Privacy Policy
GMI Premium — gmipremium.com
Last updated: 28 July 2026
1. Who we are
Guitar And Music Online Learning Ltd., company number SC465953, is the data controller for the personal data described in this policy. We are a company incorporated under the law of Scotland.
Registered address: 109/14 Swanston Road, Edinburgh, Scotland, EH10 7DS
Contact for privacy matters: info@gmipremium.com
ICO registration number: ZB230803
2. The short version
- We collect what we need to run your account, take your payment, and make the platform work.
- We do not sell your personal data. We never will.
- We do not track you across other websites, and we do not run advertising.
- We use a number of third-party services to operate — hosting, payments, email, AI. They are all named in section 6.
- When you use Ask Thomas Balfour, what you type is sent to Anthropic in the United States, and a copy is kept on our own database. Section 7 explains this.
- We study how the platform is used in aggregate to improve it, and may share anonymised insights with third parties. Individual data is never shared. Section 12 explains this.
- You have rights over your data, including the right to a copy and the right to deletion. Section 10 tells you how.
The rest of this policy is the detail.
3. What personal data we collect
You give us:
| Data | When |
|---|---|
| First name, last name, username, email address, password | On registration |
| Billing name, billing address, country | At checkout |
| Payment card details | At checkout — handled by our payment provider, never stored by us |
| Questions and text you type into AI features | When you use Ask Thomas Balfour or similar |
| Posts, replies and profile information | When you use the community |
| Chord charts, progressions, sketches, practice records and other saved work | As you use the applications |
| Support messages | When you contact us |
We collect automatically:
| Data | Why |
|---|---|
| IP address | Security, fraud and abuse prevention, spam filtering |
| Browser and device type, screen size | Making the platform work on your device |
| Pages visited, features used, session timing | Understanding what works and what doesn’t |
| Login times and authentication events | Account security |
We do not collect special category data — health, race, religion, political opinion, sexual orientation, biometrics — and you should not send it to us.
4. Where we get data from other sources
Our sign-in page offers you the option of signing in with a Google account. If you use it, we receive your name and email address from Google to create or match your account.
The Google sign-in component loads on our sign-in and registration pages whether or not you use it, which means Google receives your IP address when you visit those two pages. It is not present anywhere else on the site.
5. Why we use your data, and our legal basis
UK GDPR requires us to have a lawful basis for each use. Here they are.
| What we do | Legal basis |
|---|---|
| Create and run your account | Performance of a contract |
| Give you access to the tier you have paid for | Performance of a contract |
| Take payment and manage renewals | Performance of a contract |
| Save and show you your own work | Performance of a contract |
| Send service emails — receipts, renewal reminders, password resets, security notices | Performance of a contract |
| Keep accounting and tax records | Legal obligation |
| Respond to your support requests | Performance of a contract, or legitimate interests |
| Protect the platform from fraud, abuse, bots and attack | Legitimate interests |
| Understand how the platform is used so we can improve it | Legitimate interests |
| Produce aggregated, anonymised insights (section 12) | Legitimate interests |
| Keep and review AI conversations for moderation and quality (section 7) | Legitimate interests |
| Send marketing emails about GMI | Consent, or the soft opt-in for existing customers |
| Provide AI-assisted answers | Performance of a contract |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and concluded it is not. You can object at any time — see section 10.
Where we rely on consent, you can withdraw it at any time without affecting anything done before you withdrew it.
6. Who else processes your data
We use the following providers. Each acts on our instructions under a contract.
Infrastructure
| Provider | What they do | Where |
|---|---|---|
| IFDNRG Ltd | Web hosting and email hosting | United Kingdom |
| Cloudflare, Inc. | Traffic routing, security, DDoS protection, and bot verification on our forms (Turnstile) | Global network, US company |
| Google LLC (reCAPTCHA) | Bot and fraud protection on our checkout page only | United States |
| Bunny.net (BunnyWay d.o.o.) | Content delivery — video, audio, images, application files, typefaces | Global network, Slovenian company |
| Supabase, Inc. | Database for application data, saved work and AI conversation records | European Union (EU West) |
| Defiant, Inc. (Wordfence) | Firewall, malware scanning, blocking of malicious IP addresses | United States |
Payments and commerce
| Provider | What they do | Where |
|---|---|---|
| SureCart | Subscription and checkout management | United States |
| Stripe | Card payment processing | Ireland / United States |
| PayPal | Alternative payment method | Luxembourg / United States |
Communication
| Provider | What they do | Where |
|---|---|---|
| MailerLite (UAB Mailerlite) | Marketing email, list management | Lithuania (EU) |
Platform features
| Provider | What they do | Where |
|---|---|---|
| Anthropic PBC | AI processing for Ask Thomas Balfour and related features | United States |
| Google LLC | Sign-in authentication, where you choose to sign in using your Google account | United States |
| Plausible Analytics | Website statistics, collected without cookies | European Union |
| Google (Drive) | Off-site backup storage | United States |
Forms. Our contact form is provided by Contact Form 7, which runs on our own server and emails submissions to us rather than storing them in a database. What you send us is covered by “support correspondence” in section 9.
Books. Book purchases are handled by our separate shop, which uses its own providers and its own privacy policy. This policy does not cover them.
Typefaces. The typefaces used on this site are served from our own content delivery network, not from a third party. Loading a page does not disclose your visit to any font provider.
7. Ask Thomas Balfour and AI features
This section matters, so it is set out plainly.
What happens. When you type a question into an AI feature, that text is sent over the internet to Anthropic PBC, a company based in the United States, which processes it and returns an answer.
What we send to Anthropic. The text of your question, and enough context about which application you are using for the answer to make sense. We do not send your name, your email address or your account details.
What Anthropic does with it. Anthropic’s commercial terms — which are the terms we operate under — state that customer inputs and outputs are not used to train their models. Their published commercial retention policy is that inputs and outputs are automatically deleted within 30 days. If a session is flagged by their automated safety systems, they may retain it for up to two years, and safety classification scores for up to seven years.
What we keep on our own systems. We keep a record of each exchange in our own database, held in the European Union. That record contains your question, the answer given, the topic, which application you were using, a session identifier, and — so that we can connect it to your account — your user ID and the email address on your account.
Why we keep it. Three reasons, and no others:
- Moderation. Questions are reviewed before anything is published, and we need to be able to act on abuse or misuse.
- Quality. Reviewing real questions and answers is how we find out where Thomas is wrong, where the platform is confusing, and what to explain better.
- Publication. See below.
Questions may be published to the community. We select good questions and publish them, with an answer, in our community area so that other members can learn from them. Nothing is published automatically. Every question is read by a person first, and only some are chosen. Published questions appear anonymously — your name, username and email are never shown, and the question is not attributed to you.
Please don’t put personal information into it. Don’t enter your own or anyone else’s name, contact details, health information or anything confidential. There is no reason to, it travels further than the rest of your data, and it may be read by a person during review.
How long we keep it. AI conversation records are kept for 24 months, after which they are deleted. Questions that have been published to the community remain published unless you ask us to remove them.
If you want yours removed. Email info@gmipremium.com. We will delete your conversation records, and remove any published question of yours from the community, on request.
The answers can be wrong. Clause 7 of our Terms explains this.
8. Sending data outside the UK
Some of our providers are outside the UK. Where that happens, the transfer is protected by one of:
- the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it
- the UK International Data Transfer Addendum to the EU Standard Contractual Clauses
- UK adequacy regulations, where the country has been formally recognised — this covers our EU-based providers
You can ask us for details of the safeguards applying to any specific transfer.
9. How long we keep your data
| Data | Retention |
|---|---|
| Account details | While your account is open |
| Inactive free accounts | Closed and deleted after 24 months without sign-in, with 30 days’ warning — matches clause 24 of the Terms |
| Saved work and library content | While your account is open, or until you delete it |
| Data after a membership ends | Kept for 90 days in case you resubscribe, then deleted |
| Payment and transaction records | 6 years from the end of the relevant financial year — legal obligation |
| Marketing list membership | Until you unsubscribe |
| Support correspondence | 2 years from resolution |
| Security and access logs | 12 months |
| AI conversation records | 24 months from the date of the exchange |
| Backups | Rolling — overwritten in the ordinary cycle, typically within 30 days |
When you ask us to delete your data, we remove it from the live systems promptly. Copies may persist in backups until those backups are overwritten in the normal cycle.
10. Your rights
Under UK data protection law you have the right to:
- be told how your data is used — this document
- get a copy of the data we hold about you
- have mistakes corrected
- have your data deleted, where we have no overriding reason to keep it
- restrict how we use it while a concern is being resolved
- take your data elsewhere in a portable format
- object to processing based on legitimate interests
- object to direct marketing at any time, absolutely and without exception
- withdraw consent where consent is what we relied on
How to exercise them. Email info@gmipremium.com, or use our data deletion request page at gmipremium.com/data-deletion-requests/.
We will respond within one month. There is no charge. We may need to verify your identity first.
11. Marketing
We will send you marketing email only where you have agreed, or where you are an existing customer and the message is about similar products — which the law permits, subject to your right to opt out.
Every marketing email has an unsubscribe link. Unsubscribing stops marketing but not service emails such as receipts, renewal notices and security alerts, which we must send you.
Double opt-in. When you join a mailing list through our site, we send you a confirmation email and only add you once you click the link in it. This means nobody can be added to our list using someone else’s address.
Registering an account does not subscribe you to marketing. If you want our emails, you choose to receive them.
12. Aggregated and anonymised insights
We study how the platform is used across all members so that we can improve it, and so that we can understand things about how guitarists learn.
Where we produce insights from this, they are aggregated and anonymised — combined across many people so that no individual can be identified. We may publish these insights, or share them with third parties such as researchers, educational institutions or instrument manufacturers.
Our commitments:
- We will never sell your personal data
- We will never share data that identifies you individually with a third party for their own purposes
- Aggregated groups will always be large enough that no individual can be picked out of them
- You may object to your usage data being included, and we will exclude it
The legal basis is legitimate interests. Once information is genuinely anonymised it is no longer personal data and data protection law no longer applies to it — but the process of getting there is covered by this policy, which is why it is set out here.
13. Cookies and similar technologies
We use cookies and similar technologies for:
- Strictly necessary purposes — keeping you signed in, remembering your basket, and protecting your account and our payment process. These do not require your consent.
- Functional purposes — remembering your display preferences.
Bot protection. Most of our forms are protected by Cloudflare Turnstile, which sets no cookies and does not analyse your behaviour.
Our checkout page is different. Because it takes payments, it is additionally protected by Google reCAPTCHA v3. Unlike Turnstile, reCAPTCHA looks at how you interact with the page in order to tell a person from an automated script, and it sets cookies to do so. We use it to prevent card testing and fraudulent orders, which protects both you and us, and we rely on it as strictly necessary for that purpose. It runs on the checkout page only and nowhere else on the site.
What we do not do. We do not use advertising or cross-site tracking cookies. We do not allow third parties to advertise to you on our site. Our website statistics are collected without cookies and do not identify you.
14. Security
We protect your data with encryption in transit, access controls, two-factor authentication on administrative accounts, a web application firewall, and regular off-site backups held in access-controlled storage.
No system is completely secure. If a breach occurs that is likely to put your rights at risk, we will tell you and the Information Commissioner’s Office as the law requires.
15. Children
The Service is for people aged 16 and over, matching clause 4 of our Terms. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
16. Changes to this policy
We may update this policy. The date at the top always shows the last revision. If we make a change that materially affects how we use your data, we will email registered members at least 30 days in advance.
17. Complaints
If you are unhappy with how we have handled your data, contact us first at info@gmipremium.com and we will try to put it right.
You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 ico.org.uk
