Privacy policy

This Privacy Policy explains how Program Partner, LLC (“Program Partner,” “we,” “us,” or “our”) collects, uses, discloses, protects, retains, and deletes information when schools, arts programs, directors, staff, students, parents, guardians, and other authorized users access the Program Partner web application and related services (the “Services”), and when anyone visits our website at myprogrampartner.com. A mailing address is available upon verified request.

1. Scope and our role

Program Partner is a multi-organization, role-based platform for band, chorus, orchestra, theatre, private-studio, and related program-management activities. Enabled features may include communications, calendars, forms, fees and receipt review, fundraising credits, purchase requests, practice logs, Skill Pathways, achievements, inventory, file submissions, and administrative reporting.

For records supplied by or maintained on behalf of a participating school or program, that organization determines the educational or program purpose and controls those records. Program Partner acts as a service provider performing authorized functions. Individual users may separately control limited information associated with their own login account. This distinction affects who may request access, correction, export, or deletion.

2. Information we collect

Account and identity information. Names, email addresses, optional phone numbers, account identifiers, authentication method, role assignments, organization memberships, invitation and join-code records, and information needed to connect an authorized parent, guardian, student, director, staff member, or platform administrator to the correct program records.

Google sign-in. If you sign in with Google, Google provides only your name, email address, and profile picture, which we use to create and identify your account. Program Partner’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

School and program records. Student names, photos, and contact information; ensemble, class, instrument, cast, group, and roster information; guardian and student relationships; participation and attendance-related information; forms, permissions, acknowledgments, and responses; and related timestamps and status records. Forms a program assigns may ask for health and emergency information, such as allergies, medications, physician, and insurance details. When someone signs a form, we record the signature, the signer’s name, the time, and the signer’s IP address and browser. Equipment agreements record the signer’s name, email, typed signature, and the time.

Instructional and progress information. Practice requirements and logs, Skill Pathways assignments and progress, quizzes, recordings, performance or skills submissions, teacher or director feedback, approvals, achievements, and similar educational records when an organization enables those features.

Inventory, fee, and transaction records. Equipment and inventory assignments, condition and return records, amounts assigned, balances, credits, payment status, fundraising allocations, purchase requests, receipt images, and records documenting program transactions. When a program enables online payment, card details are entered on the hosted checkout pages of the program’s own payment processor (Stripe, Square, or PayPal), and full card numbers are never stored by Program Partner. Users should not enter full payment-card numbers or other payment credentials into ordinary forms or messages.

Content and files. Documents, images, audio, video, receipts, form responses, messages, and other content uploaded or submitted through an enabled feature.

Communications and delivery information. Recipient addresses, message content, portal notifications, email delivery events, bounces, complaints, unsubscribes, and open or click signals where supported. Email privacy tools, image proxies, and link scanners may make engagement signals incomplete or inaccurate.

Calendar and integration information. Events from a Google or Outlook calendar a program connects (read-only), and Skill Pathways recordings stored in a program’s own Google Drive when it connects one, together with the connection settings and synchronization details needed to provide that integration.

Technical and usage information. Device and browser information, IP address, session and authentication records, security and audit logs, feature activity, error information, request metadata, and similar operational information used to provide, secure, diagnose, and improve the Services.

3. How information is used

• Provide organization-authorized administrative, instructional, communication, transaction, and family-facing workflows.
• Authenticate users, connect accounts to appropriate records, and apply organization-, relationship-, and role-based access controls.
• Send transactional and program communications, process delivery events, and present message status to authorized users.
• Maintain records, provide support, diagnose errors, prevent misuse, investigate incidents, and protect the security and reliability of the Services.
• Improve functionality using aggregated or de-identified information where reasonably practicable and consistent with school instructions and applicable law.
• Meet legal obligations and enforce agreements governing the Services.

Program Partner does not sell personal information. Student information is not used for behavioral advertising, targeted advertising, unrelated profiling, or unrelated commercial purposes. Program Partner will not build advertising profiles from school-controlled records.

The Program Partner app does not send school-controlled records to artificial-intelligence services, and does not let AI assistants or other outside apps sign in to or act on a user’s account. A signed-in user can choose to add a personal calendar subscription link to a calendar app such as Google Calendar, Apple Calendar, or Outlook. That app then receives the events available to the account (for a family, the events it can see; for staff, the organization’s calendar), including titles, times, locations or meeting links, descriptions, cancellation status, and event identifiers.

Program Partner’s developers use AI-assisted coding and code-review tools on the source code and on demonstration data, and do not use them to look at school-controlled records. Older development notes that held limited details about individual users remain in the source code repository’s private history, which those tools can read.

4. School-authorized use; FERPA and children’s privacy

When a school provides education records under an applicable FERPA exception, Program Partner will use those records only to perform the school-authorized service or function, remain subject to the school’s direction and control regarding use and maintenance of the records, and not redisclose or repurpose them except as directed by the school or permitted by law.

For a child under 13, a school may authorize collection on a parent’s behalf only for a school-authorized educational purpose and not for an unrelated commercial purpose. When school authorization is unavailable or insufficient, Program Partner may require verifiable parental consent or decline to collect the information. Participating organizations remain responsible for determining the legal basis for their use, providing required notices, and obtaining any consent required by their policies or applicable law.

Program Partner seeks to collect and retain only information reasonably necessary for an enabled educational or program purpose. This policy does not, by itself, certify compliance with every federal, state, local, or district requirement. Program Partner will cooperate with reasonable privacy reviews and written data-protection terms.

5. When information may be disclosed

• To authorized users within the participating organization, according to their roles, guardian or student relationships, and legitimate program responsibilities.
• To service providers that support hosting, database, authentication, storage, email delivery, payment processing, security, networking, diagnostics, source control, or related operations, only as needed to provide the Services and subject to appropriate restrictions.
• At the direction of the school or program, including approved exports, integrations, transfers, or disclosures initiated by an authorized organization administrator.
• To comply with law, legal process, or a valid governmental request; protect rights, safety, or security; investigate misuse; or enforce applicable agreements.
• As part of a reorganization, financing, merger, acquisition, or transfer of the business, subject to continued protection of the information and any required notice, consent, or school approval.

6. Service providers

The following list reflects the current production architecture.

No advertising network is integrated into the Services. Program Partner will update this list before enabling any new service that materially processes school-controlled or child information.

7. Where data is stored

Program Partner runs the app on its own Cloudflare account and keeps its database, sign-ins, and files in its own Supabase project, hosted in [the United States — confirm the project’s region]. Supabase states that a project’s database, sign-in service, and stored files stay in the region selected for the project. Network, email, payment, sign-in, support, and operational metadata handled by other providers may be processed in other locations described in their terms and documentation.

Supabase keeps its own daily backups of the database for 7 days. Program Partner’s daily encrypted backup of the database and uploaded files is stored in Cloudflare R2, separately from Supabase, and can be read only with a key Program Partner holds.

8. Security

Program Partner uses administrative, technical, and organizational safeguards appropriate to the nature of the Services. Current controls include encrypted network connections, authenticated access, organization- and role-based authorization enforced by database rules and server checks, private storage for uploaded files, managed cloud infrastructure, access restrictions, and security and audit logging. Supabase encrypts stored data with AES-256 and data in transit with TLS. Credentials for services a program connects are additionally encrypted before they are stored, and daily backups of the database and uploaded files are encrypted before they leave the application. When Program Partner staff open a program to give support, the session is time-limited, its reason is recorded, and it is logged.

No online service can guarantee absolute security. Users should protect their credentials and report suspected unauthorized access to support@myprogrampartner.com.

If Program Partner becomes aware of a security incident affecting protected information, it will investigate, take reasonable containment and remediation measures, and notify affected organizations or individuals as required by law or applicable agreement.

9. Retention and deletion

School-controlled records are retained according to the participating organization’s instructions, the organization’s active use of the Services, documented backup cycles, and applicable law. Program Partner does not intend to retain child or student information indefinitely.

After a school or organization ends its use of Program Partner, school-controlled records will be returned if the organization asks and then deleted within 45 days of the organization’s written request or the end of its service, unless a shorter period is agreed or retention is required by law. Copies in encrypted backups expire within 30 days after that. If a backup is ever restored, previously deleted records are deleted again.

A user may request deletion of the user’s own account information by contacting support. Requests concerning school-controlled student records must be directed to the participating school or program, which will instruct Program Partner as appropriate. Deleting an account does not automatically require deletion of records the school must retain or records documenting completed transactions, submissions, permissions, or communications.

10. Access, correction, export, and choices

Users may request access to or correction of their own account information through available settings or by contacting support. Parents, guardians, eligible students, and others seeking school-controlled educational records should contact the participating organization. Authorized organizations may request an export, correction, return, or deletion of their controlled records, subject to applicable law and agreed procedures.

Users may manage browser permissions and unsubscribe from optional communications where offered. Required account, security, transactional, or school-authorized communications may still be sent. Organization administrators control many program communication settings and recipient selections.

11. Cookies and similar technologies

The Services use essential cookies or comparable browser storage for sign-in, session continuity, security, organization selection, preferences, and core functionality. Email messages may use provider-hosted images or tracked links to report delivery or engagement where enabled. Program Partner does not use school-controlled student information for cross-site behavioral advertising. The myprogrampartner.com website sets no cookies (see section 12).

12. Our website, demo requests, and messages to us

This section covers myprogrampartner.com, which anyone can visit without an account. It does not cover the records programs keep in the app, which the sections above describe.

Visiting the site. The site sets no cookies and carries no advertising trackers or social-media pixels. Cloudflare Web Analytics counts page views without cookies and without following you from site to site. Like any website host, GitHub, which serves the site, receives your IP address and browser details with each page request. Links to our Facebook and Instagram pages are plain links; those sites’ own policies apply once you follow one.

The Let’s chat form. When you send a message, we collect what you enter: your name, email, role, school or studio, state, program type and size, the topics you want help with, the tools you use now, your message, your consent to be emailed about it, and the page you sent it from. It is stored in Program Partner’s own database, using the providers in section 6, and we receive an email notice of it through Resend. To limit spam, we also record your email address and IP address for repeated-submission checks, and delete those records after 7 days. [Keep only if Turnstile is added:] Cloudflare Turnstile checks that a person, not an automated program, is sending the form, using signals from your browser.

Scheduling a demo. The Schedule a demo button opens a booking page run by [Google Calendar or Calendly]. What you enter there goes to that service under its privacy policy and to our calendar, and we use it to hold the call.

How we use it. We use what you send only to reply to you, prepare a demo or quote, and follow up on your request. We don’t sell it, share it for anyone else’s marketing, or add you to a mailing list unless you ask. We keep a message for as long as we’re in contact about it, and no more than [24] months after our last contact, and delete it sooner if you ask at support@myprogrampartner.com.

Children. The website and its forms are for adults, such as directors, booster officers, and studio teachers. If we learn that a child under 13 has sent us a message, we delete it.

13. Changes to this policy

This policy may be updated as the Services, providers, data practices, or legal requirements change. The effective date will be revised when a new version is published. Material changes affecting school-controlled information will be communicated to participating organizations as required by agreement or law. Where required, Program Partner will obtain authorization before applying a materially different use to previously collected information.

14. Contact

Privacy, account-deletion, and security questions may be sent to support@myprogrampartner.com. A mailing address is available upon verified request. Requests involving school-controlled student records should first be directed to the participating school or program.