Dafola Privacy Policy

Last updated: October 16, 2026

This policy explains how Dafola collects, uses, shares and protects personal information. If anything is unclear, email us at privacy@dafola.com.

Summary

  • Dafola makes web software that private music schools and academies ("Schools") use to manage lessons, families and billing.
  • Inside a School's app, the School is in charge of the information. We handle it for the School. For our own website, demo and business contacts, we are responsible ourselves.
  • We do not sell or rent personal information, show ads, or use advertising or analytics cookies.
  • Our database and servers are in Canada, but some of our service providers are US companies.

1. Who we are

Dafola is operated by [Legal entity name] ("Dafola", "we", "us" or "our"), located at [registered address], Toronto, Ontario, Canada. Our Privacy Officer is responsible for our compliance with this policy and with privacy law. You can find their contact details in section 17.

2. What this policy covers and our two roles

This policy applies to our website at dafola.com, each School's web app at its own address ending in .dafola.com (the "School app"), our public demo at demo.dafola.com, and the emails and support we provide. We handle personal information in two different roles, which affects who you should contact first.

When we act for a School

Each School decides what information to collect in its School app and why. We process information in the School app on the School's behalf, as its service provider. We use it only to provide and support the service for that School, as our agreement with the School allows, or as the law requires.

The School is responsible for:

  • telling its students, families, instructors and staff how it uses their information
  • having the consent or other legal authority it needs, including a parent's or guardian's consent for a child
  • the accuracy of the information it enters, and what it chooses to record
  • deciding who at the School is approved and what access they have
  • its own privacy practices outside our software

If you have a question about how your School uses your information, or you want your School records changed or removed, please contact your School first. If you contact us instead, we will normally pass your request to your School and help it respond. You can always contact us directly using the details in section 17.

When we are responsible ourselves

We decide how information is handled, and we are responsible for it, when it relates to:

  • visitors to dafola.com and demo.dafola.com
  • School owners and other people who sign up for, buy or ask about Dafola for a School
  • people who contact us about our business, such as prospective customers, partners and suppliers
  • the security and operation of our own systems, such as server logs and security records

This policy does not cover how a School handles information outside our software, or the practices of other services, such as Google when you sign in with Google. They have their own privacy policies.

3. Personal information we collect

Information in a School app

A School, or the people it approves, may enter the following into its School app:

  • Account and profile details: name, email address, phone number and date of birth. Date of birth is collected for students and is optional for instructors and children. If photo uploads become available, a profile photo you choose to add.
  • Family details: each parent's or guardian's contact details, their relationship to each child, and the child's name, optional date of birth and instruments. Parents provide their children's details. Children do not sign up themselves.
  • Lessons: instruments, lesson schedules, attendance, away and sick days, lesson requests and the replies to them (accept, decline or reschedule), and messages between families and instructors.
  • Lesson notes: notes an instructor writes, which may be shared with the family or kept private to School staff.
  • Billing: invoices, charges, credits and payment records. Today, Schools record e-Transfer, cash and cheque payments by hand. We do not receive bank account or card numbers for these payments.
  • Sign-up requests: the details you give when you ask to join a School, including any note you type, and the School's decision to approve or decline you.
  • Sign-in details: your email address and password. Your password is stored only in scrambled (hashed) form by our authentication provider, and we cannot see it. If you choose "Continue with Google", Google sends us your name and email address, but not your Google password.
  • Activity record: a log of who did what in the School app, and when, such as who changed an invoice. It is used for security, disputes and fixing problems.

Please do not put health details or other sensitive information in notes, messages or the sign-up note. To record a sick day, the date is enough.

Information about School owners and business contacts

When you sign up for Dafola for a School, ask about our service or work with us, we collect your name, the School's name, your email address and phone number, your role, the messages you send us, and details of the School's subscription and payments to us [TO CONFIRM: how Dafola will bill Schools and through which provider].

Information collected automatically

  • Server logs: our hosting provider records technical information about each request, such as your IP address, the date and time, the page requested and your browser type. We use it to run, secure and fix the service.
  • Sign-up protection: when a sign-up form is submitted, our server keeps the connection's IP address in memory for up to one hour to limit repeated sign-up attempts. It is not saved to our database.
  • Demo design memory: on demo.dafola.com only, we remember the last design you chose. We store it under a keyed one-way hash of your IP address. We do not store the IP address itself.
  • Browser storage: see section 12.

Information we do not collect

  • We do not collect full card numbers or bank account numbers.
  • We do not use advertising or analytics cookies, tracking pixels or third-party marketing tools.
  • We do not track your location or build profiles of you.
  • We do not knowingly collect personal information directly from children (see section 11).

Features we plan to add

We plan to add online card and Canadian pre-authorized debit payments through Stripe, text message reminders, and more sign-in options (such as Apple and Facebook). With online payments, Stripe would collect your card or bank details directly, and we would receive only a reference such as "Visa •••• 4242" and the payment status. We will update this policy before any of these features goes live.

4. How we use personal information

For Schools

We use information in a School app, on the School's behalf, to:

  • run the features the School uses, such as schedules, attendance, lesson requests, messages, notes and billing
  • create and secure accounts, handle sign-up requests and send transactional emails
  • provide support when the School or a user asks for help
  • keep each School's information separate, protect the service from misuse, and make backups
  • meet our legal obligations

For our own purposes

We use the information we are responsible for to:

  • run and improve our website, the School app and the public demo
  • respond to questions and requests
  • set up and manage School accounts, subscriptions and billing
  • send School owners and prospective customers information about our service, as permitted by Canada's anti-spam law (see section 13)
  • keep our systems secure, investigate incidents and prevent abuse
  • comply with the law, enforce our agreements and protect our rights

We may also prepare statistics that do not identify any person or School, such as how many Schools use a feature, to run and plan our business [TO CONFIRM: only as our agreement with Schools allows].

What we do not do

We do not sell or rent personal information. We do not use School app information to advertise to anyone. We do not make decisions about you based only on automated processing.

Canadian privacy laws generally require meaningful consent to collect, use and share personal information, unless the law allows otherwise.

  • Inside a School app: your School collects your information for its own purposes and is responsible for getting your consent. When you sign up to join a School, or the School adds you, your information is stored in Dafola's systems so the School can serve you.
  • For our own purposes: we rely on your consent. It may be express, such as when you agree to receive emails from us, or implied when the use is obvious, such as using your email address to reply to you.
  • Without consent: in limited cases the law allows this, for example to comply with a court order, to investigate a breach of an agreement or the law, or in an emergency that threatens someone's life, health or security.

Children and parents

Children do not create their own accounts. A parent or guardian signs up and enters their child's information, or the School adds it. Students under 18 are signed up by a parent or guardian [TO CONFIRM: age at which a student can manage their own account].

When you add a child, you confirm that you are the child's parent or legal guardian, or are otherwise authorized to act for the child, and that you agree to the School and Dafola handling the child's information as described in the School's notice and this policy.

Canada's federal Privacy Commissioner expects consent for children under 13 to come from a parent or guardian. In Québec, consent for a child under 14 must come from a parent or tutor.

Withdrawing consent

You may withdraw your consent at any time, with reasonable notice, unless a legal or contractual restriction applies. For information in a School app, contact your School. For emails from us about our service, use the unsubscribe link or contact us. If you withdraw consent, your School may not be able to provide some services through the app, and we will tell you if that is the case.

6. How we share personal information

Inside your School

The School app shows information only to people who need it, based on their role:

  • School owners and staff can see their School's records, as the School allows.
  • Instructors can see only their own students.
  • Families can see only their own family.

Our service providers

We use the following service providers to run Dafola. They may only use personal information to provide their services to us, under contract.

  • Supabase, Inc. (United States company): database, sign-in and backups. Our database is hosted in the Amazon Web Services Canada (Central) region in Montréal, Québec.
  • Fly.io, Inc. (United States company): application servers in its Toronto, Canada region, and server logs.
  • Amazon Web Services, Inc. (United States company): delivery of transactional email through Amazon SES in the Canada (Central) region [TO CONFIRM: go-live date; until then, sign-in emails are sent through Supabase's email service].
  • Google LLC (United States company): Google Workspace email for our staff (including emails you send us), the optional "Continue with Google" sign-in, and Google Fonts (see section 12).

Planned: Stripe for online payments and Twilio or a similar provider for text message reminders. We will update this list before we use them.

Our service providers may use their own subcontractors. We remain responsible for personal information we transfer to our service providers.

Other sharing

We may also share personal information:

  • when the law requires or allows it, for example to comply with a warrant, subpoena or court order, to respond to a lawful request from a government authority, to investigate fraud or a security incident, or to protect someone's life, health or safety
  • with our professional advisers, such as lawyers, accountants and insurers, who must keep it confidential
  • in a business transaction, such as a merger, financing, or sale of all or part of our business. Personal information may be shared with the other parties only as needed to evaluate or complete the transaction, under an agreement that requires them to protect it and use it only for that purpose. If the transaction goes ahead, the information will continue to be protected as described in this policy.
  • with your consent, or at the direction of your School

7. Where information is stored and cross-border access

Our database is stored in Montréal, Québec, and our application servers run in Toronto, Ontario. However, Supabase, Fly.io, Amazon Web Services and Google are based in the United States, and their staff or subcontractors may access information from outside Canada for support, maintenance and security. Google Workspace email, Google sign-in and Google Fonts may be processed outside Canada, including in the United States. Internet traffic may also pass through other countries on its way to our servers.

Information stored in, or accessible from, another country is subject to that country's laws and may be accessed by its courts, law enforcement and national security authorities. We rely on contracts with our providers to protect the information.

For Québec residents: before personal information is communicated outside Québec, we assess whether it will be adequately protected, as Québec law requires [TO CONFIRM: assessment completed].

8. How long we keep information

We keep personal information only as long as needed for the purposes in this policy or as the law requires. When we no longer need it, we delete it or make it anonymous.

  • School app information: kept while the School subscribes, for as long as the School keeps it. Schools can correct records and can ask us to delete information. After a School cancels, we keep its information for [TO CONFIRM: 90] days so the School can export it, and then delete it, unless the law requires us to keep it longer or the School asks us to delete it sooner.
  • Backups: our database provider keeps daily backups for [TO CONFIRM: 7] days [TO CONFIRM: requires a paid Supabase plan; the free plan has no automatic backups]. Deleted information may remain in backups until they expire. We use backups only to recover from errors or incidents.
  • Activity record: kept with the School's information [TO CONFIRM: separate retention period, if any].
  • Server logs: kept by our hosting provider for a limited period [TO CONFIRM: period].
  • Public demo: demo data resets every night, and sign-ups made on the demo are deleted.
  • Demo design memory: removed through routine clean-up once it has not been updated for 90 days.
  • School owner accounts and billing records: kept while the account is active, and then as long as needed for tax, accounting and legal purposes [TO CONFIRM: 7 years].
  • Business emails and inquiries: [TO CONFIRM: 2 years after our last contact], unless we have an ongoing relationship.

If we use your information to make a decision about you, we keep it long enough for you to ask to see it.

9. How we protect information

We use administrative, technical and physical safeguards suited to the sensitivity of the information, including:

  • encrypted connections (HTTPS) everywhere
  • passwords stored only in hashed form by our authentication provider
  • database rules that control access to every row of data, with no direct database access from your browser
  • role-based access and permission checks on our server before any change is made
  • two-step sign-in for School owners, available on request
  • an activity record in each School app, and daily backups managed by our database provider [TO CONFIRM: paid Supabase plan in place]
  • limiting access within Dafola to people who need it

No method of storing or sending information is completely secure, and we cannot guarantee absolute security. You can help by using a strong, unique password, keeping it private and signing out on shared devices. School owners can ask us to turn on two-step sign-in.

10. Your privacy rights

Rights in Canada

Subject to limits set by law, you have the right to:

  • ask whether we hold personal information about you, and get access to it
  • ask us to correct information that is inaccurate or incomplete
  • withdraw your consent, as described in section 5
  • ask how we use and share your information, and which service providers we use
  • complain to us and to a privacy commissioner (see section 17)

We will respond within the time required by law, generally 30 days. If we need more time, we will tell you why. Access is normally free; if a fee is allowed and applies, we will tell you first. We may refuse a request where the law allows, for example if answering would reveal another person's information, and we will explain why.

Additional rights in Québec

If you live in Québec, you may also:

  • ask for the personal information you provided, in a structured, commonly used technological format, or have it sent to another organization
  • ask us to stop sharing your information, or to de-index a link to it, where the law allows
  • ask for the categories of people at Dafola who can access your information, how long we keep it, and the contact details of our Privacy Officer
  • be told when information is collected using technology that can identify, locate or profile you. We do not use such technology.

US residents

Dafola currently serves Schools in Canada. Some US states give their residents privacy rights, such as the right to know about, access, correct or delete personal information, and to opt out of its sale or use for targeted advertising. We do not sell personal information or use it for targeted advertising. If a US privacy law applies to how we handle your information, we will respond to your request as that law requires.

How to make a request

Email privacy@dafola.com or write to us at the address in section 17. We will need to confirm your identity before we act, and we may ask for more information to do so. A parent, guardian or other authorized person may make a request for someone else with proof of their authority.

If your request is about information in a School app, we will normally pass it to your School, because the School controls that information, and we will help the School respond.

11. Children's privacy

Dafola is a business tool for Schools and is not directed to children. We do not knowingly collect personal information directly from children under 13, or under 14 in Québec. Children's information comes from their parent or guardian, or from their School.

We treat children's information as sensitive. We use it only to provide the School's services, and never for advertising or marketing.

Parents and guardians can review, correct or ask to delete their child's information through their School or by contacting us. If we learn that a child has given us personal information directly without the required parental consent, we will delete it.

12. Cookies and similar technologies

We do not use advertising cookies, analytics cookies or tracking pixels. We use only the browser storage needed to make the service work:

  • Session storage keeps your sign-in session, temporary sign-in details when you use Google sign-in, and which child a parent is viewing. Your browser clears it when you close the tab, which also signs you out.
  • Local storage remembers your preferences on your device: day or night theme, chosen design, sound on or off, and calendar view. It stays until you clear it.
  • Demo design memory: on demo.dafola.com, we remember your last chosen design as described in section 3.
  • Google Fonts: our website and School apps load fonts from Google. When they do, your browser connects to Google's servers, which receive your IP address and basic browser information. Google's handling of this information is described in the Google Privacy Policy.

You can clear or block browser storage in your browser settings. If you block it, you may not be able to sign in.

If we ever add analytics or other tracking technologies, we will update this policy first and ask for your consent where the law requires.

13. Emails and other messages

People who use a School app receive only transactional messages, such as sign-in links, password resets, invitations, sign-up decisions and, when available, lesson reminders and invoices. These are part of the service. We do not send marketing emails to School app users.

We may send School owners and prospective customers emails about our service where we have consent or where Canada's Anti-Spam Legislation allows it. Each of these emails identifies Dafola, gives our contact details and includes an unsubscribe link. We act on unsubscribe requests within 10 business days. Even if you unsubscribe, we may still send messages about your account, security, billing or changes to this policy.

14. The public demo

demo.dafola.com is public and uses made-up sample data. Anyone can see what is entered into it. Please do not enter real personal information into the demo. Demo data resets every night, and sign-ups made on the demo are deleted.

15. Privacy breaches

If a breach of security safeguards involves personal information we are responsible for and creates a real risk of significant harm, we will notify the affected people and the privacy regulators as the law requires. In Québec, we will notify the Commission d'accès à l'information and the affected people of any confidentiality incident that presents a risk of serious injury. We keep a record of all breaches, as the law requires.

If a breach involves information we hold for a School, we will notify the School without undue delay and help it meet its own obligations to notify people and regulators.

16. Changes to this policy

We may update this policy, for example when we add features or service providers, or when the law changes. We will post the new version here and change the "Last updated" date. Before a significant change takes effect, we will give notice, for example by email to School owners or in the School app, and ask for consent where the law requires.

17. Contact us and complaints

Our Privacy Officer is responsible for how Dafola handles personal information.

  • Privacy Officer: Jahangir Salarian [TO CONFIRM: name and title]
  • Email: privacy@dafola.com
  • Mail: [Legal entity name], Attention: Privacy Officer, [registered address], Toronto, Ontario, Canada

Please contact us first so we can try to resolve your concern. You may also complain to a privacy regulator: