Privacy Policy

Last updated: September 9, 2026

Operated by Fermata Works, LLC (“Fermata Works,” “we,” “us,” or “our”). Products covered: Marching Mapper, Marching Mapper Buddy, and related websites and services at marchingmapper.com (collectively, the “Service”).

1. Scope and roles

This Policy describes how we collect, use, disclose, and protect personal information when you visit our website, create an account, purchase a license, use Marching Mapper or Marching Mapper Buddy, join or download a shared show, post in community features, or otherwise interact with the Service.

Depending on how the Service is used, we may act as:

• A service provider / school official for Student Data when a U.S. school, district, or authorized educator uses the Service for educational purposes and directs Student Data to us (see Section 2); or
• A business for personal or commercial accounts when an individual creates an account for personal use, marketing site visits, purchases, or non-school community participation.

“Student Data” means information that is linked or linkable to a current or former student and that is provided to us by or on behalf of a school, district, or educator for educational purposes. This may include a student’s name, email address, account profile information, show join/request information, show files or drill content that identify performers, and related usage records created in an educational context.

2. Student Data and school use (FERPA and U.S. state student privacy laws)

Marching Mapper is designed primarily for educators, directors, designers, and ensembles. Schools and districts in the United States often treat vendors that receive Student Data under the school’s direction as “school officials” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), when a proper agreement or authorized use is in place.

When we process Student Data for a school or district:

• We use Student Data only to provide and support the educational Service the school or educator requested.
• We do not sell Student Data.
• We do not use Student Data for targeted advertising, and we do not build advertising profiles from Student Data.
• We do not use Student Data to amass a personal profile about a student for non-educational commercial purposes.
• We do not disclose Student Data except as described in this Policy, as directed by the school, as needed to operate the Service through approved subprocessors, or as required by law.
• We maintain administrative, technical, and physical safeguards appropriate to the nature of the Student Data we process.
• Upon a verified written request from the school or district (or as required by a signed DPA), we will delete or return Student Data that we hold for that school, subject to legal retention needs and backup cycles.
• Parents, guardians, and eligible students who want to access, correct, or delete Student Data should contact their school or district first. We will cooperate with the school’s instructions for FERPA and applicable state student privacy requests.

Many states have additional student privacy laws (for example, California SOPIPA, Illinois SOPPA, New York Education Law 2-d, and similar statutes). Our Student Data commitments above are intended to support compliance with those common requirements. Individual districts may still require their own DPA, Exhibit E, or equivalent. We will review school/district contracts in good faith.

Important for educators: When you invite performers to join a show in Marching Mapper Buddy, you may submit student names and email addresses, or students may submit that information themselves. Treat that information as Student Data when it relates to K-12 students. Only share what your school policies allow, and use school-approved accounts where required.

3. Children under 13 (COPPA)

The Service is not directed to children under 13 for personal account registration. We do not knowingly allow a child under 13 to create a personal Marching Mapper account. Web registration requires confirmation that the registrant is 13 or older.

If Student Data about a child under 13 is provided through a school or district for educational use, we rely on the school to authorize that collection and use under applicable COPPA school consent guidance and FERPA, as appropriate. Parents who believe we have collected a child’s personal information outside an authorized school context should contact us and we will take appropriate steps to delete it.

4. Information we collect

4.1 Account and profile information

When you register or update your profile, we may collect:

• First name, last name, and email address
• Password (stored only as a secure hash; we do not store plaintext passwords)
• Profile type (for example, Director, Designer, Arranger, Student, or Publisher)
• Optional ensemble name, ensemble state, bio, and website URL
• Optional “how did you hear about us” response
• Role and license-related account flags needed to operate the Service

4.2 License, device, and payment-related information

• License keys, license type/status, activation and expiration dates
• Machine identifiers used to bind a license to a device
• Stripe customer/session/subscription/payment identifiers and payment amounts, fees, and tax totals
• We do not store full payment card numbers. Card data is handled by Stripe.

4.3 Show sharing and Marching Mapper Buddy

• Show titles, descriptions, access codes, uploaded show files, and version history
• Join requests and downloads, which may include requester name and email address
• Show content you upload may include performer labels or other identifiers you place in the file

4.4 Community, support, and learning features

• Forum posts, replies, attachments, and optional reply-notification preferences
• Bug reports (including product, OS/device details, and screenshots you upload)
• Testimonials (name, email, organization, story, and optional images)
• Contact form messages
• Newsletter email addresses
• MMU course progress, quiz responses, project submissions, and related feedback where those features are used

4.5 Usage, security, and coarse location signals

• Pages visited, approximate referrer, and truncated/hashed session or viewer identifiers for analytics and abuse prevention
• Coarse location derived from IP geolocation (for example, country/region and heavily rounded coordinates), stored separately from account records for aggregate usage maps. We do not request GPS/device location permissions for this.
• App authentication tokens for Marching Mapper Buddy / mobile access
• Security and diagnostic logs needed to operate and protect the Service

4.6 Information from third-party services

We receive limited information from providers that help us run the Service, such as payment confirmation metadata from Stripe, spam/bot verification results from Google reCAPTCHA, email delivery events from our email provider, and coarse geolocation results from IP lookup providers.

5. How we use information

We use information to:

• Create and manage accounts, licenses, and authentication
• Provide desktop, web, and Buddy features, including show sharing and downloads
• Process purchases, subscriptions, upgrades, cancellations, and related receipts
• Provide customer support, security, fraud prevention, and service troubleshooting
• Operate community features you choose to use (forum, bug tracker, resources, testimonials)
• Send transactional messages (for example, password reset, email change, license/billing notices)
• Send product updates or newsletters for non-Student accounts created on the website (Director, Designer, Arranger, Publisher). Student accounts are not auto-added to the newsletter. Anyone on the newsletter can unsubscribe at any time.
• Understand aggregate product usage and improve the Service
• Comply with law, enforce terms, and protect users, schools, and Fermata Works

For Student Data, we limit use to providing the educational Service and related support, security, and legal compliance, unless the school provides a different lawful instruction in writing.

6. How we share information

We do not sell personal information or Student Data. We share information only in these situations:

• With other users you choose to interact with. For example, show hosts can see join requests and download records for their shows; community posts may display a shortened public name; approved testimonials may display the name and organization you submit.
• With schools/districts. When an educator or school administers a show or account used for Student Data, school-authorized personnel may access information associated with that educational use.
• With service providers (subprocessors) that help us operate the Service under contractual obligations appropriate to the data they process. Current categories include:
  • Stripe (payments)
  • Email delivery providers (transactional and newsletter email)
  • Google reCAPTCHA (bot prevention on selected forms)
  • IP geolocation providers (coarse location estimates)
  • Hosting / infrastructure providers needed to run the website and store uploaded files
• For legal and safety reasons, if we believe disclosure is required by law, regulation, legal process, or to protect rights, safety, or security.
• Business transfers. If we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to ongoing privacy commitments for Student Data.

7. Advertising and analytics

We do not sell Student Data and we do not use Student Data for targeted advertising.

Our public marketing website may use analytics or advertising technologies, including the Meta (Facebook) Pixel, only for logged-out visitors on public pages. Once you are signed in, we do not load the Meta Pixel, so logged-in educators, students, and other account holders are not tracked by that advertising tool while using the Service.

If you are a school, district, or parent concerned about advertising technologies, we recommend accessing educational workflows through school-managed devices/accounts and reviewing your organization’s web-filtering and privacy settings. You may also contact us about educational deployment preferences. We do not use Student Data from educational show sharing, license validation, or school-directed accounts to target ads.

8. Cookies and similar technologies

We use cookies and similar technologies to:

• Keep you signed in (session cookies)
• Remember limited preferences (for example, viewer tokens used for aggregate resource view counts)
• Support security and form abuse prevention
• Support optional translation features if you use them
• Support marketing analytics on public pages, as described above

You can control cookies through your browser settings. Disabling certain cookies may limit account login or some features.

9. Security

We use safeguards designed to protect personal information, including password hashing, access controls for administrative tools, encrypted transport (HTTPS) for the website, and least-privilege practices for production systems where feasible. No method of transmission or storage is 100% secure. If we become aware of a security incident affecting Student Data or personal information, we will take appropriate steps to investigate, mitigate, and notify affected schools and individuals as required by applicable law and any signed DPA.

10. Retention and deletion

We retain information for as long as needed to provide the Service, maintain licenses and financial records, resolve disputes, enforce agreements, and meet legal obligations. Show files, join/download records, community content, and support records may persist until deleted by an authorized user, by us at a school’s request, or through our account administration processes.

To request deletion of your personal account data, email us from your account email or contact us. Schools and districts may request deletion or return of Student Data as described in Section 2. Some information may remain in encrypted backups for a limited period, and we may retain limited records as required for legal, security, or accounting purposes.

Newsletter subscribers can unsubscribe using the link in those emails. Student accounts are not auto-subscribed. If you change your profile type to Student, we remove your email from the product newsletter. If you change from Student to another profile type, we may add your email to the newsletter. Deleting an account may not automatically remove a separately stored newsletter subscription tied only to an email address; tell us if you want both removed.

11. Your choices and rights

Depending on your location and role, you may have rights to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion
• Unsubscribe from marketing emails
• Withdraw consent where processing is consent-based

U.S. state consumer privacy laws (such as the CCPA/CPRA for California residents) may provide additional rights for personal information that is not Student Data governed by FERPA. We do not sell personal information. To exercise a privacy request, contact us. We will verify requests before fulfilling them. For Student Data held for a school, we will route or coordinate requests with the school as required.

12. International users

We are based in the United States and process information in the United States. If you access the Service from outside the U.S., you understand your information may be transferred to and processed in the United States, which may have different data protection rules than your country.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date. Material changes affecting Student Data processing for schools will be communicated in a manner appropriate to the change, which may include email or in-product notice when feasible.

14. Contact

Fermata Works, LLC
Privacy questions and deletion requests: marchingmapper.com/contact
Email: info@marchingmapper.com

Stripe’s privacy policy (payment processing): https://stripe.com/privacy