Privacy

Chris Jepson is the data controller and can be reached at info@tenuti.ch.

As institutions begin using Tenuti, each institution will become the controller for its own students' and teachers' records, and responsibility for those records will pass to them. You will be told before that happens to any account of yours.

Your account. Name, email address and password (stored only as a cryptographic hash — nobody, including us, can read it). Optionally a short bio, instruments, location, website, date of birth, and for teachers a profile photo. We also record how many times you have signed in and when you last did, to tell active accounts from abandoned ones.

Lessons. Times, durations, locations, who taught whom, any notes you attach when booking, and whether an accompanist was requested.

Students' work. Practice sessions a student logs (what they practised, for how long, their own notes and difficulty rating), repertoire, and course or festival participation.

Teachers' records about students. Written lesson notes and end-of-term assessments with a rating and comments.

Phone notifications, if you turn them on. For each phone or browser where you allow notifications, we keep the address its push service gives us and the keys that encrypt messages to it. It is deleted when you turn notifications off, log out on that device, or the device stops accepting them.

Lesson notes and assessments are visible only to the teacher who wrote them. Students do not see them, and there is no mechanism for sharing them with anyone else.

Your practice log is private to you. Teachers, other students, pianists and institution or platform administrators cannot access your practice activity through Tenuti. Teachers can send you practice instructions, but cannot see your completion, time spent, ratings or reflections. Your connected teacher can see your shared repertoire and lessons.

Other students can see your first and last name against a booked lesson time with a shared teacher, so that lesson swaps can be arranged. If the teacher sorts students into groups (for example by school), only students in the same group see each other. They cannot see your email address, your practice, your repertoire, or anything a teacher has written.

Institution administrators can see which courses run under their institution and how many people are enrolled, but not individual students' practice, repertoire or lesson notes.

Collaborative pianists — a school's staff pianist, or a freelance one a teacher works with — normally see only the lessons they have been asked to play. For those lessons they see the student's name, the time and place, the teacher, and the pieces that student is working on — what anyone needs in order to turn up prepared. They cannot see practice logs, lesson notes or assessments, and they may additionally see a teaching group's class timetable when its teacher explicitly shares that group with them. This includes lesson times and student names, not other groups, other teachers' schedules, repertoire or private records for unassigned lessons. Institution membership is not required. A pianist's repertoire access to a student ends when the lesson does.

We do not sell data, we do not show advertising, and we do not use anything here to build profiles or train machine-learning models.

Vercel hosts the application itself and stores uploaded files — sheet music, images and course covers.

Prisma Data hosts the database: every account, lesson, note and assessment. The database is arranged through Vercel, so it appears on their bill, but the records themselves sit with Prisma.

Resend delivers email — invitations and password resets. They see the recipient address and the message.

Apple, Google and Mozilla deliver phone and browser notifications, if you turn them on — whichever makes your device's browser. Only a short line is sent, such as “A lesson has moved”: never times, notes or anything a teacher has written. The message is encrypted so that only your device can read it.

Sentry records errors, so a page that fails can be found and fixed. A report carries the page you were on, your account's identifier and the technical detail of what went wrong. It does not carry lesson notes, assessments or practice detail. Sentry stores this in the European Union.

Notion holds the log of problems and ideas people report. If you use “Report a problem or share an idea”, what you write is filed there, together with the page you were on, your role and your language — and the screenshot, if you attach one. Your name and email are included only if you tick the box allowing us to contact you; otherwise the report carries nothing that identifies you. Notion is a company in the United States and stores this there. On the rare occasion the log cannot be reached, the report goes to Sentry instead so that it is not lost.

Anthropic reads timetables, and only that. If a teacher uploads a photo, PDF or pasted note of an existing schedule to import it, that file is sent to Anthropic to extract the dates and times. It is not stored there and is not used for training. Nothing else in the app is sent to any AI service — lessons are never recorded or transcribed.

Your browser's speech service. Teachers can dictate lesson notes instead of typing. This uses your browser's own speech recognition, which in Google Chrome sends the audio to Google to convert it to text. If you would rather that did not happen, type the note instead — the feature is entirely optional.

Practice logs, written lesson notes and assessments are deleted automatically after 24 months. A teacher can mark an individual assessment to be kept for longer where there is a reason to — a reference for a conservatoire application, for instance.

Lesson bookings themselves are kept as a record of teaching done, but the written notes inside them are cleared on the same 24-month schedule. Repertoire lists are kept, since they are a record of what someone has played rather than an observation about them.

Your account and everything attached to it is kept until you close it.

Many students here are under 16. Accounts are created by invitation from a teacher, not by children signing themselves up, and by sending that invitation the teacher confirms they have the consent they need from a parent or guardian.

A parent or guardian can ask that teacher, or us, for a copy of their child's data or for it to be deleted, and we will act on it.

Students cannot upload photographs or files. This is deliberate — it keeps the service from holding images of children.

You can download everything held about you at any time from Profile & Settings, as a file you can keep or take elsewhere. You can correct your details on the same page, and you can close your account, which deletes your records.

Under the GDPR you also have the right to object to processing, to ask us to restrict it, and to complain to your national data protection authority if you think we have handled your data badly. You are welcome to raise it with us first at info@tenuti.ch.

Passwords are hashed, never stored as text. Access to student records is checked on every request against the actual teaching relationship, not merely hidden in the interface.

If a breach occurs that puts anyone at risk, we will tell those affected and the relevant authority within 72 hours of becoming aware of it.

If this notice changes in a way that affects what happens to your data, you will be told rather than left to notice the date at the top.