Privacy Policy

1. Who is responsible for your data

The controller for this website under the EU General Data Protection Regulation (GDPR) is:
Kyle Kinard, sole proprietor
San Francisco Bay Area, California, USA
Email: kylejkinard@gmail.com

I’m an individual, so there is no data protection officer; write to me directly with any question or request.

2. What data I process, why, and on what legal basis

Visiting the site

When you load a page, the server that hosts this site automatically receives technical data your browser sends with every request: IP address, date and time, the page requested, browser and operating system. The hosting provider uses it to deliver the site and keep it secure, and keeps it only briefly in server logs. I don’t use it to identify you. Legal basis: legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

Fonts, images, videos and scripts are all served from this site itself. In particular, fonts are hosted locally, so loading a page sends nothing to Google Fonts.

Contact and lesson booking form

If you send the form, I receive your name and email address (required), your message, and, for lesson requests, the plan, what you want to learn, your experience level, lesson format, availability and, optionally, the name of a friend who referred you. I use this only to answer you and to arrange and teach lessons. Legal basis: steps you ask for before a contract and performing that contract (Art. 6(1)(b) GDPR), and for general messages my legitimate interest in replying (Art. 6(1)(f)).

The form is delivered to my email inbox through Web3Forms, a form-to-email service, and my inbox is provided by Google (Gmail). Both act as service providers and may process the data in the United States. Your details are never added to a mailing list, sold or shared with anyone else.

If you include a friend’s name for the referral discount, please only do so if they’re happy for you to share it; I use it only to apply the discount.

Emailing me directly

If you email me, I process your email address and whatever you write, for the same purposes and on the same legal basis as the form.

The CV password

The CV on the home page is encrypted. The password you type is checked entirely in your own browser and is never sent to me or anyone else.

YouTube and Spotify (only with your consent)

The home page can show my music video from YouTube (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, in the “privacy-enhanced” youtube-nocookie.com mode), and the Music page can show a Spotify player (Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden). These load content from their servers, which sends them your IP address and may set cookies or similar storage on your device. They load only if you choose “Allow external media” in the cookie banner, or press the play / “Load Spotify player” button for that one item. Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on device storage). You can withdraw it at any time under “Cookie settings” at the bottom of every page. What they do with the data is covered by Google’s Privacy Policy and Spotify’s Privacy Policy.

Links to other sites

Links to Instagram, LinkedIn, IMDb and Spotify are plain links: nothing is sent to those services unless you click one, at which point their own privacy policies apply.

3. Cookies and browser storage

This site sets no cookies of its own. It stores three small, strictly necessary values in your browser (your cookie choice, whether you minimized the sidebar, and whether you’ve already seen the opening animation). Details are in the Cookie Policy.

4. What this site does not do

• No analytics, visitor tracking, advertising or social media pixels.
• No selling or renting of personal data, and no sharing for marketing.
• No profiling and no automated decision-making with legal or similar effects (Art. 22 GDPR).

5. Artificial intelligence (EU AI Act)

This site doesn’t use any AI system that interacts with you, such as a chatbot, and doesn’t use AI to make decisions about you. The photos and videos are real recordings by me, not AI-generated or AI-manipulated images. In some teaching photos the faces of students and bystanders are blurred to protect their privacy. If AI-generated content is ever added, it will be clearly labelled as such, as Article 50 of the EU AI Act requires.

6. How long I keep data

• Messages that don’t lead to lessons: deleted within 12 months of our last contact.
• Students’ contact and booking details: kept while you take lessons, then deleted within 12 months of the last lesson, except records I must keep longer for tax and accounting law.
• Your cookie choice and other browser storage: stays on your device until you clear it.

7. International transfers

I’m based in the United States, and some of the service providers above (Web3Forms, Google) may process data there. Where data leaves the EU/EEA, it relies on the safeguards those providers offer under the GDPR, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

8. Your rights

Under the GDPR you have the right to:

• access the personal data I hold about you and get a copy (Art. 15);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict how it’s used (Art. 18) and receive it in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting earlier processing (Art. 7(3));
• complain to a data protection supervisory authority, in particular in the EU country where you live or work (Art. 77).

To use any of these rights, email kylejkinard@gmail.com. I’ll answer within one month.

California residents can also ask what personal information I hold and ask for it to be deleted, at the same address. I don’t sell or share personal information as defined by California law.

9. Children

This site isn’t aimed at children. For lessons with a student under 16, a parent or guardian should get in touch and give the details. If you think a child has sent me personal data, email me and I’ll delete it.

10. Security

The site is served over an encrypted (HTTPS) connection, and the form is sent to Web3Forms over HTTPS. No method of sending data over the internet is perfectly secure, but I keep what I collect to a minimum.

11. Changes

If this policy changes, the new version will appear on this page with a new “last updated” date.