Important: This policy is provided for transparency and is not legal advice. Your school or district may have additional agreements, policies, or requirements that also apply.
Who we are
EnsembleVault is a web-based service for K–12 theatre and music programs to manage performing arts inventory, productions, loans, and related operations. Our primary website and application are operated under the domain ensemblevault.com.
Scope: U.S. laws and school context
We design our practices to align with common U.S. privacy expectations for educational technology, including:
- Children’s Online Privacy Protection Act (COPPA): Where the service is used in connection with students under 13, we rely on the school or district, as the educational entity, for consent and authorization to the extent COPPA permits, and we do not use student information for behavioral advertising.
- Family Educational Rights and Privacy Act (FERPA): We process school-controlled information only as directed by the institution (or its authorized users) and for legitimate educational purposes. We do not use education records to build advertising profiles.
- Student privacy laws (state): Many states impose additional limits on operators of educational sites and services (for example, restrictions on targeted ads, limits on secondary uses of student data, and breach-notification expectations). We avoid selling student personal information and limit use to operating and improving the service for our customers.
- Consumer privacy laws (state): Depending on your state of residence, laws such as the California Consumer Privacy Act (CCPA/CPRA) and similar statutes in Colorado, Connecticut, Virginia, Utah, and others may grant rights to access, delete, or opt out of certain processing. If you are a California resident, see “Your California privacy rights” below.
Information we collect
Account and organization data
We collect information needed to create and administer accounts: for example, name, work email address, role, organization or school affiliation, and authentication data processed by our infrastructure provider. Billing contacts may provide information needed to process payments by check, money order, or purchase order; we do not process card payments in the product.
Program and inventory data you enter
You may enter information about inventory items, locations, productions, loans, repairs, and similar operational data. Depending on how your district uses the product, this may include student names or identifiers associated with check-outs or assignments. Such data is treated as customer content under your control.
Technical and usage data
Like most web applications, we collect limited technical data: IP address, browser type, device identifiers, timestamps, and diagnostic logs needed for security, reliability, and support. We may use aggregated or de-identified statistics to understand product usage.
Website analytics and session tools
We utilize third-party analytics services, including Microsoft Clarity and Vercel Web Analytics (provided by Vercel, Inc., which hosts our site), to collect and analyze information about how users interact with our website and application. This may include data such as IP address (anonymized where applicable), browser type, device information, pages visited, session duration, clicks, scroll behavior, referring URLs, and performance-related metrics. This information is used to improve site performance, user experience, and overall service quality.
Microsoft Clarity may record user sessions and generate heatmaps to help us better understand user interactions. Clarity employs privacy safeguards, including automatic masking of sensitive data fields, to prevent the collection of personally identifiable information.
Vercel Web Analytics helps us measure traffic and Core Web Vitals with a privacy-focused approach (for example, aggregated page views rather than cross-site advertising profiles). Processing is subject to Vercel's privacy policy as applicable.
We do not use this data to personally identify users, nor do we sell or share this information for advertising purposes.
How we use information
- Provide, secure, and improve the EnsembleVault service.
- Authenticate users, enforce permissions, and prevent fraud or abuse.
- Communicate about the service (for example, account notices, password resets, and responses to support requests).
- Meet legal obligations and respond to lawful requests.
We do not sell student personal information. We do not use student data for targeted advertising across third-party sites or apps.
How we share information
We share information only as needed to operate the service:
- Service providers (subprocessors): We use vetted vendors for hosting, database, authentication, email delivery, website analytics (including Microsoft Clarity and Vercel Web Analytics as described under “Website analytics and session tools”), and similar functions. They are permitted to process data only to provide services to us and are bound by confidentiality and security obligations.
- Your organization: Administrators and authorized staff at your school or district can see data according to the roles and permissions you configure.
- Legal and safety: We may disclose information if required by law, valid legal process, or to protect the rights, safety, and security of users, the public, or the service.
Data retention
We retain customer data for as long as your account is active and for a reasonable period afterward for backups, legal compliance, and dispute resolution. Your organization may request deletion or export of certain data subject to your agreement and applicable law.
Security
We use industry-standard safeguards including encryption in transit (HTTPS), access controls, and secure cloud infrastructure. No method of transmission or storage is 100% secure; we work to reduce risk through monitoring, least-privilege access, and regular updates.
K–12 and student-data commitments
- EnsembleVault is intended for educational and operational use by schools and authorized staff.
- We do not knowingly use student information for marketing unrelated to the service.
- Districts and schools remain responsible for notices and consents required under their own policies and local law.
- Upon request from an authorized school or district contact, we will cooperate regarding data access, correction, or deletion as required by contract and applicable law.
Your California privacy rights (CCPA/CPRA)
If you are a California resident, you may have the right to know what personal information we collect, to request deletion (subject to exceptions), and to opt out of “sale” or “sharing” as defined by California law. We do not sell personal information of minors under 16. To exercise rights, contact us using the information below. We will verify requests as required by law.
Other U.S. state rights
Residents of states with comprehensive privacy laws may have additional rights (for example, appeal processes or opt-out rights for certain profiling). Submit a request through the contact options below and we will respond in line with applicable law.
International users
The service is hosted in the United States. If you access it from outside the U.S., you consent to processing and transfer of information in the U.S., where privacy laws may differ.
Changes to this policy
We may update this policy from time to time. We will post the revised policy on this page and update the “Last updated” date. For material changes, we will provide additional notice as appropriate (for example, a notice in the application or by email to administrators).
Contact us
Questions about this policy or our privacy practices: support@ensemblevault.com
You may also use our contact form.