Privacy Policy

Effective date: November 12, 2026. This policy describes the Zaasna guitar-lesson website and the inquiry form on it. It is written for the site as it actually operates. It is not a claim that a lawyer reviewed it, and it is not a certification under any privacy statute.

Who operates the site

Zaasna offers guitar instruction in Ohio, United States. The public site is https://zaasna.com/. The operator is the person or entity who controls this website and the lesson inquiries it receives.

The contact address is 698 Morrison Rd, Columbus, OH 43213. The meeting place for a lesson is agreed before that lesson. The contact address is not a statement that every lesson is held in that building.

Privacy requests can be sent through the contact form. Put “Privacy request” at the start of the message. The phone number is +1 (614) 655-3901.

What this policy covers

This policy covers information collected on this website: the lesson inquiry form, the session cookie that protects that form, and ordinary server logs created when pages are requested. It covers correspondence that continues from an inquiry, such as a reply about scheduling.

It does not describe a student portal, a mobile app, a payment processor, or an advertising network, because those systems are not part of this website. If a lesson later involves payment, that payment happens outside the site under the terms you and the instructor agree. This policy will be updated if the website itself starts to collect card numbers, government ID, or account passwords. It does not do so now.

The terms and conditions explain the inquiry and lesson relationship. The cookie policy explains the single session cookie in more detail. If those pages disagree with this one about a privacy practice, this policy is the one to follow for personal information, and the pages should be corrected.

Information in an inquiry

The form asks for information the instructor needs in order to answer a lesson request. The fields are:

• Full name of the adult submitting the form.
• Email address.
• Phone number, which may be left blank unless you ask to be called.
• Preferred contact method, email or phone.
• Lesson type, such as beginner, acoustic, electric, or a rate question.
• Experience level, described in broad steps rather than a test score.
• Student age group: adult student, teen with a parent or guardian writing, or child with a parent or guardian writing.
• Preferred lesson format. A preference for live video is stored as a preference. It does not mean video lessons are offered.
• A message about goals, songs, instruments, and general availability.
• A required confirmation that you agree to this policy and that you are the named adult, or the parent or guardian.

The form also contains a hidden field labeled “website.” People using the form as intended leave it blank. Automated submissions that fill it are rejected and are not stored as lesson inquiries. That field is not a marketing question.

You should not include a child’s full name, school, medical information, or exact birth date. The age-group menu is the only age detail the form is built to collect. If you put extra sensitive details in the message, they will be stored with the message because the form saves what you typed. Please don’t add them.

Each stored inquiry includes a reference id, the time it was received in UTC, and a hash of the network address used for rate limiting. The raw network address is not written into the inquiry file. The hash cannot be used as a general location map. It is there so repeated submissions can be limited and so a specific record can be matched if you ask about it.

Students under 18

Some lessons may be for minors. The website does not create accounts for children and does not ask children to submit the form. The parent or legal guardian is the person who inquires, the person whose email and phone are stored, and the person who can ask for access or deletion.

The age-group field exists so the instructor knows the inquiry is about a younger student and so the reply goes to the adult. It is not a profile of the child. If an inquiry appears to come from a child rather than a guardian, it should not be treated as a booking conversation with that child. The practical response is to ask for a parent or guardian, or to delete the submission if a guardian cannot be identified.

Nothing on this site is a social feature. Students cannot post, comment, or upload recordings.

Messages after the inquiry

If you and the instructor continue by email or phone, those messages are correspondence about lessons. They may include scheduling, a quoted rate, and notes about what you want to learn. Keep them limited to what is needed. Do not send government identification numbers, payment card numbers, or a child’s detailed records by email to this business. The website has no secure vault for those items, and this policy does not promise one.

The website does not email the inquiry to anyone. There is no newsletter and no automatic notification. The instructor reads the stored file and, if they reply, writes to the email address or calls the phone number you typed. That later message is ordinary correspondence. It is not produced by a mailer built into this website. Your address is not added to a mailing list.

Technical data and logs

The hosting server may keep standard logs: the requested address, the time, a status code, the browser type, and an IP address. Those logs are a function of running a website. They are used to fix errors, to understand abuse such as form flooding, and to keep the server operating. They are not used to build an advertising profile, because no advertising profile is built.

Server logs may be kept for as long as the host keeps them for operations and security. They are not copied into an advertising system. This policy does not name a log-deletion date the host has not published.

The inquiry file is separate from those logs. It is stored outside the public website directory. The site is also configured to refuse web requests for that storage path. Inquiry files are not a public page.

Cookies

The contact form sets one first-party session cookie named inquiry_session when it requests a security token or when you submit. The static contact page does not set that cookie by itself. The cookie holds a random session id. The server uses that id to remember the security token and when it was issued. The cookie is marked HttpOnly so page scripts cannot read it. It uses SameSite=Lax. It is marked Secure when the request itself was made over HTTPS.

The cookie does not have a long expiration date. It is a session cookie, removed when you close the browser, subject to how that browser treats session restore. The server-side session file is intended to be discardable after about 30 minutes of inactivity. Other pages do not start this session, so visiting the homepage does not set the cookie.

There is no analytics cookie, no advertising cookie, and no cookie from an embedded video or social plugin. Those tools are not installed. Because optional cookies are not used, the site does not show a consent banner that pretends to manage them. The cookie policy explains how to block the session cookie and what the form will do if you do.

Why the information is used

Inquiry information is used to:

• Decide whether the requested lesson is something the instructor can actually teach, including format and general availability.
• Reply by the contact method you selected.
• Keep a record of what was asked, so a later message does not depend on memory alone.
• Protect the form from automated spam and from repeated submissions.
• Respond to a request to correct or delete an inquiry.
• Meet a legal duty if one actually applies, such as responding to a valid legal process. The business does not volunteer inquiry files to marketers.

The site is operated in the United States. Some state privacy laws give residents rights to access or delete personal information. This policy does not claim that a particular state law has been formally assessed for this small site. If you are a resident of a state with those rights, use the contact method below and say which right you are using. The operator should respond to access and deletion requests about inquiry records even without a statute forcing the point, because the records exist to answer you, not to build a database.

Information is not sold. “Sold” here means exchanged for money or shared for cross-context advertising. Neither happens. A hosting company stores the site files and the inquiry file because that is how the site is served. The form does not hand the inquiry to an email provider. Hosting is not treated as a sale.

Hosting

The public site is https://zaasna.com/. Visitors reach it over HTTPS. Cloudflare handles the public connection, and the site files run on the operator’s web server. That host can see the files it stores, including inquiry records, the way a hosting administrator normally can. No other company is given the inquiry to use for advertising.

The form does not send the inquiry through email. No mail password is stored in the site. The confirmation page is shown only after the inquiry file has been written. It says the request was received. A person replies afterward to the email or phone on the form. Sending the form does not reserve a lesson.

No other processors are built into the pages. There is no analytics vendor, tag manager, chat widget, font host, or map. Fonts and photographs are files on this site.

What the site does not do

• It does not create customer accounts or passwords.
• It does not take payment card numbers.
• It does not run ads or retargeting.
• It does not install Google Analytics, Google Tag Manager, or a Meta pixel.
• It does not ask for precise geolocation from the browser.
• It does not record lessons or store audio and video uploads.
• It does not use inquiry text to train a public model. The operator should not paste student messages into a public AI tool.

How long information is kept

Inquiry records are kept so the instructor can reply and so there is a record of what was requested if a lesson is later arranged. The server does not delete them on a timer. If you ask for deletion and the record is not needed for a lesson you still want or for a legal duty, it should be removed from the inquiry files.

Rate-limit files contain only timestamps and are named by a hash. They are kept only to slow repeated submissions. Session files expire with the session described above.

If a lesson relationship continues, ordinary teaching notes kept outside this website, such as a practice list in the instructor’s notebook, are not automatically covered by the website’s file deletion. Ask if you want those notes destroyed as well, and be specific. This policy should not pretend the website controls paper notes it cannot see.

Safeguards

The form is checked on the server. A security token must match the session. Submissions that arrive too fast to be a person reading the form, or that fill the hidden field, are refused. Repeated posts from the same network are limited. Stored text is stripped of markup so a message is saved as text, not as a page that could run in a browser.

These measures reduce spam and some abuse. They are not a promise that a breach is impossible. Hosting accounts should use a current PHP version, HTTPS, and file permissions that keep the storage directory off the public web. If a breach of inquiry data is discovered, the operator should notify affected people as required by applicable law and should not wait for a polished rewrite of this page to do the urgent part.

You can reduce your own exposure by using a current browser, avoiding shared computers for the form, and not putting secrets in the message field.

Access, correction, and deletion

You may ask for:

• A copy of the inquiry records that match your email address.
• A correction, if a name, phone number, or other detail is wrong.
• Deletion of the inquiry, if it is not needed for a lesson you still want or for a legal duty to keep it.

The operator may ask you to confirm that the email address matches the inquiry, so someone else cannot download your message. That confirmation should be proportionate. It should not turn into a demand for identity documents the site never needed.

If a request is refused, the reply should say why in plain language, for example that the record could not be found or that a scheduled lesson still depends on it. If you are in the United States and you believe a state law gives you a right this response missed, say so. The operator should not answer that kind of message with a generic “policy forbids it.”

Children and COPPA

The kids pages are written for parents and guardians. The site does not offer accounts, comments, or uploads to children, and the inquiry form tells the writer to use the adult’s name. The age-group menu records only that the student is an adult, a teen, or a child. It does not collect a child’s name, school, or birth date. The operator does not claim that the site has been reviewed under the Children’s Online Privacy Protection Act, and this paragraph is not a COPPA safe-harbor seal.

COPPA can apply when a site is directed to children under 13 or when the operator knowingly collects personal information from a child. Verifiable parental consent, in the sense used by that rule, can involve methods such as a signed form, a card transaction, or a video call with trained staff. This website does not use those methods, because it is not built to take personal information from the child. The implemented rule is narrower: an inquiry about a minor must come from the parent or guardian, and a submission that appears to come from a child is not treated as a booking with that child. If that design is not enough for the way the kids pages are actually used, the operator should stop collecting the inquiry until an Ohio attorney confirms the right consent step. Do not read this policy as a statement that the question has already been closed.

This section is not a child-protection program. It does not invent staff screening, reporting duties, or facility rules. Guardians who need those answers should ask them directly before agreeing to lessons.

Changes

If the site starts using a new kind of cookie, a new vendor, or a new form field, this policy should be updated before or when that change goes live. The effective date at the top will change. Continuing to browse after a wording change does not, by itself, mean you agreed to a new use of an inquiry you already sent. A new use of an old inquiry that is not required to answer you should not happen quietly.

Older copies of the policy may not remain online. If you need the text that applied when you submitted a form, say the date of the inquiry in your request.

How to reach us about privacy

Use the contact form and begin the message with “Privacy request,” or use the published email or phone if one is listed above. Include the email address you used on the inquiry so the record can be found. You do not need to send the whole original message again.

Please allow a reasonable time for a reply. This policy does not promise a specific number of days, because no staffing level is published here. A request about a child’s information or about information sent in error should be handled first.