The short version
- We collect what we need to run your account and the lessons: your name, email, quiz answers, learning progress, and payment records. Your card number never reaches us.
- Optional cookies (analytics and advertising) need your OK where the law requires it. Elsewhere in the US they are on by default, and you can switch them off any time with Cookie Preferences or Your Privacy Choices in the footer. We honour Global Privacy Control everywhere.
- We do not sell your information for money. When advertising is on for you, Meta, Google and Microsoft receive data about your visit, which some US states call “sharing”. You can turn that off.
- The AI guitar assistant sends your question to an AI provider to write the answer. We do not keep your questions or answers.
- You can see, correct, get a copy of, or delete your data. A deleted account is permanently removed 30 days later. If you bought from us, we keep your email address with the record of your purchase, and your support emails for 3 years.
This summary is here to help you read the page. The full wording below is what applies.
1. Who is responsible for your data
Rock Guitar Power is a trading name (“doing business as”) of Medurik Corporation, 20 Dewberry Drive, Rochester, NY 14622, USA. Medurik Corporation is the “controller” of your personal information for the public website at rockguitarpower.com, the members site at lessons.rockguitarpower.com, our emails, and the AI guitar assistant. For anything about privacy, email support@rockguitarpower.com.
We are a small business. We do not have a data-protection officer or a representative in the EU or UK; privacy requests go to the owner directly. We sell worldwide but do not specifically target the EU or UK.
2. What we collect
Things you give us
- Account details: your name, email address, and password (stored only as a one-way hash).
- Skill quiz answers: your playing level, goals, and interests, which we use to pick your free course and the lessons we suggest.
- Purchase and membership details: what you bought, when, for how much, and your membership status. Your card number and security code go straight to Stripe (or PayPal) and never touch our servers; we do not store any card digits.
- Messages: anything you send through the contact form or by email.
- Email preferences: what you have subscribed to or unsubscribed from.
Things collected automatically
- Learning activity: which lessons you open and finish, and where you stopped in a video, so you can pick up where you left off.
- Login history: when you signed in, and the IP address used (kept for 90 days).
- Device and usage data: browser type, device type, screen size, pages visited, time on page, the page you came from, and campaign tags (such as UTM parameters) in the link that brought you here. On quiz and sign-up steps we also record a browser “fingerprint” (a code made from your browser’s settings) to keep those steps joined up.
- IP address and rough location: used for security and to work out your city or region. We keep IP addresses and browser strings for 90 days, then a daily job removes them; the visit record stays without them.
- Linking your visits: when you give us your email address, we link it to your earlier visits from the same device, browser, or IP address in the previous few days, so we know which page or ad brought you here.
- Your cookie choices: the choice you made, when, and which version of our notice you saw. The IP address and browser string saved with it are removed after 90 days.
- Email engagement: whether our emails were delivered, opened, clicked, bounced, or marked as spam.
We do not collect “sensitive personal information” as defined by California law, and please do not send us health details, government ID numbers, or payment details by email.
3. How we use it, and where it comes from
- To run the service: create and secure your account, give you access, track your progress, take payments and give refunds, and send receipts and account notices (trial and renewal reminders, cancellation confirmations, password resets).
- To personalise: choose your free course from your quiz answers, suggest lessons, and tailor the tips we email you.
- To answer you: reply to support messages and AI assistant questions.
- To tell you about lessons and offers, only where you have signed up, always with an unsubscribe link.
- To understand and improve the site, and to measure advertising when advertising is on for you (section 5).
- To keep things safe and legal: prevent fraud, abuse, and account sharing, enforce our Terms of Service, keep tax records, and respond to lawful requests.
Where we get information: from you; from your device and browser; from Stripe and PayPal (payment results); from Meta, Google and Microsoft (reports on whether an ad led to a sign-up or purchase); and from Resend (email delivery events).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Our legal grounds (UK, EU and similar places)
| Legal ground | What we use it for |
|---|---|
| Performing our contract with you | Your account, lessons, payments, receipts, support, and account emails. |
| Your consent | Analytics and advertising cookies where the cookie banner appears, marketing emails, and the free course from the quiz. You can withdraw consent at any time. |
| Our legitimate interests | Security, fraud prevention (including making sure each person gets the free trial only once), improving the site, linking visits to work out what brought you here, and default-on optional cookies in US states outside the banner regions. These uses are small, expected, and easy to switch off, so we believe they do not override your rights; you can object at any time. |
| Legal obligation | Tax and accounting records, and responding to lawful requests. |
7. The AI guitar assistant
- Your question, together with matching passages from our lessons and blog posts, is sent to OpenAI to write the answer. We do not send your name or email with it.
- We do not keep your questions or the answers. The text of your question is not sent to our analytics either.
- On the public website the assistant allows 10 free questions per visitor per day, counted with a one-way hash of your IP address (the real address is not stored). Members are identified by their login.
- Please do not type personal, financial, or health information into the assistant.
8. Emails and your choices
- Account emails (receipts, trial and renewal reminders, cancellation confirmations, password resets) are part of the service.
- Lessons, tips, and offers are sent only if you signed up, for example through the skill quiz. Every one has an Unsubscribe link, which takes effect right away.
- Our emails record opens and clicks so we can stop sending what you do not read.
9. How long we keep things
| Information | How long we keep it |
|---|---|
| Your account and learning progress | Until you delete your account. Sign-in stops at once; a daily job permanently removes the account 30 days later. Email us within those 30 days to restore it. If you ask us by email instead, we delete it straight away. |
| Payment and refund records (only if you bought something) | 7 years (tax law). When your account is deleted we keep your email address with each sale record (date, product, amount, payment reference, refunds) so we can prove the purchase and handle refunds, plus your support emails (see Support emails below). No name, no account, no tracking. If you never paid us, nothing is kept. |
| “Already had a free trial” marker | 3 years. When an account that had a membership is deleted, we keep a scrambled code made from the email address with a secret key (not the address itself), so the same address cannot start a second free trial. You can always sign up again; you just start without a trial. |
| IP addresses and browser strings | 90 days, then a daily job blanks them. The visit record stays without them. |
| Cookie consent records | The choice itself for as long as we rely on it; the IP address and browser string saved with it, 90 days. |
| Quiz leads who never buy or open our emails | We review and remove them after 24 months. |
| Support emails | 3 years, including after a deleted account if you bought from us (for refund or payment questions). If you never bought from us, they are deleted with your account. |
| AI usage logs (counts, no question text) | 90 days. |
| Email delivery events | Kept with your contact record, and removed with it. |
| Unsubscribe list | Kept indefinitely, so that we never email you again. |
Backups: our database host keeps no separate backup copy on our current plan, so when data is deleted, it is gone.
When your account is deleted we also ask our providers to remove you: we remove your scrambled email from any Meta, Google or Microsoft advertising audience and delete your customer record at Stripe. If you never paid us, we also ask Stripe to remove your details from its payment records. Stripe and PayPal keep their own records of real payments, as the law requires them to. Advertising reports that were already counted (for example “one sign-up last Tuesday”) cannot be undone per person.
10. Your rights and how to use them
Wherever you live, you can:
- See and update your name and password in your account settings. To change your email address, ask us.
- Get a copy of your data: ask us and we send it as a JSON file (a standard, portable format).
- Correct anything that is wrong.
- Delete your account in account settings (or ask us). Billing stops and sign-in ends immediately. Unused time is not refunded outside the 60-day guarantee. What we keep afterwards, and for how long, is listed in section 9. You can sign up again at any time and start fresh (without a second free trial).
- Stop marketing emails with the unsubscribe link, or by emailing us.
- Opt out of advertising “sharing” and profiling for ads at Your Privacy Choices or with GPC.
UK, EU and EEA residents
Under the GDPR you have the right of access, rectification (correction), erasure, restriction, data portability, and objection (including an absolute right to object to direct marketing), and the right to withdraw consent at any time without affecting what was done before. You may complain to the UK Information Commissioner’s Office (ICO) or your national data-protection authority, though we would like the chance to put things right first.
California and other US state residents
You have the right to know what we collect and share, to access, correct, and delete it, to opt out of its “sale” or “sharing” for targeted advertising, and not to be treated differently for using these rights. We do not knowingly sell or share the data of anyone under 16.
How requests work
- Email support@rockguitarpower.com from the address on your account; that is how we confirm it is you. An authorised agent may ask for you with your signed permission.
- We confirm we received your request within 10 business days and answer within 45 days. If we need longer (up to 45 more days), we tell you why.
- If we say no, you can appeal by replying with the word “Appeal”. We answer appeals within 45 days. If you are still unhappy, you may contact your state attorney general.
- We never charge for a reasonable request.
11. Children and teenagers
The site is for people aged 13 and over, and the quiz asks you to confirm your age. We do not knowingly collect personal information from children under 13. If you are under 18, please ask a parent or guardian before creating an account or taking the quiz; the parent or guardian must be the one who pays. We do not knowingly sell or share the data of anyone under 16, and we do not use the data of anyone under 18 for targeted advertising. If you believe a child under 13 has given us personal information, email support@rockguitarpower.com and we will delete it.
12. How we protect your information
- Everything travels over encrypted connections (HTTPS).
- Passwords are stored only as one-way hashes.
- Our database uses row-level security, so one member’s data is never visible to another.
- The marketing admin area is protected by two-factor login and access is logged. The members-site admin is protected by a strong password, with two-factor login planned.
- Card data never reaches our servers; Stripe and PayPal handle it.
No system is completely secure. If a breach ever affects your personal information, we will tell you and the authorities as the law requires.
13. Where your data lives
Medurik Corporation is based in the United States, and our providers are mostly in the United States. If you use the site from elsewhere, your information is transferred there. For visitors from the UK, EU, and EEA we rely on standard contractual clauses (with the UK addendum for UK data) and, where the provider is certified, the EU-US Data Privacy Framework.
14. Changes to this policy
We may update this policy as the site changes. For changes that matter, we email members and post a notice on the site. Earlier versions are available on request.
This policy is effective October 10, 2026 and was last updated October 22, 2026. It replaces all earlier versions.
Questions?
Email support@rockguitarpower.com. Messages come straight to Mike and are normally answered within one business day. Rock Guitar Power is operated by Medurik Corporation.