Privacy Policy

Effective: August 24, 2026

Port 443 Inc. (“Port 443”, “we”, “us” or “our”) provides My Music Staff, TutorBird and AthletaDesk, including our websites, applications and related services (collectively, the “Services”).

We take privacy seriously. This Privacy Policy explains what Personal Information we collect, how and why we use it, when we share it, how long we retain it, and the choices and rights available to you.

Port 443 Inc. is located at:

Port 443 Inc.
880 Laurentian Dr, Unit #2
Burlington, Ontario L7N 3V6
Canada

Privacy questions or requests may be directed to privacy@port443.io.

1. When This Privacy Policy Applies

This Privacy Policy applies to Personal Information that Port 443 collects and processes for its own purposes, including information relating to:

• customers and prospective customers;
• individuals who create or administer Port 443 accounts;
• visitors to our websites;
• people who contact our sales or support teams;
• people who receive communications from us; and
• other individuals who interact directly with Port 443.

There is an important distinction between this information and information our customers enter into the Services about their own students, parents, clients, staff or other individuals.

Customer Data

When a customer enters Personal Information concerning students, parents, guardians, clients, staff or other individuals into My Music Staff, TutorBird or AthletaDesk, the customer generally determines why and how that information is used.

In those circumstances:

• the customer acts as the Controller of the Personal Information; and
• Port 443 acts as the Processor on the customer’s behalf.

Port 443 processes this Customer Data according to the customer’s instructions and our Data Processing Agreement.

Individuals seeking to exercise privacy rights relating to information held within a customer’s account should generally contact that customer directly. Port 443 assists its customers with privacy requests as required by applicable law and our Data Processing Agreement.

2. Personal Information We Collect

The information we collect depends on how you interact with us and which Services you use.

Account and Contact Information

We may collect information such as:

• your name;
• email address;
• telephone number;
• business or organization name;
• mailing or billing address;
• account login and profile information; and
• information you provide when creating or managing an account.

Billing and Transaction Information

If you purchase Services from Port 443, we may collect information relating to your subscription, invoices, payment status and transaction history.

Payment card information is processed by our third-party payment providers. Port 443 does not store complete payment card numbers.

Communications and Support Information

When you contact us, request a demonstration, submit a form, participate in a survey or communicate with our support or sales teams, we may collect:

• your contact information;
• the contents of your communication;
• support or account information relevant to your request; and
• other information you choose to provide.

Website and Usage Information

When you visit or use our websites or Services, we may automatically receive certain technical information, including:

• IP address;
• browser type and version;
• device and operating-system information;
• pages or features accessed;
• date, time and duration of activity;
• referring website or source;
• application and system activity; and
• diagnostic, security and performance information.

Marketing Information

If you interact with our marketing activities, we may collect information relating to:

• email subscriptions and preferences;
• marketing communications you open or interact with;
• advertisements or campaigns that directed you to our websites; and
• other marketing engagement information.

3. How We Use Personal Information

We use Personal Information for purposes including:

• providing and operating the Services;
• creating and administering customer accounts;
• processing subscriptions, billing and payments;
• communicating about accounts, Services and important product changes;
• providing customer support;
• responding to inquiries and demonstration requests;
• maintaining the security, integrity and reliability of our Services;
• detecting, preventing and investigating fraud, abuse and security incidents;
• diagnosing technical problems;
• understanding how our websites and Services are used;
• improving our Services, websites and customer experience;
• developing new features and functionality;
• sending marketing communications where permitted by law;
• measuring the effectiveness of our marketing activities;
• maintaining appropriate business and financial records;
• enforcing our agreements and protecting our legal rights; and
• complying with legal and regulatory requirements.

We do not sell Personal Information to third parties.

4. Legal Bases for Processing

Where the UK GDPR, EU GDPR or similar legislation requires us to identify a lawful basis for Processing, we rely on one or more of the following, depending on the circumstances.

Performance of a Contract

We process Personal Information where necessary to enter into or perform our agreement with you, including to:

• create and administer your account;
• provide the Services;
• process subscriptions and billing;
• provide requested support; and
• communicate with you about the Services.

Legitimate Interests

We may process Personal Information where necessary for our legitimate business interests and where those interests are not overridden by your privacy rights.

These interests may include:

• operating and improving our business and Services;
• maintaining system and account security;
• preventing fraud and abuse;
• understanding how our Services are used;
• providing customer service;
• communicating with existing customers about relevant products and features; and
• measuring and improving our marketing and business activities.

Consent

We rely on consent where required by applicable law, including for certain marketing communications, cookies or tracking technologies.

Where Processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect Processing that occurred before consent was withdrawn.

Legal Obligations

We may process Personal Information where necessary to comply with applicable laws, regulations, court orders or other legal obligations.

5. Customer Data We Process on Behalf of Customers

Customers may use our Services to collect and manage Personal Information relating to their students, parents, guardians, clients, staff, instructors, teachers, tutors or other individuals.

Depending on the Service and how the customer chooses to use it, Customer Data may include:

• names and contact information;
• account and profile information;
• lesson, session, appointment and scheduling information;
• attendance information;
• invoices and transaction-related information;
• communications;
• notes and records entered by the customer; and
• other Personal Information the customer chooses to store within the Services.

Port 443 does not determine the purposes for which customers collect this information. We process it on their behalf to provide, secure, maintain and support the Services.

Our obligations concerning Customer Data are described further in our Data Processing Agreement.

6. Service Providers and Other Third Parties

We use third parties to help us operate our business and provide the Services.

These providers may support activities such as:

• cloud hosting and infrastructure;
• communications and messaging;
• payment processing;
• customer-requested integrations;
• analytics;
• website operations;
• security; and
• other technical and business operations.

Where a third party processes Personal Information on our behalf, we require appropriate privacy, confidentiality and security protections.

Some third parties, including certain payment providers and third-party services selected or connected by customers, may process Personal Information as independent Controllers under their own privacy policies.

Our current list of Subprocessors that may process Customer Data, including applicable processing locations, is available on request by contacting privacy@port443.io.

7. Payments

We use third-party payment providers to facilitate certain payments.

When payment information is entered directly into a third-party payment provider’s systems, that provider’s collection and use of the information is governed by its own privacy terms.

Port 443 does not store complete payment card numbers.

Customers may also connect supported third-party payment services to their Port 443 account for transactions between the customer and its own students or clients. Those providers may have their own responsibilities as Controllers of payment information.

8. Cookies and Similar Technologies

Our websites and Services use cookies and similar technologies for purposes such as:

• keeping users signed in;
• maintaining security;
• remembering preferences;
• understanding website and Service usage;
• measuring performance; and
• supporting marketing and advertising activities.

Some cookies and similar technologies are necessary for our websites or Services to function. Others are optional.

Where required by applicable law, we request consent before using non-essential cookies or similar technologies. You can manage available choices through our cookie settings and, in some circumstances, through your browser or device settings.

Third-party analytics or advertising providers may receive information about your browser, device or interactions with our websites where those technologies are enabled.

9. Marketing Communications

We may send information about Port 443 products, features, events, offers or other information we think may be relevant to you where permitted by applicable law.

You may unsubscribe from marketing emails at any time using the unsubscribe option included in those messages.

Even if you unsubscribe from marketing communications, we may continue to send non-marketing communications that are necessary to administer your account, provide the Services, address security matters or fulfill our contractual or legal obligations.

We may retain limited information necessary to record and honour an unsubscribe request.

10. International Processing and Data Transfers

Port 443 is based in Canada. Personal Information may be processed in Canada, the United States and other jurisdictions in which our approved service providers operate.

Where applicable data-protection law restricts international transfers of Personal Information, we use recognized transfer mechanisms and safeguards as required by law.

United Kingdom

Where Personal Information subject to the UK GDPR is transferred to Port 443 in Canada and the Processing is subject to PIPEDA, we may rely on the United Kingdom’s applicable adequacy regulations for Canada.

Where Personal Information is transferred to an eligible certified recipient in the United States, an applicable UK adequacy regulation, including the UK Extension to the EU-U.S. Data Privacy Framework, may be relied upon.

Where an applicable adequacy regulation does not cover the transfer, safeguards may include the UK International Data Transfer Agreement or the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum, as applicable.

European Economic Area

Where the EU GDPR applies and Personal Information is transferred to a jurisdiction that is not covered by an applicable adequacy decision, we use an appropriate transfer mechanism, which may include the European Commission Standard Contractual Clauses.

Further information about international transfers of Customer Data is available in our Data Processing Agreement.

11. Retention and Deletion

We retain Personal Information only for as long as reasonably necessary for the purposes for which it was collected, including as necessary to:

• provide the Services;
• maintain appropriate business, accounting and transaction records;
• comply with legal and regulatory requirements;
• resolve disputes;
• maintain security;
• prevent fraud or abuse; and
• establish, exercise or defend legal claims.

The applicable retention period depends on the type of information, why it was collected, applicable legal requirements and the sensitivity of the information.

Customer Data

Customer Data is retained in accordance with the customer’s use of the Services and our Data Processing Agreement.

When an individual record is deleted from the active production system, copies of that information may temporarily remain within backup systems until the applicable backup expires.

Port 443 currently retains:

• nightly database backups for up to 35 days; and
• certain longer-term backup snapshots for up to 12 months.

Personal Information relating to deleted records that remains solely within backups is not used for ordinary business processing and is retained only for legitimate backup, security and disaster-recovery purposes until the applicable backup expires.

12. Security

We maintain appropriate technical and organizational measures designed to protect Personal Information against accidental or unlawful loss, destruction, alteration, unauthorized access or disclosure.

Our security measures include controls relating to:

• access and authorization;
• authentication;
• system security;
• monitoring and logging;
• backup and disaster recovery;
• personnel confidentiality; and
• security incident response.

No method of transmitting or storing information can guarantee absolute security. We regularly review our safeguards and update them as appropriate based on the nature of the information and associated risks.

13. Your Privacy Rights

Depending on where you live and the circumstances of the Processing, you may have rights relating to your Personal Information, including the right to:

• request access to Personal Information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of Personal Information;
• request restriction of Processing;
• object to certain Processing;
• receive certain Personal Information in a portable format;
• withdraw consent where Processing is based on consent; and
• make a complaint concerning our privacy practices.

These rights are subject to exceptions and limitations under applicable law.

We may take reasonable steps to verify your identity before completing a privacy request.

Information Held Within a Customer Account

If your request relates to information held about you within a My Music Staff, TutorBird or AthletaDesk customer’s account, that customer is generally the Controller of the information.

Please contact the customer directly to exercise your rights. If we receive such a request directly, we may refer you to the applicable customer and will assist the customer where required by law.

Complaints

If you have a concern about Port 443’s handling of Personal Information, please contact us first at privacy@port443.io so we can review the matter.

Depending on where you live, you may also have the right to make a complaint to an applicable privacy or data-protection regulator, including the Office of the Privacy Commissioner of Canada, the UK Information Commissioner’s Office or the applicable supervisory authority in the European Economic Area.

14. Children’s Information

Our Services are designed for businesses and professionals that may provide services to children, including music teachers, tutors and other service providers.

A customer may choose to enter Personal Information relating to a child into the Services. In those circumstances, the customer generally acts as the Controller of that information and Port 443 processes the information on the customer’s behalf in accordance with our Data Processing Agreement.

Customers are responsible for determining the appropriate legal basis for collecting and using children’s Personal Information and for providing any notices or obtaining any consent required by applicable law.

Port 443 does not use Customer Data relating to children for its own independent marketing purposes.

15. Automated Decision-Making

Port 443 does not currently make decisions based solely on automated processing of Personal Information where those decisions produce legal or similarly significant effects concerning an individual.

16. Business Transactions

If Port 443 is involved in a merger, acquisition, financing, reorganization, sale of assets or similar business transaction, Personal Information may be disclosed or transferred as part of that transaction.

We will continue to protect Personal Information in accordance with applicable law and will provide notice where required if responsibility for the information changes.

17. Legal Disclosures

We may disclose Personal Information where reasonably necessary to:

• comply with applicable law, regulation, legal process or enforceable governmental request;
• respond to a court order or lawful request from a public authority;
• investigate or prevent fraud, abuse or security incidents;
• protect the rights, property or safety of Port 443, our customers, users or others;
• enforce our agreements; or
• establish, exercise or defend legal claims.

18. Third-Party Websites and Services

Our websites and Services may contain links to websites, applications or services operated by third parties.

We are not responsible for the privacy practices of third parties acting independently from Port 443. We encourage you to review their privacy information before providing Personal Information to them.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, privacy practices or legal obligations.

When we make changes, we will update the effective date at the top of this page. Where a change materially affects how we use Personal Information or your rights, we will provide additional notice where required by applicable law.

20. Contact Us

Questions, privacy requests or complaints may be directed to:

Port 443 Inc.
880 Laurentian Dr, Unit #2
Burlington, Ontario L7N 3V6
Canada

Email: privacy@port443.io