Data protection impact assessment (DPIA): draft

Tool: Playable Notes Supplier: Ozni Apps LLC (Colorado Springs, Colorado, USA)
School: [School to complete: school name] Prepared by: [School to complete: name and role] Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-11-05). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of tool	music teaching resources / reads photos or PDFs of piano sheet music into editable scores and rearranges them (simpler, easier left hand, another key) for each student
Purpose in our school	[School to complete: what you will use it for, which year groups or staff, and why]
Who will use it	Supplier says pupil-facing: no - terms say it is a tool for music teachers; students open teacher-made practice links without an account, and the supplier says it keeps nothing about them [School to complete: number and roles of users]
Personal data involved	[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controller	not stated - consumer-style teacher accounts; the privacy policy lists service providers that process data on its behalf, with no school or organisation data-processing terms
Where data is stored	not stated - US operator; hosting and storage on Google Cloud and Firebase, music read and changed by OpenAI, plus Cloudflare and Stripe; regions and protections for transfers from Britain not stated
Trains AI on inputs	not stated - uploaded music is processed by OpenAI and Cloudflare on the supplier's behalf; the policy does not say whether inputs are used to train AI models
How long inputs are kept	deleting a project keeps an archived copy no other user can see; deleting the account permanently deletes projects, archives, versions, uploads and practice links; purchase records and a one-way fingerprint of the email are kept; PostHog analytics may remain until removal is requested
Data processing agreement	Not stated by the supplier. [School to complete: DPA reference or date signed] Signs individual DPAs: Not stated by the supplier. [School to complete: ask the supplier]
Supplier DPO / UK representative	not stated (contact support@playablenotes.com)
Minimum age	not stated - teacher tool; students use practice links without signing in
Other safety notes	piano-only (treble and bass staff together); teachers may upload only music they own or have permission to copy and adapt, confirmed before every upload; analytics and ad tracking are on by default, with session recordings (typed form text masked) and page visits, sign-up and purchase events, IP address and hashed email shared with Google Ads, Meta and OpenAI for ad measurement and targeting, which can be switched off in account Privacy settings; students' practice pages are not tracked but anyone with a practice link can open it; can connect to ChatGPT or Claude, which then act on the teacher's account; 50 free credits, then 1 credit per line of music read, sold to US billing addresses only for now; check AI readings and changes before use
Lawful basis	[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Grey, pupils Grey.

Risk	Suggested measure	Likelihood / severity	Residual risk
Unclear whether inputs are used for AI training	Ask the supplier in writing; check plan settings.	[School to complete: low / medium / high]	[School to complete: accepted?]
Data may be stored outside the UK/EU (Not stated)	Confirm the transfer safeguards (UK IDTA, standard contractual clauses or adequacy).	[School to complete: low / medium / high]	[School to complete: accepted?]
No data processing agreement published	Request a DPA before use, or limit use to non-personal data.	[School to complete: low / medium / high]	[School to complete: accepted?]
Minimum age: not stated - teacher tool; students use practice links without signing in	Check this against the age of any pupils who will use it.	[School to complete: low / medium / high]	[School to complete: accepted?]
Supplier not confirmed as a processor acting on school instructions	Clarify roles in the contract.	[School to complete: low / medium / high]	[School to complete: accepted?]
AI output may be inaccurate or biased	Staff review all output before it is used; do not rely on it for decisions about individuals.	[School to complete: low / medium / high]	[School to complete: accepted?]
[School to complete: any other risks]	[School to complete: measure]

4. Sign-off

DPO advice	[School to complete: DPO comments and date]
Decision	[School to complete: approved / approved with conditions / not approved]
Approved by	[School to complete: name, role, date]
Review date	[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

https://playablenotes.com/privacy
https://playablenotes.com/terms
https://playablenotes.com/pricing
https://playablenotes.com/support
https://playablenotes.com/about