Privacy Policy
V 2.1.0 Last revised August 25, 2026
At Metrognome, we are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our studio booking platform and services.
We share hashed personal information with Meta and Google to measure and deliver advertising. You may opt out of this sharing at any time on our Your Privacy Choices page. We also automatically honor Global Privacy Control (GPC) signals.
Information We Collect
Personal Information
When you create an account or use our services, we may collect:
- Name, email address, and phone number
- Billing address and payment information
- Profile information including band/artist name and other contact details
- Account credentials and authentication information
- Communications with our support team
Usage Information
We automatically collect information about how you use our platform:
- Booking history and studio usage patterns
- Website navigation and interaction data
- Device information, IP address, and browser type
- Location data when accessing our facilities
Payment Information
Payment processing is handled securely through Stripe. We store limited payment information such as the last four digits of your card and billing address. Full payment details are processed and stored by our payment processor in compliance with PCI DSS standards.
How We Use Your Information
Service Operations
- Processing bookings and managing your account
- Facilitating access to artist studios and facilities
- Processing payments and managing billing
- Providing customer support and resolving issues
- Maintaining facility security and safety
Communication
- Sending booking confirmations and reminders
- Providing important account and service updates
- Responding to your inquiries and support requests
- Sending operational notifications and policy changes
SMS and Text Messaging
When you give us your phone number, you consent to text messages about your studio, bookings, account, and access, including confirmations, reminders, access alerts, and conversation with your community manager. You may also opt in to receive promotional SMS messages about special offers and updates.
- Message frequency varies based on your activity and preferences
- Message and data rates may apply
- Reply STOP to any message to stop it, or HELP for help
- Manage what you receive by purpose anytime in your account preferences
- Your mobile phone number and SMS consent information will never be sold, rented, or shared with third parties or lead generators for marketing purposes
Analytics and Improvement
- Analyzing usage patterns to improve our services
- Developing new features and services
- Measuring advertising effectiveness (subject to your opt-out choices)
Legal and Security
- Complying with legal obligations and regulations
- Protecting against fraud and unauthorized access
- Enforcing our terms of service and facility policies
- Resolving disputes and investigating violations
Sharing for Advertising
We share certain personal information with advertising platforms to measure conversions and deliver relevant ads. Under the California Consumer Privacy Act (CCPA/CPRA) and Oregon Consumer Privacy Act (OCPA), this constitutes “sharing” for cross-context behavioral advertising.
What We Share and With Whom
| Recipient | Information Shared | Purpose |
|---|---|---|
| Meta (Facebook/Instagram) — Pixel | Browser cookies, pageview and conversion events | Ad measurement and targeting |
| Meta — Conversions API (server-side) | Hashed email, hashed phone, IP address, user agent, event metadata | Ad measurement and targeting |
| Google Ads | Client identifiers, conversion value | Ad measurement and targeting |
How to opt out: Visit our Your Privacy Choices page to opt out of advertising data sharing. You may also opt out by enabling Global Privacy Control (GPC) in your browser — we honor it automatically. Opting out suppresses all three data flows above.
Opting out of advertising sharing does not affect service operations, transactional communications, or operational analytics (PostHog, Sentry).
Service Providers
The following vendors process personal information on our behalf as service providers under applicable privacy law. They are contractually prohibited from using your data for their own marketing.
| Vendor | Category | Information Processed |
|---|---|---|
| Stripe | Payments (PCI DSS compliant) | Name, email, payment method, billing address |
| Supabase | Authentication and database | All account and app data |
| Vercel | Hosting and CDN | Request logs, IP address |
| Sentry | Error monitoring | Error traces, user ID, IP address |
| PostHog | Product analytics and session replay | Pageviews, event names, user ID, session recordings (input fields masked) |
| Resend | Transactional and marketing email | Email address, name |
| Twilio | Transactional and marketing SMS | Phone number |
Other Disclosures
Anonymized Aggregated Data
We may disclose aggregated, de-identified information (e.g., the number of musicians using our facilities) that cannot reasonably be linked to any individual.
Legal Requirements
We may disclose your information when required by law, such as in response to subpoenas, court orders, or other legal processes, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business transaction. We will notify you of any such change in ownership or control of your personal information.
Data Security
We implement industry-standard security measures to protect your personal information:
- Encryption of data in transit and at rest using SSL/TLS protocols
- Secure authentication and access controls
- Regular security audits and vulnerability assessments
- Employee training on data protection and privacy practices
- Secure data centers with physical and digital safeguards
- Regular backup and disaster recovery procedures
While we take reasonable measures to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but continuously work to improve our security practices.
Your California, Oregon, Texas, Colorado, Connecticut, and Virginia Privacy Rights
Residents of California, Oregon, Texas, Colorado, Connecticut, and Virginia have the following rights under applicable state privacy laws (CCPA/CPRA, OCPA, TDPSA, CPA, CTDPA, and VCDPA). We apply these rights uniformly to all US residents.
Right to Know / Access
You may request a copy of the personal information we hold about you, including the categories of information, the purposes for which it is used, and the categories of third parties with whom we have shared it.
Right to Delete
You may request deletion of your personal information. Some information may be retained where required by law or for legitimate business purposes such as fraud prevention or financial record-keeping.
Right to Correct
You may request correction of inaccurate personal information we hold about you.
Right to Opt Out of Sharing for Advertising
You may opt out of the sharing of your personal information for cross-context behavioral advertising at any time. Visit our Your Privacy Choices page or enable Global Privacy Control (GPC) in your browser. GPC signals are honored automatically on first request.
Right to Data Portability
You may request a copy of your personal information in a portable, machine-readable format.
Right to Non-Discrimination
We will not discriminate against you for exercising any of these rights. You will continue to receive the same quality of service regardless of your privacy choices.
How to Exercise Your Rights (DSAR)
To submit a data subject access request, email [email protected] with your name and the email address associated with your account. We will acknowledge your request within 10 business days and fulfill it within 45 days. If we require an extension, we will notify you before the initial 45-day period expires.
We may need to verify your identity before processing your request. For deletion or correction requests, we may require confirmation through your account.
Data Retention
We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this privacy policy:
- Account information: Retained while your account is active
- Booking history: Retained for 7 years for operational and tax purposes
- Payment information: Retained according to financial regulations
- Support communications: Retained for 3 years
- Advertising consent records: Retained for 2 years per CCPA §7026
- Marketing data: Retained until you opt out or for 2 years of inactivity
When you close your account, we will delete or anonymize your personal information within 90 days, except for information we are required to retain by law or for legitimate business purposes.
Cookies and Tracking Technologies
Essential Cookies
Required for the platform to function properly, including authentication, security, and basic functionality. These cookies cannot be disabled.
Advertising Cookies
We use the Meta Pixel and Google Ads tags, which set cookies to measure conversions and support ad targeting. These cookies are suppressed when you opt out of advertising sharing via the Your Privacy Choices page or GPC. We also implement Google Consent Mode v2 — ad signals are set to denied by default when you have opted out.
Analytics Cookies
We use PostHog, a product analytics and session-replay tool, to understand how you use our platform. PostHog records anonymous pageviews and events for all visitors and associates them with your account ID once you sign in. Session recordings mask all form-input values. PostHog is contracted as a service provider under a Data Processing Agreement and is not affected by your advertising opt-out choice. Session recording is disabled on checkout pages.
Preference Cookies
We store your advertising opt-out preference in a first-party cookie (mg_privacy_choices) for up to one year so your choice persists across sessions.
You can manage browser cookies through your browser settings. Disabling essential cookies may affect platform functionality.
Children's Privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. This is stricter than the federal COPPA threshold of 13 and reflects our studio access policy. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected].
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:
- Posting the updated policy on our website with a new revision date
- Sending an email notification to registered users
- Displaying a notice on our platform
Your continued use of our services after any changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.
Contact Us
For privacy questions, data subject requests, or to exercise your rights, contact us at:
Email: [email protected]
To opt out of advertising data sharing, visit Your Privacy Choices.