, and we revise this policy when new categories of service providers are added.

4.3

We may receive subpoenas, court orders, warrants, or other legal requests seeking lesson recordings, transcripts, messages, or account information. We may disclose information when we believe in good faith that disclosure is required by law, necessary to enforce our Terms or Code of Conduct, or needed to protect the rights, property, or safety of RLGL, our users (especially minors), or the public. We will narrow our disclosure to what is needed and, where permitted by law and consistent with safety considerations, we will attempt to notify the affected user before producing information.

Where the law prohibits notice (for example, when a request comes with a non-disclosure order), we will comply with the request and seek to challenge or narrow any prohibition on notifying you where appropriate.

4.4

If RLGL is acquired, merged, reorganized, or sells assets, personal information may transfer to the acquiring entity. Where reasonably practicable, we will notify you of any such transfer that materially changes this policy in advance of the change taking effect; if applicable law gives you a right to delete your account before the transfer, we will honor it.

5.1

Before each lesson begins, both participants receive clear on-screen notice that the session will be recorded and transcribed and must affirmatively acknowledge the notice before the lesson’s audio and video begin. By continuing into the lesson after receiving that notice, participants acknowledge and consent to the recording and transcription to the extent permitted by applicable law. If a participant does not wish to be recorded, they may end the session and request a refund through support.

This notice-plus-acknowledgment design is intended to satisfy both one-party and all-party (two-party) recording-consent requirements under federal and state law (including states such as California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington).

5.2

Lesson transcripts are generated by automated speech-to-text tools and may contain errors, mishearings, or omissions. They are intended as a study aid and should not be treated as a verbatim record of the lesson.

Our transcription tools generate text and chapter markers from lesson audio. They do not analyze facial geometry, create voiceprints, or otherwise isolate or store unique biometric identifiers. We do not use lesson audio or video to identify individuals through biometric recognition technologies.

5.3

• The student and the instructor who attended the lesson can watch the recording and download the transcript.
• For minor students, the parent or guardian of record can watch every recording from the minor’s account.
• Authorized RLGL personnel may access recordings only for safety investigations, support cases, fraud prevention, or legal requests, and only under access controls.
• We will not sell lesson recordings, will not share them with third parties for advertising, and will not provide them to third-party AI model trainers outside of RLGL.

5.4

See § 11 for the lesson-recording sunset schedule.

7.1

A child under 13 cannot use the Service until a parent or legal guardian has approved the account. We support two creation paths.

• Parent-created. A parent or legal guardian creates an account, identifies the child it is for, and provides the child’s name and date of birth.
• Minor-initiated. A prospective student begins signup themselves and provides their name and date of birth. If the date of birth indicates the user is under 13, the Service routes the account through a parental approval flow before activating it. We send a verification email to the parent address provided during signup; the parent must click the verification link to approve the account. Until that approval is received, the account remains inactive and the child cannot take lessons, send messages, or have data processed beyond what is needed to deliver the parental notice.

In both paths the parent retains the rights described in § 7.3below, including the right to review or delete the child’s data at any time, and explicitly acknowledges that lessons are recorded and transcribed and that the parent can review every recording and every message from the child’s account.

We treat the parent’s approval as our parental consent step under COPPA and will continue to evaluate our consent mechanism as the Service evolves.

7.2

For children under 13, we seek to limit our collection to what is reasonably necessary to operate the Service for them: the child’s name and date of birth (used to determine age and route the account through the right consent flow), instrument and learning preferences, lesson schedule, in-platform messages with their instructor, and the lesson recordings and transcripts described in § 5. We do not require persistent identifiers beyond what is needed to keep the child signed in, we do not show them third-party advertising, and we do not enable behavioral advertising about them.

7.3

A parent or guardian of a child under 13 has the right, at any time, to:

• Review the personal information we have collected about the child.
• Request that we delete the child’s personal information.
• Refuse to permit further collection or use of the child’s information.
• Watch every lesson recording and read every message.
• Receive direct notice of any material change to how we handle the child’s data.

To exercise any of these rights, contact us at parents@redlightgreenlight.music. We will verify the request and respond within a reasonable time, and in any event no later than required by law.

7.4

We do not condition a child’s participation in any RLGL activity on more personal information than is reasonably necessary.

13.1

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, the categories of sources, the business purposes, and the categories of third parties with whom we share it.
• Access the specific pieces of personal information we have about you.
• Correct inaccurate personal information.
• Delete your personal information (subject to retention exceptions).
• Opt out of any sale or sharing of personal information for cross-context behavioral advertising. We do not sell or share personal information in this sense, and we honor the Global Privacy Control as a valid opt-out signal.
• Limit our use of sensitive personal information to what is necessary to provide the Service.
• Not be discriminated against for exercising these rights. We do not offer financial incentives in exchange for personal information.

You may submit a request through your account settings or by emailing privacy@redlightgreenlight.music. An authorized agent may submit a request on your behalf with (a) written permission signed by you, (b) proof of the agent’s identity, and (c) for access, deletion, or correction requests, our verification of your identity directly with you before we act.

Shine the Light (Cal. Civ. Code § 1798.83): We do not share personal information with third parties for their direct-marketing purposes.

13.1.1

Reference table

For California residents, the table below summarizes the categories of personal information we collect, where the information comes from, why we collect it, and the categories of recipients we share it with.

For retention windows that apply to each category, see § 11. We do not sell or share personal information for cross-context behavioral advertising.

13.2

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Nebraska, Kentucky, Rhode Island, and other states that enact similar laws have substantially similar rights: access, correct, delete, export, and (depending on the state) opt out of targeted advertising, sale, or profiling that produces legal or similarly significant effects.

Illinois. The Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14) regulates the collection, use, and retention of biometric identifiers (such as scans of face geometry and voiceprints) and biometric information derived from them. RLGL does not collect or generate biometric identifiers or biometric information from lesson recordings, transcripts, or any other source. Our transcription tools produce text from audio without isolating, storing, or comparing unique vocal or facial characteristics. We do not use lesson audio or video to identify individuals through biometric recognition technologies. If we ever introduce a feature that would collect or generate biometric identifiers or biometric information from Illinois residents, we will obtain the written informed consent BIPA requires before doing so.

Maryland. Maryland’s Age-Appropriate Design Code (effective 2025) applies to online services likely to be accessed by minors and requires data minimization, high-privacy defaults, and impact assessments. RLGL applies the minor protections described in §§ 7 and 8 to all minor accounts.

Nevada. Nevada residents have the right to tell us not to sell their covered personal information to third parties under Nev. Rev. Stat. § 603A.300 –.360. We do not sell covered personal information.

New York. New York’s Child Data Protection Act (effective 2025) restricts processing of the personal data of users under 18, including targeted advertising and certain data sales. RLGL does not target advertising to minors and does not sell minor personal data; parent and guardian visibility into minor accounts is described in §§ 7 and 8.

Vermont. Vermont’s child data protection law (effective 2025) layers stricter consent and data-minimization requirements on top of COPPA for users under 18. RLGL’s COPPA-aligned process in § 7 is designed to also meet these requirements.

Washington. Washington residents may have additional rights under state privacy laws (including the My Health My Data Act, where applicable). RLGL does not collect consumer health data as defined by that statute, but Washington residents may exercise the rights described in this section by contacting us.

Florida. Florida’s Digital Bill of Rights includes specific protections for minors that apply regardless of company size, including limits on collecting precise geolocation from minors and restrictions on certain uses of voice and facial- recognition data. RLGL does not collect precise geolocation from minor accounts and does not use lesson audio or video for facial recognition or voice recognition (see § 5.2).

We respond to verified requests from residents of those states the same way we respond to California requests. Where state law gives you a right to appeal a denied request, contact privacy@redlightgreenlight.music with the word “Appeal” in the subject line, and we will respond within the time your state requires.

We do not engage in profiling that produces legal or similarly significant effects about you, and we do not use personal information for targeted advertising.