Suoni Privacy Policy — privacy-v1
Document identifier reserved: privacy-v1 Effective date: 3 October 2026 Controller: Educational Whiteboards Limited Privacy contact: teachingwhiteboards@gmail.com
1. Who we are
Educational Whiteboards Limited operates Suoni.
For the personal information described in this policy, Educational Whiteboards Limited is the controller unless we state otherwise.
Contact us at teachingwhiteboards@gmail.com for privacy or data-rights requests.
2. Scope
This policy explains how Suoni handles personal information when you use our website, mobile applications, support channels and related services.
The initial controlled release keeps registration and child learner access disabled. If child learner access is introduced later, it will require a separately approved safeguarding and privacy release and may require a new privacy-policy version.
3. Information we may handle
Depending on the features available in the version you use, we may handle:
Account and profile information
This may include name, email address, account or user identifiers, authentication information, profile image, teacher biography, instruments, languages, availability and other profile details.
Lesson and service information
This may include lesson requests, bookings, lesson status, teacher or learner associations, lesson timing, notes, reviews, reports, sheet-music references and related service records.
Messages and user-generated content
This may include messages, support communications, lesson notes, reviews, reports, biographies, uploaded documents, sheet music, images and other content you choose to provide.
Audio and video
Where live lesson or classroom functionality is enabled, camera and microphone data may be transmitted to provide the live session. Suoni does not treat live audio or video as recorded content unless a recording feature is separately enabled and disclosed.
Payment and transaction information
Where payment functionality is enabled, we may handle transaction history, amounts, payment status, payout or withdrawal records and payment-provider identifiers.
We do not need to store full payment-card details where they are processed directly by a regulated payment provider.
Technical, security, device and approximate-location information
This may include IP address, device or installation identifiers, app version, operating system, authentication/security records, logs, crash or diagnostic information and information needed to detect abuse or protect the Service.
Where an enabled analytics or infrastructure provider derives city, region or country from an IP address, Suoni may handle approximate-location information. Suoni does not require precise GPS location for the initial controlled service.
Search and interaction information
When you search for a teacher or instrument, the search text is transmitted to Suoni so that matching results can be returned. Where product analytics is enabled, search and feature-interaction information may also be used to understand and improve the Service.
Support, moderation, privacy and safeguarding information
If you contact us or make a report, we may handle the content of that correspondence and the evidence reasonably necessary to investigate, respond, comply with law or protect users.
Safeguarding evidence may be extracted into a restricted record with tighter access controls where retention is required.
4. Why we use personal information
Depending on the context, we use personal information to:
- provide and secure the Service;
- authenticate users and maintain account state;
- display profiles and enable teacher discovery;
- provide messaging, lesson, document or classroom functionality where enabled;
- administer payments where enabled;
- respond to support and data-rights requests;
- investigate abuse, security events, moderation reports or safeguarding concerns;
- maintain audit, deletion and security evidence;
- comply with legal, regulatory, accounting or law-enforcement obligations; and
- understand and improve the Service where analytics is lawfully enabled.
5. Legal bases
We use personal information only where we have an applicable lawful basis.
For the initial controlled service, the principal bases are:
- contract, where processing is necessary to provide an existing account holder with a feature or service they request, such as account access, tutor search, messaging or access to retained transaction history;
- legitimate interests, where necessary and proportionate to secure and operate Suoni, prevent fraud or abuse, investigate ordinary moderation reports, maintain service reliability, provide general support, preserve necessary audit evidence or establish and defend legal rights. Our interests are protecting users and the Service, keeping records accurate, responding to users and maintaining the security and integrity of Suoni;
- legal obligation, where processing is necessary to comply with applicable law, including handling data-rights requests or keeping records that law requires; and
- consent, where a specific optional use requires consent.
Optional analytics, live audio/video, new payment flows and push notifications are not enabled merely by listing a possible lawful basis here. If a material new purpose or feature is enabled, we will identify the applicable basis and update our privacy information where required.
We do not rely on this policy to enable child processing. Any child-access release requires a separate approved basis, transparency and safeguarding assessment before activation.
6. Service providers and other recipients
Suoni uses infrastructure and service providers to operate the Service. The providers involved depend on which features are enabled.
These may include:
- Google Cloud / Firebase for cloud infrastructure, authentication, installation identifiers, messaging infrastructure, databases and related platform services;
- Sentry for crash, diagnostic or performance monitoring where monitoring is enabled;
- Mixpanel for product analytics where analytics is enabled;
- Agora for live audio/video communications where live classroom functionality is enabled;
- Stripe for payment processing where payment functionality is enabled; and
- Google / Gmail for the published support and rights-request mailbox at teachingwhiteboards@gmail.com.
We may also use providers for hosting, storage, security and operational support where necessary.
The published mailbox currently uses the consumer version of Gmail. Google states that it does not act as a data processor and does not offer a Data Processing Agreement for consumer Gmail; Google's consumer Terms of Service and Privacy Policy apply. Support and rights-request correspondence may therefore also be processed by Google under its own privacy framework.
Other providers may act as our processor/service provider or, for some activities, as an independent controller. Where a provider acts as an independent controller, its own privacy information applies to that processing.
7. Sharing
We do not sell personal information.
We may disclose information:
- to service providers acting on our behalf;
- where necessary to complete a user-requested service;
- to professional advisers where appropriate;
- to competent authorities where legally required; or
- where necessary to protect users, investigate serious misuse, address a safeguarding concern or defend legal rights.
Where a third party acts as an independent controller, its own privacy notice will apply.
8. International transfers
Some providers may process information outside the United Kingdom.
For Google Cloud / Firebase customer data, Google publishes UK GDPR data-processing terms and contractual transfer mechanisms, including UK controller-to-processor standard contractual clauses where applicable.
The consumer Gmail service used for the published support mailbox is governed by Google's own consumer privacy framework rather than a Suoni processor agreement. Google states that information may be processed on servers outside the country where the user lives and publishes transfer mechanisms including adequacy arrangements, the UK Extension to the EU-U.S. Data Privacy Framework where applicable, and standard contractual clauses where required.
For any other restricted international transfer for which Suoni is responsible, we use an appropriate safeguard or another transfer basis recognised by UK law.
9. Retention
We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected and for applicable legal, security, accounting, dispute or safeguarding requirements.
Current controlled retention decisions include:
- general support correspondence: normally no more than 12 months;
- privacy and data-rights correspondence: normally no more than 24 months;
- spam or misdirected mailbox content: normally no more than 30 days;
- safeguarding/moderation evidence that must be retained: extracted to the controlled record, with the mailbox copy deleted within 30 days where appropriate;
- ordinary non-safeguarding moderation records: 24 months after case closure;
- safeguarding case records: 10 years after case closure followed by mandatory review;
- learner-to-lesson linkage, if child learner access is later enabled: normally 90 days after lesson completion/cancellation before removal or pseudonymisation;
- learner-related adult/tutor messaging context, if applicable: normally 12 months;
- learner ownership, authority, deletion and security audit evidence, if applicable: normally 12 months.
A legal hold, active dispute, fraud/security investigation or legal requirement may justify a longer period for a defined record.
Adult financial and accounting retention is managed separately from child identity retention.
10. Account deletion
If you have a Suoni account, you can request deletion through an available in-app deletion option or through Suoni's published account-deletion web page. You can also contact teachingwhiteboards@gmail.com for assistance with a deletion request. We may ask for information reasonably necessary to verify that the request relates to your account.
A valid deletion request does not necessarily erase every record immediately. We may retain or pseudonymise information where required for legal obligations, accounting, security, safeguarding, fraud prevention, dispute handling or proof that a deletion request was completed.
The account-deletion process removes or scrubs active authentication/private account state and preserves controlled evidence that the deletion request was carried out. Historical records involving another user, financial/accounting records, safeguarding evidence or records subject to a legal hold may be retained only where there is a legitimate reason to do so.
11. Security
We use technical and organisational measures designed to protect personal information, including access controls, encryption where appropriate, restricted evidence stores, logging and controlled release processes.
No internet service is completely secure. If you believe your Suoni account or information has been compromised, contact us promptly.
12. Children
Child learner registration and child access are disabled in the initial controlled release.
Before any child-access release, Suoni requires additional safeguarding, continuity, service-hours, age/guardian, transparency and store-policy controls.
A later child-access release may require a new immutable Privacy Policy identifier rather than modifying privacy-v1 in place.
13. Automated decision-making
Suoni does not use solely automated processing to make decisions that produce legal or similarly significant effects on users in the initial controlled release.
14. Your rights
Depending on the circumstances, UK data-protection law may give you rights to:
- obtain access to your personal information;
- correct inaccurate information;
- request deletion;
- restrict processing;
- object to certain processing;
- receive certain information in a portable format; and
- withdraw consent where processing is based on consent.
These rights are subject to legal conditions and exceptions.
To exercise a right, contact teachingwhiteboards@gmail.com.
You may also complain to the UK Information Commissioner's Office if you believe your data-protection rights have been infringed.
15. Changes to this policy
Material changes will use a new immutable policy version. We will not silently replace the published body associated with privacy-v1.
16. Company information and contact
Educational Whiteboards Limited Company number: 14554635 Registered in: England and Wales Registered office: Educational Whiteboards Limited, 124 City Road, London, England, EC1V 2NX Email: teachingwhiteboards@gmail.com