Privacy Policy

Downbeat LLC ("Downbeat," "we," "us," or "our") provides a software platform for the management of marching band, concert band, color guard, and related music program operations (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the rights you have with respect to your information.

This Policy applies to the Downbeat website at https://www.downbeatapp.com and any Downbeat-branded application or service that links to it.

1. Definitions

Account Holder means an adult (18 or older) who registers an account to access and use the Service on behalf of an educational institution. This typically includes band directors, administrators, volunteers, and staff members.

Customer means the educational institution, school district, band program, or other organization that has entered into a subscription with Downbeat and on whose behalf the Service is operated.

Customer Data means all data submitted to, stored in, or generated by the Service by or on behalf of a Customer, including student roster information, inventory records, assignment history, uploaded files, and related records.

Guardian Portal User means an individual identified by a Customer as a parent, legal guardian, or other authorized adult contact for a student, who accesses the Service through a magic-link authentication flow to view records relating to that student. Guardian Portal Users do not hold Accounts and do not pay for the Service.

Student Portal User means a student enrolled in a Customer's program who accesses the Service's Student Portal through a magic-link authentication flow, where the Customer has enabled the Student Portal for its program. Student Portal Users do not hold Accounts and do not pay for the Service.

Student Education Records means any Customer Data that constitutes an "education record" as defined under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g.

Sub-Processor means a third-party service provider engaged by Downbeat to process Customer Data or Personal Data in connection with the Service.

Personal Data means information that identifies, relates to, describes, or could reasonably be linked with a particular individual.

Service means the Downbeat platform, including the website, applications, APIs, and any related functionality provided by Downbeat LLC.

You means the individual accessing or using the Service.

2. Information We Collect

We collect information in five distinct categories, each governed by different rules.

2.1 Student Education Records (collected on behalf of schools)

When a Customer uses the Service to manage its program, Account Holders enter information about students enrolled in the Customer's program. This information may include:

• Student first and last name
• Grade level or class year
• Student identification number (where provided by the Customer)
• Student date of birth, where the Customer has enabled the Student Portal. Date of birth is entered by the student during Student Portal signup and is used solely to verify the link between a student and the guardian or guardians authorized to view that student's records. It is not used for any other purpose.
• Ensemble, section, and part assignments
• Instrument, uniform, and equipment assignments
• Damage reports and repair history associated with assigned items, including reports submitted by students through the Student Portal
• Fee obligations and payment status
• Email address (where provided for program communications or Student Portal access)
• Completed digital forms, including electronic signatures. Where a Customer publishes a form for completion by a parent, guardian, or student, the completed form is stored as part of the relevant student's record. Electronic signatures are captured as a typed name or a drawn signature image and are embedded in the completed form document.
• Photographs uploaded by Account Holders, students, or other users to document equipment condition, damage, or inventory. Such photographs may incidentally include students; where a student is identifiable, the photograph is treated as part of that student's record and is subject to the FERPA commitments below

The Customer controls what optional information is collected. The Service allows Customers to define custom student fields and custom forms; any data collected through Customer-defined fields or forms is determined by, controlled by, and the responsibility of the Customer institution.

Student Education Records are provided to Downbeat by the Customer (typically by an Account Holder such as a band director) or, where the Customer has enabled the Student Portal or published a form, submitted by the student or guardian at the Customer's direction. In every case they are processed by Downbeat solely on the Customer's behalf. See the "FERPA Compliance" section below for the full governing framework.

2.2 Account Holder Information

When an adult registers an account with the Service, we collect:

• First and last name
• Email address
• Password (stored only in hashed form)
• Role within the organization (e.g., director, assistant director)
• Billing information, where the Account Holder is responsible for paying for the Service (processed by Stripe; see "Payments" below)
• Communications with Downbeat support

2.3 Visitor and Prospect Information

When you visit the Downbeat website or submit a contact form, we may collect:

• Information you voluntarily provide (name, email, organization, message content)
• IP address, browser type, device identifiers, and pages visited
• Referring URL and approximate geographic location derived from IP address
• Information transmitted by cookies and similar technologies (see "Cookies")

2.4 Guardian Portal User Information

The Service includes a Guardian Portal that allows parents, legal guardians, and other authorized adult contacts to view records relating to a specific student in a Customer's program. Guardian Portal Users do not create Accounts; they sign in by entering their email address and clicking a single-use, time-limited link sent to that email.

For Guardian Portal Users, we process the following information:

• Guardian first and last name (provided by the Customer)
• Guardian email address (provided by the Customer; used to authenticate access via magic link)
• Guardian phone number, where provided by the Customer (not used for authentication)
• The link between the guardian and the student or students whose records the guardian is authorized to view (provided by the Customer, or verified through the date-of-birth confirmation flow described in Section 2.1)
• Magic link tokens (stored only in hashed form, expire after 15 minutes, single-use)
• Session tokens (stored only in hashed form, expire after 30 days of inactivity)
• IP address and user-agent string captured at the time of magic link request and session creation, used solely for security monitoring, rate limiting, and abuse detection

Guardian contact information is provided to Downbeat by the Customer, not collected directly from the guardian. Guardian-specific security data (magic link tokens, session tokens, IP addresses, user-agent strings) is collected directly from the guardian's device when they use the Guardian Portal, and is used by Downbeat exclusively for security purposes. This security data is not surfaced to the Customer institution or to any Account Holder. The Customer can see whether a guardian has activated the portal and can revoke a guardian's active sessions at any time, but cannot view IP addresses, login timestamps, or session counts for any guardian.

2.5 Student Portal User Information

Where a Customer has enabled the Student Portal for its program, students may sign in to view their event schedule and assigned equipment and to submit damage reports. Student Portal Users do not create Accounts; they sign in by entering their email address and clicking a single-use, time-limited link sent to that email.

For Student Portal Users, we process the following information:

• Student email address (on file with the Customer; used to authenticate access via magic link)
• Student date of birth, entered by the student at signup and used solely for guardian-student link verification as described in Section 2.1
• Magic link tokens (stored only in hashed form, expire after 15 minutes, single-use)
• Session tokens (stored only in hashed form, expire after 30 days of inactivity)
• IP address and user-agent string captured at the time of magic link request and session creation, used solely for security monitoring, rate limiting, and abuse detection
• Content the student submits through the portal, such as damage reports and photographs, which is treated as part of the Customer's Student Education Records

As with the Guardian Portal, portal security data is used exclusively for security purposes and is not surfaced to the Customer institution or to any Account Holder. The Customer controls whether the Student Portal is enabled for its program and can revoke a student's active sessions at any time. See Section 13 for how we handle information collected from children.

2.6 Information from Public-Facing Forms

The Service includes certain public forms that a Customer may make available without requiring an account or magic-link authentication — for example, damage report forms for students or parents, and volunteer signup pages. Information submitted through these forms flows directly into the Customer's instance of the Service and is treated as Customer Data of that institution. Downbeat does not use this information for any purpose other than delivering it to the Customer.

3. FERPA Compliance

Downbeat provides services to educational institutions, including K–12 schools, colleges, and universities. In the course of providing these services, Downbeat processes Student Education Records on behalf of the Customer and operates as a "school official" with a "legitimate educational interest" in those records, as those terms are used in FERPA, 20 U.S.C. § 1232g and 34 C.F.R. Part 99.

3.1 School Official Designation

By entering into a subscription or Data Privacy Agreement with Downbeat, the Customer designates Downbeat as a school official performing an institutional service or function for which the Customer would otherwise use employees. In this capacity, Downbeat agrees to the following:

• Direct control. Downbeat operates under the direct control of the Customer with respect to the use and maintenance of Student Education Records. The Customer determines what data is entered into the Service, who may access it, and when it is deleted.
• Authorized use only. Downbeat uses Student Education Records solely for the purpose for which they were disclosed — to provide and maintain the Service for the Customer.
• No re-disclosure. Downbeat does not re-disclose Student Education Records to any third party except (a) Sub-Processors acting under written contract on Downbeat's behalf, (b) as directed in writing by the Customer, (c) to Guardian Portal Users designated by the Customer as authorized to view a specific student's records, consistent with FERPA's school-official exception, (d) to a Student Portal User with respect to that student's own records, where the Customer has enabled the Student Portal, or (e) as required by law.
• No advertising or profiling. Downbeat does not use Student Education Records to serve advertising, to build profiles about students, or to train artificial intelligence or machine learning models.
• No sale. Downbeat does not sell, rent, lease, or trade Student Education Records.
• No combination with other data. Downbeat does not combine Student Education Records with personal information collected through non-educational services.

3.2 Guardian and Student Access Under FERPA

FERPA permits an educational institution to share education records with a student's parent or with the eligible student. The Guardian Portal and Student Portal are mechanisms by which the Customer institution exercises that disclosure on its own behalf, with Downbeat acting as the school official providing the disclosure infrastructure. The Customer institution determines which guardians are authorized to access which students' records, determines whether the Student Portal is enabled, and remains responsible under FERPA for the appropriateness of those designations.

3.3 Data Privacy Agreement

Prior to processing Student Education Records for a Customer, Downbeat requires the Customer to execute a Data Privacy Agreement (DPA) that governs the handling of student data in greater detail, including specific commitments regarding access, security, audit, breach notification, and deletion. Customers may request a copy of Downbeat's standard DPA by contacting mason@downbeatapp.com.

3.4 Data Deletion on Cancellation

Upon termination of a Customer's subscription, Downbeat retains Customer Data (including Student Education Records, uploaded files, and Guardian and Student Portal User information) for 30 days to allow the Customer to export its data. Promptly after this export window closes — and in any event within 60 days of termination — all such data, including files in cloud storage, is permanently deleted from active systems. Residual copies may remain in encrypted backups for a limited period consistent with Downbeat's backup schedule (typically 7 days) and are not restored except as required for security, disaster recovery, or legal compliance. A Customer may request earlier deletion by contacting mason@downbeatapp.com.

If a Customer begins a free trial and does not start a subscription, the same deletion procedure is applied beginning 90 days after the trial ends. Downbeat sends notice to the Account Holder of record approximately 14 days and again approximately 3 days before this deletion occurs. A Customer may request earlier deletion, or a brief extension, at any time.

3.5 Changes to This Policy or the DPA

Downbeat will notify Customers in writing (by email to the Account Holder of record) in advance of any material change to this Privacy Policy or to the standard DPA that affects the handling of Student Education Records. Customers will have a reasonable opportunity to review the change before it takes effect.

3.6 Reporting FERPA Concerns

If you believe that Student Education Records have been handled in violation of FERPA, please contact mason@downbeatapp.com. We also encourage you to contact the relevant educational institution, which is the party responsible for FERPA compliance under the statute.

4. How We Use Information

The purposes for which we use information depend on the category of data collected.

4.1 Student Education Records

Student Education Records are used only to provide and maintain the Service to the Customer that provided them. This includes displaying records to authorized Account Holders, to authorized Guardian Portal Users, and to the relevant Student Portal User; generating assignment and inventory reports; producing damage reports; processing fee status; and delivering service-related emails to Account Holders, authorized guardians, and students about records maintained in the Service.

Student Education Records are not used to send marketing communications, to profile students, to train machine learning models, to serve advertising, or for any other purpose.

4.2 Account Holder Information

We use Account Holder information to:

• Create, maintain, and secure Account Holder accounts
• Provide and improve the Service
• Process subscription payments
• Respond to support requests
• Send transactional emails (e.g., password resets, receipts, security notifications, service announcements)
• Send product update announcements, newsletters, and promotional emails about Downbeat, where the Account Holder has not opted out
• Comply with legal obligations and enforce our agreements

Every marketing email from Downbeat includes a one-click unsubscribe link. Transactional and security emails are sent regardless of marketing preferences because they are required to operate the Service.

4.3 Visitor and Prospect Information

We use visitor and prospect information to:

• Operate and improve the Downbeat website
• Respond to inquiries submitted via contact forms
• Send marketing communications to individuals who have expressed interest in Downbeat, where permitted by applicable law
• Analyze website usage in aggregate

4.4 Guardian and Student Portal User Information

We use Guardian Portal User and Student Portal User information solely to:

• Authenticate access to the relevant portal via magic link
• Display the records the Customer has authorized the user to view
• Send transactional emails relating to portal access (e.g., the magic link itself, and, where the Customer enables them, fee reminder emails or damage event notifications)
• Monitor for security events, enforce rate limits, and detect abuse

We do not send marketing emails to Guardian Portal Users or Student Portal Users. Guardian and student email addresses are not added to any Downbeat marketing list under any circumstances.

5. Sub-Processors

Downbeat uses a limited set of third-party sub-processors to deliver the Service. Each sub-processor is bound by a written agreement that restricts the use of Customer Data to the provision of services to Downbeat. All sub-processors listed below operate from data centers located in the United States.

Sub-Processor	Function	Data Categories
Supabase, Inc.	Primary database, file storage, and authentication	All Customer Data, Account Holder credentials, Guardian and Student Portal session and token data
Vercel, Inc.	Application hosting, content delivery, and request routing	All data in transit; request logs (IP, user agent, path)
Stripe, Inc.	Subscription billing and payment processing	Billing contact information, payment method tokens (we do not store card numbers)
Resend Inc.	Transactional and marketing email delivery	Recipient email addresses and message content, including guardian and student magic link emails
Functional Software, Inc. (Sentry)	Application error monitoring	Technical error reports and internal record identifiers only. Sentry is configured to exclude names, email addresses, and other personal information from error reports.

Outbound email from hello@downbeatapp.com is relayed via Google (Gmail SMTP) through our Resend configuration; as a result, Google may process the metadata and content of such outbound email in the course of delivery.

Downbeat will update this list prior to adding a new sub-processor that processes Customer Data and, where required by a Customer's DPA, will provide advance notice of any such change.

6. Cookies and Similar Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies that authenticate users (including Guardian and Student Portal Users), maintain session state, and enable the Service to function. These cookies cannot be disabled without breaking the Service.
• Preference cookies that remember settings and choices across visits.
• Analytics cookies that help us understand how the Service is used in aggregate, where used.

We do not use cookies for cross-site tracking or targeted advertising.

You may control cookies through your browser settings. Disabling essential cookies will prevent you from using the Service.

7. Data Retention

We retain information only for as long as necessary to provide the Service, comply with legal obligations, or resolve disputes. Specific retention periods are as follows:

• Customer Data (including Student Education Records and uploaded files): retained for the duration of the Customer's subscription, plus 30 days after cancellation to allow for export, after which Customer Data — including files in cloud storage — is permanently deleted from active systems, and in any event within 60 days of cancellation. For trials that do not convert to a subscription, Customer Data is deleted 90 days after the trial ends, with advance notice as described in Section 3.4. Encrypted backups may persist for up to 7 additional days.
• Account Holder information: retained for the duration of the account relationship and for up to 12 months thereafter to resolve disputes and meet recordkeeping obligations.
• Magic link tokens (guardian and student): expire 15 minutes from issuance. Consumed and expired tokens are retained for up to 30 days for security audit purposes and then deleted.
• Portal session tokens (guardian and student): retained for up to 30 days from last use; expired and revoked sessions are retained for 7 days for audit and then deleted.
• Rate-limit and security telemetry (IP addresses, user-agent strings): retained for up to 24 hours.
• Support correspondence: retained for up to 24 months from the date of ticket closure.
• Usage and request logs: retained for up to 12 months for security monitoring and troubleshooting.
• Financial, transaction, and contractual records (including executed Data Privacy Agreements): retained for up to 7 years to comply with tax, accounting, and legal obligations.
• Marketing list membership: retained until you unsubscribe or until 24 months after your last engagement, whichever is earlier.

Where permitted, we may retain anonymized or aggregated statistical data indefinitely for analytics purposes. Such data cannot be linked back to an identifiable individual.

8. Data Security

We use commercially reasonable administrative, technical, and physical safeguards to protect information, including:

• Encryption of data in transit using TLS
• Encryption of data at rest within our Sub-Processors' infrastructure
• Role-based access controls, with access limited to personnel who require it to perform their job
• Multi-tenant isolation of Customer Data, enforced at the database policy layer
• Secure password hashing (credentials are never stored in plaintext)
• Magic-link authentication for Guardian and Student Portal Users, with single-use tokens, 15-minute expiry, hashed storage, and per-IP and per-user rate limiting
• 30-day session lifetime with sliding-window expiry and immediate Customer-initiated revocation for portal sessions
• Uploaded files, including damage photographs and completed forms, stored in private storage accessible only through short-lived, signed URLs generated for authenticated or Customer-authorized views
• Daily encrypted database backups, retained for approximately 7 days, to support recovery from data loss
• Regular application and dependency updates

No method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security. If you have reason to believe your account has been compromised, contact mason@downbeatapp.com immediately.

9. Data Breach Notification

In the event of a confirmed unauthorized access to or disclosure of Customer Data, Downbeat will notify the affected Customer without undue delay, and in any event within 72 hours of becoming aware of the incident, at the email address associated with the Customer's Account Holder of record. Notification will include, to the extent known: the nature of the incident, the categories and approximate number of records affected, the likely consequences, and the steps Downbeat has taken or plans to take in response.

Downbeat will cooperate with the Customer's reasonable requests for additional information and will not issue notifications directly to students, parents, eligible students, or portal users except at the direction of the Customer or as required by law.

10. Data Transfers

Downbeat operates in the United States, and all Customer Data is stored and processed in the United States by our Sub-Processors. If you access the Service from outside the United States, you consent to the transfer and processing of your information in the United States.

11. Your Rights

11.1 Rights Regarding Student Education Records

Under FERPA, rights of inspection, amendment, and consent regarding Student Education Records belong to the parent (or, once the student is 18 or enrolled in a postsecondary institution, to the eligible student), and are exercised through the educational institution — not through Downbeat. Requests to inspect, correct, or delete Student Education Records should be directed to the Customer. Downbeat will assist the Customer in fulfilling such requests as provided in the applicable DPA.

11.2 Rights Regarding Account Holder, Visitor, and Portal User Information

You may request to access, correct, or delete Personal Data that we hold about you as an Account Holder, visitor, Guardian Portal User, or Student Portal User by contacting mason@downbeatapp.com. We may decline a request where retention is necessary to comply with a legal obligation or to resolve a dispute.

Portal users may request that their active sessions be revoked at any time. Customers may also revoke any portal user's active sessions through the Customer's administrative interface. Note that the underlying contact information used to grant portal access is provided by, and controlled by, the Customer institution; requests to remove or correct that contact information should be directed to the Customer in the first instance, and Downbeat will assist as required.

You may unsubscribe from marketing emails at any time via the unsubscribe link in any such email or by contacting us. Guardian Portal Users and Student Portal Users do not receive marketing emails from Downbeat under any circumstances.

12. California Residents (CCPA / CPRA)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), grants California residents certain rights with respect to their personal information.

12.1 Sale and Sharing of Personal Information

Downbeat does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising. This applies to all categories of Personal Information, including Student Education Records, Account Holder information, portal user information, and visitor information.

Downbeat has not sold or shared Personal Information in the preceding 12 months.

12.2 Categories of Personal Information Collected

CCPA Category	Collected?	Purpose
A. Identifiers (name, email, IP address, date of birth where Student Portal is enabled)	Yes	Account management, Service operation, portal authentication and guardian-link verification
B. California Customer Records information	Yes	Billing, Service operation
C. Protected classification characteristics	No	—
D. Commercial information (purchase history)	Yes	Billing
E. Biometric information	No	—
F. Internet/network activity	Yes	Service operation, security
G. Geolocation data (precise)	No	—
H. Sensory data	No	—
I. Professional/employment information	No	—
J. Non-public education information (FERPA)	Yes	Service operation on behalf of Customer
K. Inferences/profiles	No	—
L. Sensitive personal information	No	—

12.3 Rights of California Residents

Subject to certain exceptions, you have the right to:

• Know what Personal Information we collect and how we use it
• Access the specific Personal Information we hold about you
• Request deletion of your Personal Information
• Request correction of inaccurate Personal Information
• Opt out of the sale or sharing of Personal Information (inapplicable because Downbeat does not sell or share Personal Information)
• Limit the use of sensitive Personal Information (inapplicable because Downbeat does not collect sensitive Personal Information)
• Not be discriminated against for exercising these rights

To exercise these rights, contact mason@downbeatapp.com. We will verify your identity using information reasonably necessary to confirm that you are the person about whom we have collected Personal Information.

Note: Rights regarding Student Education Records are exercised through the educational institution under FERPA, not through the CCPA/CPRA. Downbeat is not the "business" for purposes of Student Education Records; the Customer institution is the controller.

13. Children's Privacy

Downbeat is not directed to children, and Account Holder accounts are available only to individuals 18 years of age or older. Guardian Portal access is also limited to adults; the Customer institution is responsible for verifying that any individual to whom guardian access is granted is an adult parent, legal guardian, or other authorized contact.

The Student Portal, where enabled by a Customer institution, is used by students enrolled in the Customer's program, some of whom may be under 13. When a student uses the Student Portal, Downbeat collects limited information directly from the student's device: the student's email address and date of birth at signup, authentication tokens, and security telemetry, as described in Section 2.5, along with any content the student submits (such as damage reports). Downbeat collects this information solely to provide the Service to the Customer institution and for no commercial purpose. Consistent with Federal Trade Commission guidance on the Children's Online Privacy Protection Act (COPPA) in the school context, Downbeat relies on the Customer institution's authorization — acting in the capacity of the parent, for use of the Service limited to the educational context — as the basis for this collection. The Customer institution is responsible for providing any notice to parents required in connection with its use of the Service and for determining whether to enable the Student Portal for its program.

Information about students entered into the Service by an Account Holder (for example, a band director entering a roster) is treated as Student Education Records under FERPA, and the Customer institution — not Downbeat — is responsible for ensuring that any required notices or consents have been provided to parents.

If you are a parent or guardian and you believe that your child's information has been entered into the Service in error, please contact the educational institution directly. You may also contact mason@downbeatapp.com and we will work with the institution to address your concern.

14. Third-Party Links

The Service may contain links to third-party websites, including external payment platforms (such as Venmo, PayPal, or Cash App) when a Customer has configured fee payment links to those platforms. Downbeat is not responsible for the content or privacy practices of third-party websites, and we encourage you to review the privacy policies of any site you visit. When you follow a payment link from the Guardian Portal, you leave the Service and the destination platform's terms and privacy policies apply.

15. Changes to This Policy

We may update this Privacy Policy from time to time. For changes that materially affect the handling of Customer Data or Student Education Records, we will notify Customers by email in advance of the effective date. For other changes, we will update the "Last updated" date at the top of this Policy and post the revised version at https://www.downbeatapp.com/privacy.

16. Contact Us

If you have questions about this Privacy Policy or our handling of your information, you can reach us at:

Downbeat LLC Email: mason@downbeatapp.com