Effective July 16, 2026
BandScan is operated by William Rubano through Rubano Enterprises, LLC. It is a school-directed service for participating school music programs. We use personal information only to provide, secure, maintain, and support the service requested by a school. We do not sell personal information, use student data for targeted advertising, or build commercial profiles of students.
Depending on the features a school enables, BandScan may handle school settings and authorized staff emails; student names, ensemble membership, instruments, optional contact/profile fields, and login codes; parent, guardian, and volunteer profiles and student links; attendance/check-ins, questionnaire responses, bus assignments, requests, inventory and loans; communications and delivery status; and account identifiers, verification records, push tokens, and limited security logs. Apple or Google provides an account identifier and limited profile information when a user chooses social sign-in. Payments are disabled, and BandScan does not store payment-card or bank-account numbers.
We use information to authenticate and authorize users, operate school-selected features, synchronize an optional school Google Sheet, deliver communications, secure the service, prevent abuse, troubleshoot, and perform school-requested export, correction, or deletion. For public schools, BandScan acts as a service provider under the school's direction and, when the school relies on it, as a school official performing an institutional service under FERPA.
Authorized staff can access records for their own school program. We disclose information only to the school, at its direction, when law requires it, or to providers needed to operate BandScan, such as Hetzner and Cloudflare for hosting/network protection, Apple and Google for authentication or push delivery, Google for optional Sheets sync, and Resend for email. Stripe remains dormant while payments are disabled.
School-controlled records are retained for the school's contract term or a shorter documented school instruction. Short-lived sessions and verification records expire; limited body-free security request metadata is retained for up to 365 days. Users can delete their BandScan account in Settings. Because attendance, inventory, communication, or similar records may be education records controlled by the school, account deletion does not independently override the school's lawful recordkeeping decisions. Parents and eligible students should ask their school to access or correct education records. BandScan assists the school with an electronic copy, correction, or verified deletion request. A Georgia school-requested deletion is completed promptly and no later than 45 days.
Schools provision and manage student access. BandScan is intended for participating high-school programs and is not offered as a general consumer service to children. Student information is not used for advertising, sold, or used for an unrelated commercial purpose.
We use safeguards designed to protect information, including encrypted transport, school-scoped authorization, expiring signed sessions, access controls, auditing, tested releases, and backup procedures. No system can guarantee absolute security. We may update this policy as the service or law changes; the effective date identifies the current version.
Privacy questions or requests may be sent to William Rubano, Rubano Enterprises, LLC at billyrubano@gmail.com. Education-record requests should normally begin with the participating school.