Privacy Policy
Last updated: August 19, 2026
Your Privacy at a Glance
- We collect only what we need: your name, email, and learning progress.
- We never see your full card number. Payments are tokenized by PCI-certified processors.
- We never sell, rent, or trade your personal data. Period.
- You can access, export, correct, or delete your data at any time.
- We respond to all data requests within 30 days.
Contents
Weiss Guitar Academy ("we," "us," or "our") is committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, how we safeguard it, and what rights you have. It applies to all visitors and users of weissguitar.com, learn.weissguitar.com, and any related services we operate.
1. Who We Are
Weiss Guitar Academy is an online guitar education platform operated by AZ MUSIC EDUCATION LTD, a private company limited by shares registered in the Republic of Cyprus. For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (GDPR), AZ MUSIC EDUCATION LTD is the data controller.
Data Controller: AZ MUSIC EDUCATION LTD
Company registration: HE 485932 (Republic of Cyprus)
Registered office: 143 Faneromenis Avenue, Office 201, 6031 Larnaca, Cyprus
Director: Daniel Weiss
Email: [email protected]
Website: weissguitar.com
2. Information We Collect
We collect only the data necessary to deliver our courses, process payments, and improve your experience. Here is exactly what we collect and why.
2.1 Account Data
When you create an account or make a purchase, we collect your name and email address. This is required to give you access to courses, send receipts, and provide support.
2.2 Payment Data
We never collect, see, or store your full credit card number. All card payments are processed by Stripe, which is certified as a PCI DSS Level 1 service provider. Stripe stores card tokens for recurring subscription billing on our behalf. We receive only a tokenized reference and the last four digits of your card for record-keeping. If you pay via PayPal, we receive your PayPal email address and transaction ID.
2.3 Subscription Data
If you subscribe to the Improvisers Academy or other subscription products, we store your plan type, billing dates, payment history, and cancellation reason (if provided) to manage your account and billing.
2.4 Learning Data
To track your progress and provide a personalized experience, we store lesson completions, practice streaks, bookmarks, your last visited lesson, and video playback positions. Some of this data is stored locally in your browser (localStorage) and may also be synced to our servers when you are logged in. This data is tied to your account and is exportable on request.
2.5 Session and Authentication Data
When you log in to our learning platform, we use secure, short-lived session tokens to keep you authenticated. These are strictly functional and contain no personal data beyond your account identifier.
2.6 Analytics Data
We use Google Analytics 4 with IP anonymization enabled to understand how visitors use our site (pages viewed, session duration, device type). We also use the Meta (Facebook) Pixel to measure the effectiveness of our advertising. Both tools use cookies described in Section 5.
2.7 Feedback and Communications
If you submit feedback through our platform widget or contact us by email, we store your message and email address to respond and improve our service. Feedback submissions are stored in Airtable.
3. Legal Bases for Processing (GDPR)
Under the GDPR, we process personal data on the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and course delivery | Performance of a contract (Art. 6(1)(b)) |
| Payment processing and invoicing | Performance of a contract (Art. 6(1)(b)) |
| Subscription management and recurring billing | Performance of a contract (Art. 6(1)(b)) |
| Transactional emails (receipts, billing alerts) | Performance of a contract (Art. 6(1)(b)) |
| Marketing emails (tips, offers, newsletters) | Consent (Art. 6(1)(a)) |
| Analytics and site improvement | Legitimate interest (Art. 6(1)(f)) |
| Advertising measurement (Meta Pixel) | Consent (Art. 6(1)(a)) |
| Fraud prevention and security | Legitimate interest (Art. 6(1)(f)) |
| Tax and accounting records | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interest, we have assessed that our processing does not override your fundamental rights or freedoms. You may object to processing based on legitimate interest at any time (see Section 10).
4. How We Use Your Information
We use your data for the following purposes and no others:
- Deliver our service: create your account, grant course access, track your progress, and manage subscriptions.
- Process payments: charge your chosen payment method, issue invoices, handle refunds, and manage recurring billing cycles.
- Communicate with you: send transactional emails (receipts, billing alerts, password resets, course updates). These are not marketing and cannot be opted out of while your account is active.
- Marketing (with your consent): send educational content, practice tips, and promotional offers via Mailchimp. You can unsubscribe at any time using the link in every email.
- Improve our platform: analyze anonymized usage patterns to make the learning experience better.
- Measure advertising: understand which ads lead to sign-ups so we can invest in content that reaches the right students.
- Comply with the law: maintain financial records as required by Cyprus tax law and respond to lawful requests from authorities.
We never sell, rent, or trade your personal data. We never share it with unrelated third parties for their own marketing.
7. International Data Transfers
Weiss Guitar Academy is operated from Cyprus, an EU member state. Some of our servers and service providers are located outside the European Economic Area, including in the United States. Your data may be transferred to, and processed in, countries other than the one in which you reside.
Outside the EEA: Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission where one applies to the destination country, and otherwise on Standard Contractual Clauses approved by the European Commission.
United States: Where our US-based processors are certified under the EU-US Data Privacy Framework, transfers rely on that framework. For all other US transfers, we rely on Standard Contractual Clauses (SCCs) or the processor's binding corporate rules, as applicable.
We ensure that any international transfer of personal data is subject to appropriate safeguards in accordance with applicable data protection law.
8. Data Security
We take the security of your data seriously and implement appropriate technical and organizational measures, including:
- Encrypted connections: all data transmitted between your browser and our servers is encrypted (HTTPS).
- Payment isolation: we never receive or store full card numbers. PCI-certified payment processors handle all card data.
- Secure authentication: we use industry-standard secure session management with short-lived tokens.
- Access control: our servers use key-based authentication with restricted access.
- Regular backups: automated daily backups ensure your data is protected against loss.
No system is perfectly secure. While we take all reasonable precautions, we cannot guarantee absolute security. If we become aware of a data breach that may affect your rights, we will notify affected users as soon as reasonably possible and inform the relevant authorities as required by law.
9. Data Retention
We retain data only as long as necessary for its stated purpose. Specific retention periods:
| Data Type | Retention Period |
|---|---|
| Account data (name, email) | While your account is active, plus 90 days after a deletion request |
| Payment tokens | Deleted when subscription is cancelled and any grace period expires |
| Learning progress | While your account is active. Exportable on request before deletion. |
| Subscription data | While your subscription is active. Summary records retained for billing history. |
| Analytics data | Per Google and Meta retention policies (14 months by default) |
| Audit and security logs | 90 days |
| Session data | Auto-expired. Login sessions last up to 30 days of inactivity. |
| Invoices and tax records | 7 years, to meet accounting and tax record-keeping obligations under Cyprus law (which requires a minimum of 6 years) |
| Marketing consent records | For as long as you remain subscribed, plus 3 years after unsubscribe |
When data reaches the end of its retention period, it is securely deleted or anonymized.
10. Your Rights
Depending on where you live, you may have the following rights under applicable data protection laws (including the GDPR, UK GDPR, and CCPA/CPRA):
- Right of access: request a copy of all personal data we hold about you.
- Right to rectification: correct any inaccurate or incomplete data. You can update your account information at any time through the platform, or contact us for assistance.
- Right to erasure ("right to be forgotten"): request deletion of your account and associated data. We will comply within 30 days, subject to any legal obligations to retain certain records (e.g., tax invoices).
- Right to data portability: receive your personal data (including learning progress) in a structured, machine-readable format.
- Right to restrict processing: request that we limit how we use your data in certain circumstances.
- Right to object: object to processing based on legitimate interest, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds.
- Right to withdraw consent: where processing is based on consent (marketing emails, advertising cookies), you may withdraw that consent at any time. For emails, use the unsubscribe link. For cookies, adjust your browser settings.
- Right to lodge a complaint: you have the right to file a complaint with a supervisory authority. For EU/EEA residents, this is your local Data Protection Authority, or the Office of the Commissioner for Personal Data Protection in Cyprus, where we are established. For UK residents, this is the Information Commissioner's Office (ICO).
For California Residents (CCPA/CPRA)
If you are a California resident, you additionally have the right to:
- Know what personal information is collected, used, and shared.
- Request deletion of your personal information.
- Opt out of the "sale" or "sharing" of personal information. We do not sell personal information. Our use of analytics and advertising pixels may constitute "sharing" under the CPRA. You can opt out by disabling third-party cookies in your browser.
- Not be discriminated against for exercising your rights.
How to Exercise Your Rights
Email [email protected] with the subject line "Data Request" and describe what you need. We will verify your identity and respond within 30 days. There is no fee for exercising these rights. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request, and we will explain why.
11. Children and Minors
Our service is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16 without parental consent.
Users between the ages of 16 and 18 may use our platform with the involvement and consent of a parent or legal guardian. Any account or purchase for a minor must be registered and managed by a parent or guardian.
If we become aware that we have collected personal data from a child under 16 without valid parental consent, we will delete that data promptly. If you believe a child has provided us with personal data without consent, please contact us at [email protected].
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page.
For significant changes that affect how we process your data, we will notify you by email or through a prominent notice on our website before the changes take effect. Your continued use of our service after any changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your information, please contact us:
AZ MUSIC EDUCATION LTD, Data Controller (HE 485932)
143 Faneromenis Avenue, Office 201, 6031 Larnaca, Cyprus
Daniel Weiss, Director
We aim to respond to all data-related inquiries within 30 days.