Privacy policy
On this page
CAUTtools is hosted software that institutions use to manage piano maintenance programs. This policy explains what personal data the service handles, why, and what the people it describes can ask for. It covers both the CAUTtools application used by our customers and this public website.
1. Who controls the data
For data held inside an institution's CAUTtools instance, the institution is the controller and CAUTtools is the processor (in United States contracting terms, the institution is the customer and CAUTtools is a service provider or school official acting under its direction). We process that data only on the institution's documented instructions and for no purpose of our own.
If you are a technician, faculty member, or student at an institution that uses CAUTtools and you want your data corrected or removed, contact that institution first. They control it, and we act on their instruction.
For this public website and for enquiries sent to us directly, CAUTtools is the controller.
2. What CAUTtools collects
The service is built around instruments, not people. Most of what it stores is about pianos: make, model, serial number, age, condition, location, service history, photographs, and valuation. The personal data it holds is limited to what a maintenance program needs in order to run.
Staff and technician accounts
Name, work email address, role, and a hashed password. Assignment records, work completed, comments written, and an audit log of actions taken in the system.
Service requests
When someone reports a problem with an instrument — usually by scanning the QR tag on it — the form collects their name, email address, phone number, a description of the fault, and optionally a preferred appointment time. Requesters do not need an account. This is the only route by which a member of the general campus population, including a student, enters the system.
Room and event schedules
Where an institution enables it, the service imports room and hall bookings from the institution's own calendars so that maintenance is not scheduled against a rehearsal. Imported entries may include an event title, location, and time, and those titles sometimes contain a person's name (for example a faculty studio booking).
Technical logs
Server and application logs recording requests, errors, and administrative actions, used for security and troubleshooting.
What CAUTtools does not collect. No grades, transcripts, enrolment status, disciplinary records, financial aid data, or any other education record. No payment card details. No government identifiers. No biometrics. No location tracking of individuals. No advertising or cross-site tracking identifiers.
3. Education records and FERPA
CAUTtools does not collect, store, or process student education records. The service holds no information about a student's academic standing, coursework, enrolment, or progress.
To be precise rather than merely reassuring: a student may submit a service request, and that request contains their name and contact details. Contact information supplied in order to report a broken piano is not an "education record" as defined at 34 CFR §99.3, because it is not maintained by the institution as a record directly related to a student's education. It is closer to a maintenance work order than to a student file.
Institutions that nonetheless prefer to treat CAUTtools as a school official with a legitimate educational interest under 34 CFR §99.31(a)(1) may do so, and we will sign an agreement to that effect. We accept the associated obligations: use the data only for the purposes authorised, do not redisclose it, and remain under the direct control of the institution.
4. This website
The public CAUTtools website sets no cookies and runs no analytics, advertising, or session tracking. The workload calculator runs entirely in your browser; the values you enter are never transmitted to us or stored anywhere.
The walkthrough request form does not submit to a server. It opens a pre-filled message in your own mail application, which you choose whether to send. Nothing you type is captured by this site.
Web fonts on this site are served by Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com, and your IP address is visible to Google in the course of that request. No cookie is set. Institutions subject to the GDPR who would prefer this not happen should tell us; we can serve the fonts from our own domain instead.
Our web host records standard server logs, including IP addresses, for security and operational purposes.
5. How data is used
We use personal data in the service only to:
- Operate the maintenance program the institution has asked us to support: routing service requests, assigning work, recording what was done, and reporting on it.
- Authenticate users and keep accounts secure.
- Contact a requester about the request they submitted.
- Diagnose faults, prevent abuse, and keep the service running.
- Meet legal obligations.
We do not sell personal data. We do not share it for advertising. We do not build profiles of individuals. We do not use customer data to train machine learning or artificial intelligence models, our own or anyone else's.
6. Who it is shared with
Each institution's data lives in its own database, on its own subdomain. It is not pooled with, combined with, or made visible to any other institution.
We share data outside CAUTtools only with:
- Hosting provider
- GoDaddy.com, LLC, which stores the application and its databases in the United States.
- Email delivery
- our hosting provider's mail service, used to send notifications and password resets.
- Legal compulsion
- Where required by law. Where we are permitted to, we will tell the affected institution first.
We do not add subprocessors that handle customer personal data without notifying customers first and giving them the opportunity to object.
7. Retention and deletion
Instrument and service records are kept for as long as the institution's subscription is active, because the value of the record is its history — a piano's service life is measured in decades.
- Imported calendar events are purged on a rolling window, by default 180 days.
- Technical logs are written to the institution's database, so they are retained as long as that database and are covered by the same daily backups.
- On termination, we provide a full export in standard formats, then delete the institution's data from the live service. Backup copies age out on a rolling three-week retention window, so all copies are gone within 30 days.
An institution may ask us to delete a specific record, or a specific person's data, at any time during the subscription, and we will do so.
8. Individual rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, and to object to it. Residents of the European Economic Area and the United Kingdom have these rights under the GDPR; residents of California have comparable rights under the CCPA as amended.
Because we are the processor for data inside an institution's instance, send your request to the institution. If you send it to us, we will forward it to them and support their response. For data we control — a walkthrough enquiry you emailed us, for example — write to us directly and we will action it within 30 days.
We do not discriminate against anyone for exercising these rights. Since we sell no personal data, there is no sale to opt out of.
9. International transfers
CAUTtools is operated from the United States and data is stored in the United States. If an institution outside the United States uses the service, personal data will be transferred to and processed in the United States. Where the GDPR applies, we rely on the European Commission's Standard Contractual Clauses, which form part of our data processing agreement.
10. Security
Our technical and organisational measures are described on the security page. In summary: transport encryption, hashed passwords, role-based access, per-tenant database isolation, regular backups, and an audit log of administrative actions.
If we become aware of a breach affecting an institution's data, we will notify that institution without undue delay and in any event within 72 hours of confirming it, with what we know, what we are doing, and what they may need to do.
11. Minors
CAUTtools is sold to institutions and intended for use by their staff and adult campus community. It is not directed at children under 13 and we do not knowingly collect their personal data. Institutions serving pre-college programs — a preparatory division or summer music school, for example — should tell us before enabling public service requests, so we can agree appropriate handling.
12. Changes
We will post any change here and update the version and date at the top. If a change materially affects how we handle personal data, we will notify institutional customers in advance by email.
13. Contact
Privacy questions, rights requests, and data processing agreements: hello@cauttools.com.
Willis Glen Miller III, sole proprietor, doing business as CAUTtools
87 Calle Azul, Corrales, New Mexico 87048, United States