The short version
- I only collect what I need to answer your enquiry and teach you.
- Analytics, ad measurement and embedded players stay off until you say yes. You can change your mind at any time with the button, which is also in the footer of every page.
- I never sell your details, and I don't send marketing emails unless you've asked to hear from me.
- Questions, or want your data deleted? Email decloak.mcr@gmail.com.
Who I am
This site is run by me, Jack Barton, trading as Decloak Music. I'm based in Lisbon, Portugal, and I'm the data controller for the personal data described here. The best way to reach me about anything on this page is decloak.mcr@gmail.com.
What I collect when you fill in a form
When you send one of the forms on this site, I get what you typed in, plus a few details the form adds automatically so I can reply properly.
| Form | What you give me |
|---|---|
| Free intro call | First and last name, email, where you're based, your Ableton experience, how you found me, and (if you choose) your goals and availability |
| Course booking | Name, email, where you're based, how you found me, and (if you choose) a start date and notes |
| Contact | Name, email, where you're based, how you found me, and your message |
| In-person enquiry | Name, email, where you're based, preferred dates, number of days and people, your experience, genre, goals and setup, and how you found me |
| Video course waitlist | First name and email |
Every form also sends your timezone and local time (so I can suggest lesson times that suit you), plus the name of the form and the page you sent it from.
The forms are run by Netlify, which hosts this site. Netlify also records your IP address and browser with each submission and runs a spam check through Akismet (Automattic). Each submission is then emailed to me at a Gmail address (Google).
Why I'm allowed to: you've asked me to reply, or to book lessons, so I need these details to do that (taking steps at your request before a contract, and then carrying out the contract). The spam check is in my legitimate interest in keeping the forms usable. For the waitlist, it's your consent, and you can ask to come off it at any time.
If you become a student
I keep your name, email, what we've booked and paid for, and my own notes on your lessons, so I can plan each session around you. Payments are taken through the secure payment link I send with your booking confirmation. The payment provider handles your card details, and I never see your full card number. I keep invoices and payment records because tax law requires it.
Cookies and similar storage
The site sets no cookies of its own. Fonts and scripts are served from this site, so nothing is sent to Google Fonts or a code library service just by visiting.
Two small items are saved in your browser's local storage, and both are strictly necessary:
| Name | What it holds | How long |
|---|---|---|
decloak-consent-v2 | Your cookie choices, a random ID for them, when you made them and which version of this policy you saw | 12 months, or until this policy changes in a way that means I need to ask again |
decloak-internal | Only set in my own browsers, so my visits don't count in the analytics | Until cleared |
Everything else is off until you say yes in the cookie banner, and you can choose each type separately:
| Type | Provider | What it does | Cookies | How long |
|---|---|---|---|---|
| Analytics | Google Analytics 4 (Google Ireland Ltd) | Shows me which pages people visit and which forms they send. Google Analytics doesn't store IP addresses. Google Signals is switched on, which only links your visit to ad audiences if you've also allowed marketing. | _ga, _ga_Q167VDKLN7 | 2 years |
| Marketing | Meta Platforms Ireland (Meta pixel) | Lets me see whether my Instagram and Facebook ads lead to visits and enquiries. It records page views and an anonymous "Lead" event when a form is sent. Automatic matching of your details is switched off. | _fbp, and _fbc after an ad click | 90 days |
| Marketing | Google Ads (Google Ireland Ltd), when I run Google ads | Measures whether my Google ads lead to enquiries | _gcl_au | 90 days |
| External media | YouTube (through youtube-nocookie.com), SoundCloud, Bandcamp, Instagram, Facebook video, Beatport, Juno, and Elfsight for my Google reviews widget | Plays videos and tracks, and shows reviews, inside my pages | Set by each provider | See each provider's own policy |
Google Tag Manager loads on every page so the site can switch these tools on and off. It sets no cookies itself, but your browser does contact Google's servers to fetch it.
If you refuse marketing, Google's advertising identifiers are stripped from anything sent. If you arrived from an ad, the ad click ID can be carried in the page address rather than in a cookie.
Why I'm allowed to: your consent. Withdrawing it is as easy as giving it: open and switch things off. That stops anything new being collected from then on.
Keeping a record of your choice
Each time you make or change a cookie choice, the site saves one record on Netlify so I can show that consent was given. It holds the random ID, what you chose for each type, the policy version, the page, the date and time, and how you chose (accept all, reject all, choose, or "always allow" on a player). It holds no IP address, name, email or browser details.
Who else handles your data
These companies process data for me, only for the purposes above:
- Netlify: hosting, forms and the consent record (USA)
- Google: Analytics, Tag Manager, Gmail, and Google Ads when I run them
- Meta: the Meta pixel
- Automattic: the Akismet spam check, through Netlify
- The external media providers above, only when you allow them
Some of these are based in the USA or move data there. Where that happens, it's covered by the safeguards the law requires, such as the EU-US Data Privacy Framework or standard contractual clauses.
How long I keep things
- Enquiries that don't turn into lessons: deleted after 12 months.
- Student details and lesson notes: for as long as we're working together, then for up to 2 years in case you come back.
- Invoices and payment records: for as long as tax law requires.
- The consent record: 3 years, then deleted.
- Cookies: as listed in the table above.
Your rights
You can ask me to show you what I hold about you, correct it, delete it, limit what I do with it, or give it to you in a format you can take elsewhere. You can object to anything I do on the basis of legitimate interests, and withdraw consent at any time. Email decloak.mcr@gmail.com and I'll reply within a month.
If you're not happy with how I've handled your data, please tell me first and I'll put it right. You also have the right to complain to the data protection authority: in Portugal that's the CNPD, and if you're in the UK you can go to the ICO.
Changes to this policy
If I change how the site uses your data, I'll update this page and the date at the top. If the change affects what you've agreed to, the cookie banner will ask you again.