Privacy Policy

Version dated 19 October 2026

This policy explains what personal data the Sheverdina Music Studio project (https://sheverdina-music-studio.com) uses when operating the website, processing purchases, and conducting individual online lessons.

The person responsible for processing personal data is individual entrepreneur Nadiia Sheverdina (Ukraine, Kharkiv, 118 Heroiv Kharkova Avenue; hereinafter, the “Studio” or “we”). Contact details are available on the Legal Notice page. For any questions concerning personal data, you can write to [email protected].

1. What data we use

1.1. The data collected depends on whether you browse the website, make a purchase, create an account, book lessons, or contact the teacher:

  • 1.1.1. Account and sign-in data: name, email address, selected time zone, and authentication data. If you register or sign in with a password, only a cryptographic password hash is stored on the server. When you sign in with Google (Google OAuth), we use the Google account identifier, email, and basic profile data provided for sign-in.
  • 1.1.2. Purchase, order, and lesson data: selected plan, number and duration of lessons, payment amount and currency, order status, technical checkout and Stripe transaction identifiers (PaymentIntent), lesson credit and debit history, remaining available lessons, and dates and statuses of bookings, cancellations, and refunds. If you make a purchase without signing in first, a temporary pending-order record is created, and the account is created after payment is confirmed.
  • 1.1.3. Contact and notification data: your email, phone number or messenger ID (WhatsApp, Viber, Telegram), preferred communication language, message contents, and learning materials you share to arrange lessons. We also record the technical delivery status of service emails and automatic reminders about upcoming lessons (25 hours and 1 hour before they begin).
  • 1.1.4. Online lesson data: participant name, meeting date and time, time zone, Zoom or Google Meet connection links, and audio and video transmitted during a live lesson.
  • 1.1.5. Referral source and PROMO offer participation: information about the source that brought you to the website (traffic_source), whether the offer conditions were met, and use of the one-time free PROMO lesson.
  • 1.1.6. Technical data and security logs: IP address, technical browser and device headers, security session and CSRF tokens, and records of sign-in attempts, password resets, errors, and system activity used to protect the website and accounts against abuse.
  • 1.1.7. Web analytics data: information about page visits and activity on the website collected by the connected Google Analytics and Statcounter services.

2. Payments and request verification

2.1. Payments for services are processed through the secure Stripe payment form. Your full bank card details (full card number, CVV/CVC, and bank verification codes) are entered directly with Stripe and are not stored on the Studio’s server. Do not send your full card number, CVV, passwords, or one-time codes by email or messenger.

2.2. If you contact us about a purchase or refund but have lost access to your account email, we verify the payment by matching the payment number on the receipt and, for card payments, the card’s last four digits. A photograph of the bank card is not required.

2.3. Only if there are reasonable doubts about the applicant’s identity may we ask you to email an image of an identity document to [email protected], with all information not needed for verification covered in advance. An image of a document submitted to verify a refund request is deleted from our mailbox within 30 calendar days after verification is complete.

3. Purposes and legal bases for processing

3.1. We process personal data for the following purposes:

  • 3.1.1. creating and maintaining your account and providing account access;
  • 3.1.2. processing purchases, receiving and recording payments, crediting lesson packages, and handling refunds;
  • 3.1.3. booking lesson times, creating online meetings in the schedule, and sending service notifications and reminders;
  • 3.1.4. conducting individual lessons and communicating with the student (or their parent/legal representative);
  • 3.1.5. providing a one-time free PROMO lesson and preventing repeated use of one-time bonuses;
  • 3.1.6. ensuring website security, preventing fraud, and maintaining legally required financial records.

3.2. Where the General Data Protection Regulation (GDPR) or similar rules apply to processing:

  • 3.2.1. account, purchase, booking, and lesson services are processed for the conclusion and performance of a contract;
  • 3.2.2. payment and order information is retained to comply with legal obligations concerning accounting and reporting;
  • 3.2.3. website protection, abuse prevention, enforcement of one-time bonus limits, and protection of legal claims are based on legitimate interests, while respecting the user’s rights and freedoms;
  • 3.2.4. operations requiring separate consent (including an agreed lesson recording or certain types of analytics) are carried out on the basis of consent, which may be withdrawn at any time.

4. Lesson recordings and children’s data

4.1. By default, the Studio does not make audio or video recordings of online lessons and does not create automatic transcripts or AI notes. If a lesson needs to be recorded for educational purposes, this is agreed separately in advance. Permission to record for personal learning does not mean consent to publish the recording or use it in advertising.

4.2. If a child attends lessons, their parent or other legal representative creates the account, pays for lessons, accepts the website terms, and provides the information needed to arrange the lessons.

5. Who may receive data and international processing

5.1. Nadiia Sheverdina personally conducts the lessons. External services are used to operate the website and provide services; they receive only the data necessary for their function:

  • 5.1.1. Stripe — payment processing, refunds, and payment fraud checks;
  • 5.1.2. Google — Google sign-in (OAuth), schedule synchronization (Google Calendar), lessons in Google Meet (if that platform is selected), email processing (Gmail), font delivery (Google Fonts), and form protection (reCAPTCHA, if enabled);
  • 5.1.3. Zoom — automatic creation of links and delivery of online lessons;
  • 5.1.4. Mailjet — delivery of service emails (registration, purchase, and booking confirmations, password resets, and lesson reminders);
  • 5.1.5. Cloudflare — network routing, domain protection, and email routing services;
  • 5.1.6. Hosting provider and Backblaze — hosting the website server and database and storing encrypted backups;
  • 5.1.7. Google Analytics and Statcounter — website traffic statistics;
  • 5.1.8. unpkg — delivery of interface icons;
  • 5.1.9. WhatsApp, Viber, Telegram — communication with the teacher if you choose to use the relevant messenger.

5.2. The service provider is registered in Ukraine, while technical providers may process data on servers in the European Union, the United States, and other countries under their security rules and applicable cross-border data transfer mechanisms. Data may also be disclosed to competent public authorities where expressly required by law.

6. Cookies and browser local storage

6.1. The website uses cookies and browser local storage (localStorage / sessionStorage) to:

  • 6.1.1. maintain an authenticated session and protect requests against forgery (CSRF protection);
  • 6.1.2. save the state of a purchase or booking when you sign in or proceed to payment;
  • 6.1.3. track the source that brought you to the website and activate a PROMO lesson (the traffic_source cookie is stored for up to 30 days);
  • 6.1.4. collect visit statistics through Google Analytics and Statcounter.

6.2. You can restrict or delete cookies in your browser settings. However, disabling technical cookies will prevent you from signing in to your account and placing orders.

7. Data retention periods

  • 7.1. Account, package, and booking data is retained while you use your account.
  • 7.2. Order, payment, and refund information is retained for as long as necessary to meet tax and accounting requirements and resolve potential payment disputes.
  • 7.3. Technical and security logs are retained for as long as necessary to protect the website and investigate incidents.
  • 7.4. An image of a document provided to verify a refund request is deleted from the mailbox within 30 calendar days after verification is complete.

8. Your rights and data deletion

8.1. Depending on the applicable law, you may request access to your personal data, its correction, deletion, restriction of processing, or portability; object to processing; and withdraw consent previously given.

8.2. To submit a request, write to [email protected]. We handle requests without undue delay, usually within 30 calendar days (where the GDPR applies, we provide a response on the measures taken no later than one calendar month).

8.3. When an account is deleted from the website database, the profile, passwords and sign-in tokens, Google OAuth connections, and scheduled Google Calendar and Zoom meetings are deleted; application metadata for incomplete payments is also cleared. Certain financial information about completed payments may be retained to the extent and for the periods required by applicable law.

8.4. You may also lodge a complaint with the competent data protection authority, including the authority where you live in the EU if the GDPR applies to the processing. Contacting us first is not a required condition for filing such a complaint, but we are always ready to resolve any issue directly and promptly.

9. Changes to this policy

9.1. The current version of the Privacy Policy is always available on this page. If we make a material change to our data processing rules, we will publish an updated version and, if required by law, send a notice or request separate consent.