Last updated: September 4, 2026
Octavella is an instrument rental, inventory, and repair platform operated by Octavella LLC. This policy explains what information we collect, why we collect it, who we share it with, and what choices you have. It covers the Octavella website and application.
Two groups of people use Octavella. The first is families renting or buying an instrument, usually a parent or guardian acting for a student. The second is staff at schools, music retailers, and repair shops who manage instrument inventory, rentals, and service work.
Where a school or district is our customer, we act as a service provider to that institution and handle student information under its direction. Section 7 covers that relationship specifically.
Account information — your first and last name, email address, and phone number. You provide these when you register, or they come from Google if you choose to sign in with Google.
Sign-in credentials — we never store your password. Authentication is handled by Keycloak, an identity server we run ourselves, which stores only a cryptographic hash. If you sign in with Google, we receive your email address, name, and whether Google has verified the address, but never your Google password.
Rental information — the student's name and grade level, the school, the assigned teacher, the delivery location, the instrument, and the rental start and end dates.
Instrument and service records — the instruments assigned to you, their repair and service history, notes recorded by staff, and photographs staff upload to document an instrument's condition.
Billing records — subscription and invoice records, amounts, payment status, and billing dates. We do not receive or store card numbers. See section 6.
Technical information — server logs containing IP address, timestamp, and the pages or endpoints requested, kept for security monitoring and troubleshooting.
We use cookies for exactly one purpose: keeping you signed in. Our authentication layer sets a session cookie and a short-lived cookie used to complete the sign-in exchange securely. Both are strictly necessary for the service to work.
We run no analytics, advertising, or tracking cookies of any kind. There is no Google Analytics, no advertising pixel, and no third-party tracker anywhere in the application. Nothing we set follows you to other websites.
To provide the service: creating and managing rentals, assigning instruments, and tracking repairs and service requests.
To communicate with you: account invitations, email verification, password resets, and notices about your rental or a service request.
To bill you and keep accurate financial records.
To secure the service, investigate abuse, and troubleshoot faults.
To meet legal, tax, and accounting obligations.
We do not use personal information to build advertising or marketing profiles, and we do not make automated decisions that produce legal or similarly significant effects.
We do not sell personal information.
We do not share personal information for advertising, and we do not share it with data brokers.
We do not use student information for anything other than providing the service to the school and the family.
We share information with the service providers below, each only to the extent needed to do its job, and each bound by its own contractual obligations to protect it.
Stripe — payment processing. Card details are entered into payment fields hosted by Stripe and go directly to Stripe. They never pass through or rest on our servers. Stripe receives your name, email, and billing details.
DigitalOcean — hosting, database, and file storage, in United States regions. The database is encrypted at rest and reachable only over a private network.
Resend — delivery of transactional email. Receives the recipient address and the message contents.
Google — only if you choose to sign in with Google, and only to authenticate you.
GitLab — source code hosting and deployment automation. It does not receive customer personal information.
We also share information with the school, retailer, or repair shop you are transacting with, which is inherent to the service: your school's staff can see the rentals and instruments belonging to that school, and a repair shop can see the instrument sent to it for work. Access within the application is limited by role and permission.
We may disclose information where legally required, such as in response to a valid subpoena or court order, or where necessary to protect our rights or someone's safety.
Our identity server runs on our own infrastructure and is not a third party.
Students do not have Octavella accounts. Student information in the system consists of a name, a grade level, a school, an assigned teacher, and the instrument assigned, and it is always entered by an adult, either a parent or guardian arranging a rental or a member of the school's staff. We do not collect information directly from children.
When a school or district is our customer and we receive student data from it, we are a third-party contractor under New York Education Law Section 2-d. In that role we commit that:
Student data is used only to provide the contracted service, and for no other purpose.
Student data is never sold, and is never used for marketing or advertising.
We do not use student data to build a profile of a student except as needed to deliver the service.
Any subcontractor that touches student data is bound to the same obligations, and the list of them is in section 6.
We will sign the district's Parents' Bill of Rights for Data Privacy and Security and maintain a Data Security and Privacy Plan on request.
A parent or eligible student may challenge the accuracy of student information. Contact us at the address in section 12, or the school directly, and we will correct verified inaccuracies.
Where we handle education records as a school official under FERPA, we do so under the school's direction and control.
All traffic between your browser and Octavella is encrypted with TLS.
The database is encrypted at rest, runs on a private network, and is not reachable from the public internet.
Access within the application is scoped by role and permission, so staff see only the accounts and organizations they belong to.
We never store your password.
No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by law, including the New York SHIELD Act and, for student data, Education Law Section 2-d.
We keep personal information for as long as your account is active and as long as needed to provide the service. Billing and invoice records are kept longer where tax and accounting law requires it. When an agreement with a school ends, student data is returned or deleted according to that agreement.
You can view and correct most of your information from your account settings. For anything you cannot reach yourself, including a request to access, correct, or delete your information, contact us at the address in section 12 and we will respond.
Deletion requests are honoured except where we are required to retain records, such as completed financial transactions. If a school controls the record, we will refer your request to the school, which decides.
If we change this policy we will update the date at the top of this page. If a change materially affects how we handle your information, we will notify you by email or in the application before it takes effect.
Questions about this policy, or a request about your information, can be sent to support@octavella.com.