1. Overview
Maqam Academy respects your privacy.
This Privacy Policy explains how personal data may be collected and processed when you:
- visit the website
- use interactive maqam tools
- create an account
- use Maqam Academy Free
- subscribe to Maqam Academy Plus or Edu
- make a payment
- contact support
- manage a subscription
- exercise privacy rights
The exact processing depends on the functions you use.
2. Controller
The controller responsible for the processing of personal data is:
Rami Al-Rajab — Maqam Academy / iMaqam Korbinianstraße 61 80807 München Germany
Email:
3. Categories of data
Depending on how Maqam Academy is used, we may process:
- account information
- name or display name
- email address
- encrypted or otherwise protected authentication information
- subscription status
- billing information
- transaction identifiers
- billing country
- communications with support
- technical connection data
- IP address or anonymized IP information where retained by the hosting provider
- browser information
- device information
- operating system
- language settings
- timestamps
- server logs
- security events
- consent preferences
- subscription and cancellation history
- usage information where analytics are enabled
- for completed ordinary Practice sessions, exercise type, difficulty, naming system, question count, verified correct-answer count, score percentage and completion time
- for unfinished ordinary Practice sessions, one resumable checkpoint per exercise for a signed-in user, containing the exercise, session settings, current question position, verified answer/score counts and the server-side current-question state needed to restore that exercise session
- for Edu Student Accounts, class and student-group membership and assigned Practice activities
- for Edu assignments, exercise type, selected difficulty, question count and optional deadline
- for Edu assignment attempts, start and completion timestamps, completion status, verified correct-answer count, total-question count and score percentage
- for Edu v2 assignment Practice, question-level learning records such as the target Maqam or Jins, the selected answer, whether the answer was correct, and relevant Practice context such as direction or tonic where applicable
- for Edu learning progress, assignment completion, score summaries, exercise history and aggregated topic analytics visible to the relevant Educator Account
4. Data that is not normally required
Maqam Academy does not require users to provide sensitive personal information merely to explore maqam theory.
Please do not send health information, government identification documents, financial credentials or other sensitive information unless specifically requested for a legitimate and clearly explained purpose.
5. Website access and server logs
When the website is accessed, the hosting infrastructure may automatically process technical information needed to deliver the website, maintain security and diagnose technical problems.
This can include:
- IP address or anonymized IP information
- date and time
- requested resource
- HTTP status
- browser type
- operating system
- referring page
- technical error information
The legal basis under the GDPR may include our legitimate interests in providing a secure, stable and functional website.
IONOS states that its web-hosting log data are made available for a maximum of eight weeks and that visitor IP addresses in those log files are anonymized. Provider settings and services may change, so the actual hosting configuration remains authoritative.
6. Free use without an account
Parts of Maqam Academy Free may be usable without registration.
Where no account is needed, we seek to limit personal-data processing to information necessary to provide, secure and operate the website plus any optional processing for which an appropriate legal basis exists.
7. User accounts
When you create an account, we may process information required to:
- create the account
- authenticate you
- save account settings
- identify your subscription
- provide Free, Plus or Edu access
- protect the account
- communicate about the account
The GDPR legal basis will normally be performance of a contract or steps requested before entering into a contract.
Security-related processing may also rely on legitimate interests or legal obligations where appropriate.
8. Maqam Academy Plus and EDU subscriptions, classes and learning progress
When you purchase or receive Plus or EDU access, we may process:
- account identifier
- plan
- purchase date
- subscription status
- internal Plus module entitlement codes and status, where applicable
- add-on entitlement source or provider reference where needed to administer the entitlement
- billing period
- renewal date
- cancellation status
- transaction reference
- billing country
- tax-related information where required
- for Edu, institution or organization name
- for Edu, institution type and country
- for Edu, billing email address
- for Edu, organization role, licensed seat quantity and seat-change history
- for Edu, Student Account and invitation information needed to administer educational access
- for Edu, class and student-group membership and assignment information, including optional deadlines
- for Edu Student Accounts, assigned Practice attempts, verified scores, question-level answers, completion status, exercise history and progress summaries
- for Edu, aggregated strong/needs-work topic analysis derived from saved assignment answers where enough answers exist for a meaningful sample
This information is used to provide and administer subscriptions and add-on entitlements, Student Accounts, classes, student groups, assignments, learning history, progress and analytics functions, process payments, maintain accounting records and meet legal obligations.
When an Educator Account assigns an existing Practice exercise to a Student Account, Maqam Academy stores the assignment configuration and the student's verified Practice result so that the student can complete the assignment and the Educator Account can review scores and progress. Edu v2 also stores the verified question-level result for assigned Practice completed after the Edu v2 migration. This can include the target Maqam or Jins, the student's selected answer, whether it was correct, and limited musical context needed for detailed learning history and topic analysis.
The score and question result are calculated from answers verified by the Practice system. Maqam Academy does not need to store microphone recordings or raw audio in order to calculate these assignment scores or analytics. CSV and PDF Edu reports are generated on request from the stored learning records and are not separately retained by the report-generation function itself.
9. Payment processing
Payments and subscription-management functions are processed using Stripe.
Stripe may process payment details, billing information and transaction information under its own privacy terms. Depending on the payment method and transaction, Maqam Academy receives information needed to confirm payment, synchronize subscription status, provide access, manage cancellations and maintain accounting records.
Maqam Academy does not intentionally store complete payment-card numbers or card security codes. Card-entry and payment processing are handled by Stripe through the payment flow.
10. Taxes and accounting
We may retain invoices, transaction records and tax-relevant information for the periods required under applicable tax, commercial and accounting laws.
Where retention is legally required, deletion requests may not require immediate deletion of records that must legally be retained.
11. Contact and support
If you contact us, we process the information you provide in order to answer your request.
This may include:
- name
- email address
- message
- account information
- technical information
- attachments voluntarily supplied
The legal basis depends on the nature of the request and may include contract performance, pre-contractual measures or legitimate interests in responding to inquiries.
12. Cookies and similar technologies
Maqam Academy may use cookies, local storage or similar browser technologies.
Strictly necessary technologies
These may be used where necessary for functions such as:
- login
- authentication
- security
- subscription status
- session management
- language settings
- privacy choices
- checkout functions
Such technologies may not require consent where applicable law permits their use because they are strictly necessary to provide a service expressly requested by the user.
The first-party cookie maqam_analytics_consent is used to remember whether a visitor allowed or declined optional website analytics. It is a privacy-choice cookie, not an analytics identifier. The current consent choice is stored for up to 180 days so the website does not repeatedly ask the same visitor on every page.
Optional technologies
Analytics, advertising, personalization or other non-essential technologies will only be used where an appropriate legal basis exists.
Where consent is legally required, they will not be activated until the user has made the required choice.
Users must be able to withdraw consent as easily as it was given. Maqam Academy provides a Privacy settings link in the website footer for this purpose.
13. Website analytics
Maqam Academy operates optional first-party website analytics for internal service analysis, security review and improvement of the Academy. This analytics feature is not activated until the visitor selects Allow analytics in the privacy banner. Selecting Decline keeps website analytics disabled.
Maqam Academy does not use a separate third-party analytics service such as Google Analytics for this feature, and analytics data is not used for advertising or shared with advertisers.
When website analytics is allowed, Maqam Academy may process:
- a random first-party visit identifier
- country or region information derived from server-side GeoIP information, trusted server country information or browser locale fallback
- browser language
- browser timezone
- the visited website path without URL query parameters
- page-view counts
- active-use time and authenticated-use time
- whether the visit is authenticated
- the Maqam Academy user ID when the visitor is signed in, so authenticated account activity is kept distinct from anonymous activity
The server may use the request IP address transiently when resolving a country through an available GeoIP mechanism. The raw IP address is not stored in the site_activity_visits or site_activity_daily analytics tables by this feature.
After consent, the first-party session cookie maqam_activity_visit may be created. It contains a random identifier and is used to distinguish a browser visit. It is Secure, HttpOnly and SameSite=Lax.
Raw per-visit analytics records are currently retained for up to 90 days. Aggregated daily statistics, such as country-level visit counts, page views and active time, may be retained for longer because they no longer contain the random visit identifier or user ID.
Where consent is the applicable legal basis, website analytics processing is based on the visitor's consent. The visitor may change the choice at any time through Privacy settings. Declining or withdrawing consent stops future website analytics collection and removes the maqam_activity_visit browser cookie. Withdrawal does not by itself require deletion of processing that was lawful before withdrawal.
The consent banner is shown globally until a choice is made, including when a visitor enters Maqam Academy through a page other than the homepage.
14. Advertising
Maqam Academy Free, Plus and Edu are not designed around the sale of user personal data.
If advertising or cross-context behavioural advertising is introduced in the future, this Privacy Policy and the relevant consent or opt-out controls will be updated before such processing begins where required by law.
15. Interactive keyboard, tuner and audio functions
When you interact with the Maqam Academy keyboard, notation, playback system or Live Tuner, the browser may process musical interaction data locally in order to produce visual, tuning or audio feedback.
The Live Tuner is optional. Microphone access is requested only when you activate Listen and the browser grants the requested permission. The incoming microphone signal is used to estimate pitch and update the tuner display.
In the current implementation, this microphone analysis takes place transiently in the browser. Maqam Academy does not intentionally record, store or upload the raw microphone audio to its server, and the tuner does not create a saved recording or practice history.
Stopping the tuner or returning from the tuner to Current Structure stops the active microphone stream. Browser or device permission settings may separately remember whether microphone access was previously allowed or denied.
Ordinary note selections and tuner readings do not need to be associated with a named account unless a feature specifically requires this.
For ordinary non-assigned Practice, Maqam Academy stores a summary when a signed-in user completes a Practice session. The saved summary can include the exercise, difficulty, naming system, Structure Training mode where applicable, question count, verified correct-answer count, score and completion time.
After the user has answered at least one question in an unfinished ordinary Practice session, Maqam Academy can store a resumable checkpoint for that exercise. Different exercises may therefore have separate unfinished checkpoints at the same time. Each checkpoint contains the exercise and session settings, current question position, verified answered/correct counts and the server-side current-question/session state required to restore the same active question instead of generating a replacement. Starting a new session for the same exercise replaces only that exercise checkpoint. The user can discard individual checkpoints from the Practice page. Checkpoints do not store microphone recordings or raw audio and do not record every note played.
Edu assignment Practice uses the separate Edu learning record described above. When a Student Account starts an assigned Practice activity, Maqam Academy stores the assignment attempt, verified score, completion status and related progress. For Edu v2 assignments completed after the v11.0 migration, the system also stores the verified question-level results needed for exercise history and topic analytics.
If future features store or transmit microphone recordings, tuner histories, favourites or other information not described here, this Privacy Policy will be updated to describe that processing.
16. MIDI and hardware access
If Maqam Academy offers optional MIDI-device functionality, compatible browser APIs may be used to receive musical input after the permissions required by the browser have been granted.
Maqam Academy should process only the information necessary to provide the requested MIDI interaction.
Use of MIDI functionality is optional.
If MIDI data are later stored or transmitted to the server, this policy will be updated accordingly.
17. Hosting and local website technology
Maqam Academy is hosted by IONOS SE in Germany.
Fonts, logos, images and videos are stored and served locally. Maqam Academy does not embed YouTube or Vimeo players and does not use social-media plugins.
The current notation implementation uses VexFlow 3.0.9. In the present technical version, VexFlow is loaded from the cdnjs content-delivery network when notation functionality is used. A request to that third-party infrastructure can therefore occur when the notation engine is loaded. Maqam Academy intends to keep third-party technical dependencies limited and this section must be updated if the implementation changes.
18. Recipients
Personal data may be disclosed to service providers where necessary to operate Maqam Academy.
Possible categories include:
- IONOS SE as hosting provider
- Stripe as payment and subscription provider
- email providers
- authentication and security providers where used
- IT service providers
- accounting or tax providers
- professional advisers
- public authorities where disclosure is legally required
Service providers acting as processors will be subject to appropriate contractual safeguards where required.
19. International data transfers
Some service providers may process personal data outside Germany, the European Union or the European Economic Area.
Where GDPR rules apply to an international transfer, we will use an applicable legal transfer mechanism where required.
Depending on the recipient and destination, this may include:
- an adequacy decision
- Standard Contractual Clauses
- another legally recognized safeguard
- a statutory derogation applicable to the specific transfer
Additional safeguards will be considered where required.
20. Retention
We keep personal data only for as long as necessary for the relevant purpose or as required by law.
Typical criteria include:
- duration of the user account
- duration of the subscription
- duration of an Edu workspace, Student Account relationship and the need to provide assignment and progress records
- legal warranty periods
- tax and accounting requirements
- security requirements
- dispute-resolution needs
- consent status
- legal claims
When information is no longer required, it will be deleted or anonymized where appropriate.
21. Security
We use technical and organizational measures appropriate to the nature of the service and the risks involved.
These may include:
- encrypted connections
- access controls
- secure authentication
- restricted administrative access
- software updates
- backups
- logging
- security monitoring
- separation of payment processing from application authentication data
No internet service can guarantee absolute security.
22. GDPR and EEA rights
Where the GDPR applies, users may have rights including:
- access to personal data
- rectification
- erasure
- restriction of processing
- data portability
- objection to processing
- withdrawal of consent
- the right to lodge a complaint with a supervisory authority
Rights depend on the circumstances and legal basis of the processing.
Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.
23. Right to object
Where personal data are processed on the basis of legitimate interests, you may have the right to object to the processing for reasons arising from your particular situation.
Where personal data are processed for direct marketing, you have the right to object to such processing in accordance with applicable law.
24. German supervisory authority
For a private controller established in Bavaria, the competent supervisory authority is generally:
Bavarian State Office for Data Protection Supervision (BayLDA) Promenade 18 91522 Ansbach Germany www.lda.bayern.de
25. United Kingdom
Where UK data-protection law applies, users may have corresponding rights under the UK GDPR and Data Protection Act framework, including rights concerning access, correction, deletion, restriction, objection and portability.
Applicable UK rights remain unaffected by the choice of German law in contractual Terms.
26. California and other US state privacy laws
Residents of California or other US states may have additional privacy rights where the relevant privacy law applies to Maqam Academy.
Depending on the law and whether its statutory thresholds apply, these may include rights to:
- know or access personal information
- correct inaccurate information
- delete personal information
- obtain information in portable form
- opt out of certain sale or sharing
- limit certain uses of sensitive information
- appeal a privacy decision where applicable
- not be discriminated against for exercising privacy rights
Maqam Academy does not claim that a specific state privacy statute applies unless its legal scope and thresholds are met.
27. Sale of personal data
Maqam Academy does not sell personal data for money.
The meaning of “sale” or “sharing” may be broader under some privacy laws than an ordinary monetary sale. If future advertising or data-sharing practices fall within such definitions, this policy and the required user controls will be updated.
28. Children’s privacy
Maqam Academy is an educational platform that may be of interest to students of different ages.
We do not intend to knowingly collect children’s personal information without complying with applicable consent requirements.
Where US COPPA applies to a child under 13, legally required parental notice and verifiable parental consent must be obtained before covered personal information is collected.
Where European data-protection law requires parental authorization because a child has not reached the applicable age for independent consent, the relevant national age rules will be respected.
A parent or guardian who believes that a child has provided personal data without the required authorization may contact:
We will review the request and take appropriate action.
29. Automated decision-making
Maqam Academy does not currently intend to make decisions producing legal or similarly significant effects about users solely through automated processing.
If such processing is introduced, this Privacy Policy will be updated as required.
30. Direct marketing
We may send marketing messages only where permitted by applicable law.
Where consent is required, marketing will be sent only after valid consent.
Users can unsubscribe from marketing communications at any time.
Transactional messages concerning accounts, security, payments, subscriptions or requested services are not necessarily marketing messages.
31. Privacy requests
Privacy requests may be sent to:
We may need to verify the identity of a requester before disclosing, deleting or changing account information.
Verification will be proportionate to the request and information involved.
32. Complaints
You may contact us first if you have a privacy concern.
Where applicable law grants a right to complain to a data-protection authority or regulator, that right remains available.
33. Intellectual-property information
This Privacy Policy governs personal-data processing. Copyright, database rights and conditions concerning Building Rules of Maqam (BRoM), Rules of Related Maqamat (RoRM), Keys X-Ray and other original Maqam Academy material are governed primarily by the Legal Notice and Terms of Use.
Building Rules of Maqam (BRoM) © Rami Al-Rajab is an original theoretical framework conceived and developed by Rami Al-Rajab. Rules of Related Maqamat (RoRM) © Rami Al-Rajab is a separate original theoretical framework. Where Maqam Academy grants permission to reproduce, publish, adapt or otherwise reuse protected BRoM material, the required attribution is:
Rami Al-Rajab — Building Rules of Maqam (BRoM), Maqam Academy, www.maqamacademy.com
Keys X-Ray is a Maqam Academy visualization concept independently developed by Rami Al-Rajab. This Privacy Policy does not create or expand intellectual-property rights; statutory rights and exceptions remain unaffected. Questions about protected Maqam Academy, BRoM, RoRM or Keys X-Ray material are addressed in the Legal Notice and Terms of Use.
34. Changes to this Privacy Policy
We may update this Privacy Policy when:
- Maqam Academy changes
- new service providers are introduced
- subscriptions are launched or changed
- new technologies are introduced
- laws change
- processing activities change
The date of the latest version will appear at the top of the policy.
Where required, users will receive additional notice of material changes.