Privacy Policy
Who we are
Tradroom is the registered business name of Gearóid Keane, trading as Tradroom. Tradroom is a private portal that Irish traditional music teachers and organisations use to share notation and recordings with their students and to manage classes. You can reach us at privacy@tradroom.ie.
The organisation or independent tutor who invited you is the data controller for their students’ information; Tradroom acts as a data processor on their behalf, under our Data Processing Agreement. For the data of account holders themselves (an organisation’s or tutor’s own contact and billing details) and for visitors to this website, Tradroom is the data controller.
What we collect
- Account data: name, email address and a securely hashed password.
- Student data: where applicable, date of birth, contact email/phone and postal address, class enrolments, attendance, and assigned resources. This is treated as sensitive and access is tightly restricted (see below).
- Parent/guardian data: name and contact details, and the consent choices a guardian records for their child.
- Membership data: for Comhaltas branches, membership type and number.
- Billing data: for account holders on a paid subscription, the plan, billing history and a payment reference. Card payments are handled directly by our payment provider (Stripe) — we do not see or store full card numbers.
- Uploaded content: the notation, recordings and teaching materials a tutor uploads to share with their students. This stays the tutor’s own intellectual property; we only store and serve it to run the service, and never sell it, pass it to third parties, or use it to train AI without separate opt-in. See section 4 of the Terms of Use.
- Technical data: a strictly-necessary session cookie to keep you signed in (see our Cookie Policy). If you turn on notifications we store your device’s web-push subscription, and if you set up a passkey we store its public credential — both only to provide those sign-in/notification features, and you can remove either at any time.
How access is controlled
Every read of a student’s personal data passes through a single access layer that returns only what your role is entitled to see, and records the access. An organisation administrator sees their own students; a teacher sees the names of students in classes they teach; a guardian sees only their own children; and the Tradroom operators never see individual student data — only the account-holder contact for an organisation or independent tutor.
Legal basis
We process account and student data to deliver the service under our agreement with the controlling organisation or tutor (contract), and to meet our legitimate interest in running a secure platform. Special categories of data are not intentionally collected. For children, processing relies on parent/guardian consent where required.
Who we share it with
We use a small number of trusted processors, and do not sell personal data. The authoritative, up-to-date list — with each provider’s processing location and transfer safeguards — is in Annex 2 of our Data Processing Agreement. In summary:
- Vercel — application hosting (EU/EEA).
- Amazon Web Services (S3, eu-west-1) — storage of uploaded notation and audio files (Ireland, EEA).
- Neon — PostgreSQL database hosting (United Kingdom, covered by the UK adequacy decision).
- AhaSend — transactional email (invites, verification, notifications). EU-based; email is processed and stored in the EU/EEA.
- Stripe — subscription payment processing (card details go directly to Stripe; we do not store them). Some payment data is processed in the United States under Standard Contractual Clauses and the EU–US Data Privacy Framework.
- Sentry provides application error monitoring, to diagnose and fix faults. Error reports are stored in Sentry’s EU data region, and we strip direct identifiers (email, name, IP) and request contents before an event is sent. Operated by Functional Software, Inc. under Standard Contractual Clauses for any processing outside the EEA.
- Matomo — optional, self-hosted website analytics (EEA), loaded only if you consent (see the Cookie Policy).
Where a processor is outside the EEA, the transfer relies on a valid GDPR mechanism — an adequacy decision, or Standard Contractual Clauses with any additional safeguards required.
Retention
We keep personal data for as long as the account is active. When an account or organisation is closed, its personal data is deleted, subject to a short backup-retention window. Uploaded files are removed when the resource is deleted or the account is closed.
Children’s data
Tradroom is designed for music education, which includes children. A student who is under 18 must be linked to at least one parent/guardian, who can review their child’s details and give or withdraw consent (for example for photos/recordings or public display) from their portal. Student personal data is never shown on public pages. (Ireland’s digital age of consent is 16.)
Your rights
You have the right to access, correct, erase, restrict, object to, and receive a copy (portability) of your personal data. To exercise any of these, contact the organisation or tutor who invited you, or email us at privacy@tradroom.ie. You can also complain to the Irish Data Protection Commission.
Changes
We may update this policy; the “last updated” date above reflects the latest version.