Privacy Notice

Steven Solomon Music LLC (d/b/a Piano By Steven) Effective / Last Updated: August 16, 2026 This Privacy Notice explains how Steven Solomon Music LLC ("Piano By Steven," "we," "us," or "our") collects, uses, discloses, and retains personal information when you visit pianobysteven.com (the "Site"), inquire about or book live music services, purchase from us, or otherwise interact with us (collectively, the "Services"). This Notice also serves as our Notice at Collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), and reflects the CCPA regulations that took effect January 1, 2026. Quick links:Your Privacy Choices · Cookies & Tracking Technologies · California Rights · Contact Us

1. Summary — What We Collect and Why

The table below is our Notice at Collection. It lists the categories of personal information we collect, why we collect them, how long we keep them, and whether they are "sold" or "shared" as those terms are defined under the CCPA.

Category (CCPA) Examples Why we collect it Retention Sold? Shared for cross-context behavioral advertising? Identifiers Name, email address, phone number, mailing address, IP address, device and browser identifiers, cookie IDs, account or order number Respond to inquiries, prepare quotes and contracts, deliver performances, process payments, send service and marketing messages, site security Inquiries: 3 years from last contact. Contracts, invoices, and tax records: 7 years. Marketing list: until you unsubscribe, plus a permanent suppression record of your email so we do not re-add you No Yes — advertising and analytics identifiers only, and only where you have consented Customer records / commercial information Event date, venue, event type, guest count, song requests, service selected, booking and purchase history, deposits and balances paid Quote, contract, staff, and perform the engagement; accounting; dispute resolution 7 years No No Internet or other electronic network activity Pages viewed, referring URL, links clicked, time on page, form interactions, approximate session information Measure site performance, understand which pages generate inquiries, advertising measurement, fraud prevention Up to 26 months in analytics tools; cookie lifespans as disclosed in Section 5 No Yes — where you have consented Approximate geolocation City/region inferred from IP address Route inquiries to the correct market (Los Angeles or Chicago), regional ad delivery, fraud prevention Same as analytics data above No Yes — where you have consented Audio, electronic, visual information Photos and video from performances; recordings you send us; voicemail Fulfill the engagement; promotional use only where separately permitted by contract or your consent Until you ask us to stop using them, subject to copies already published by third parties No No Inferences Advertising audience or interest segments created by ad platforms from Site activity Ad targeting and measurement Controlled by the ad platform; see Section 5 No Yes — where you have consented Sensitive personal information We do not intentionally collect sensitive personal information. Booking details you volunteer (for example, a bar or bat mitzvah, a religious ceremony, or a wedding) may reveal religious or family information Solely to plan and perform the event you booked Same as customer records No No

We use any sensitive personal information you volunteer only for purposes the CCPA permits without a right to limit (performing the service you requested). We do not use it to infer characteristics about you, and we do not disclose it for advertising.

We do not knowingly collect personal information from anyone under 16, and we do not sell or share the personal information of consumers we know to be under 16.

Automated decisionmaking: We do not use automated decisionmaking technology to make significant decisions about you, and we do not use your personal information to train automated decisionmaking technology.

2. Where We Get Your Information

‍ ‍Directly from you — inquiry and contact forms, email, phone or text, contracts, checkout, event questionnaires, newsletter sign-up. Automatically from your device — cookies, pixels, tags, SDKs, and server logs, as described in Section 5. From service providers and platforms — our website host, payment processor, email platform, and advertising and analytics providers. From third parties you engage with — planners, agencies, venues, or hosts who book us on your behalf; social media platforms where you interact with our profiles or click our ads. From booking marketplaces — when you request a quote or contact us through a third-party marketplace where we maintain a profile, including GigSalad, The Bash, and Thumbtack, that marketplace sends us your name, contact details, and the event details you entered. We receive that information as an independent business, not as a service provider to the marketplace. The marketplace's own collection and use of your information is governed by its privacy policy, not this one. We use marketplace inquiries to respond to and fulfill your request, and we do not add marketplace contacts to our marketing list unless you separately opt in.

3. How We Use Personal Information

Respond to inquiries, provide quotes, and negotiate and perform engagements Process payments, deposits, refunds, and chargebacks Send transactional and administrative messages (confirmations, schedule changes, invoices, policy updates) Send marketing and promotional messages where you have opted in, including email and SMS if you have subscribed Measure and improve the Site, our content, and our advertising Advertise our services, including retargeting and measurement, where you have consented Maintain security, prevent fraud and abuse, and debug errors Comply with law, tax and accounting obligations, and to establish or defend legal claims We will not use your personal information for a materially different, unrelated, or incompatible purpose without first providing notice.

4. How We Disclose Personal Information

We disclose personal information to the following categories of recipients:

Recipient category Examples Purpose Website host and e-commerce platform Squarespace Hosting, forms, commerce, first-party analytics Payment processors [CONFIRM: Squarespace Payments / Stripe / Square / PayPal / Venmo] Payment processing and fraud prevention Email and messaging platforms [CONFIRM: Squarespace Email Campaigns / Klaviyo / Mailchimp] Sending transactional and opt-in marketing messages Analytics providers Google Analytics, Squarespace Analytics Site measurement Advertising platforms Meta Platforms (Facebook and Instagram), Google (Google Ads) Advertising delivery and measurement Embedded media providers YouTube / Google LLC Playing the performance videos embedded on our pages Consent management provider Ketch Collecting and recording your privacy choices Professional advisors Accountants, attorneys, insurers Legal, tax, and risk management Marketing and SEO vendors Ranked AI Website content, technical optimization, and search performance reporting; access to site analytics and site administration Subcontracted performers and vendors Additional musicians, sound technicians Delivering your event Booking marketplaces GigSalad, The Bash, Thumbtack Communicating with you about an inquiry you submitted there, and platform-required booking and review workflows Widget and embedded content providers Elfsight, GigSalad, The Bash, Yelp, YouTube Displaying reviews, ratings, feeds, and video on our pages Legal and successor recipients Law enforcement, courts, an acquirer in a merger or sale Legal compliance; business transfer

We do not sell personal information for money. However, when advertising and analytics technologies are active on the Site with your consent, the resulting disclosures of identifiers and browsing activity to those platforms may qualify as "sharing" for cross-context behavioral advertising — and, in some cases, as a "sale" — under the CCPA's broad definitions. We treat those disclosures as sale/sharing and give you the right to opt out of them at any time. See Your Privacy Choices.

<a id="cookies"></a>

5. Cookies and Tracking Technologies

Please read this section carefully. It describes the technologies on this Site, what they transmit, and how you control them. Our Site uses cookies, pixels, tags, web beacons, software development kits (SDKs), local storage, and similar technologies (collectively, "Tracking Technologies"), including technologies operated by third parties. What they collect and transmit. When active, these technologies may collect and transmit to us and to the third-party providers listed below: your IP address; device, browser, and operating system information; cookie and advertising identifiers; the URL of the page you are viewing; the referring URL; links and buttons you click; approximate location derived from your IP address; and the date and time of your visit. Some of this is routing, addressing, and signaling information generated by your browser when it requests content. Categories we use:

Category What it does Fires before consent? Strictly necessary Site delivery, security, load balancing, shopping cart, fraud prevention, and recording your privacy choices Yes — required for the Site to function Analytics / performance Measures traffic, page performance, and which pages generate inquiries No — only after you consent‍ ‍Advertising / targeting Retargeting, conversion measurement, and audience building by ad platforms No — only after you consent‍ ‍Functional / embedded media Embedded YouTube video, social feeds, review widgets, and booking widgets No — only after you consent‍ ‍

Third-party providers of Tracking Technologies on this Site:

• Google LLC — Google Tag Manager (the container through which several of the technologies below are deployed), Google Analytics, Google Ads, and YouTube embedded video

• Meta Platforms, Inc. — Meta Pixel, and any embedded Instagram or Facebook content

• Elfsight — the widget platform that delivers review, feed, and content widgets on our pages

• GigSalad, The Bash, and Yelp — live profile, review, and rating widgets displayed on our pages

• Squarespace, Inc. — hosting, commerce, forms, and first-party site analytics

• Ketch — consent management and recording your privacy choices

• Our SEO and marketing vendor — heatmap and on-site engagement measurement used to understand how visitors move through our pages

Widgets supplied through Elfsight may in turn load content and set identifiers from the underlying platform whose content they display (for example, Google, Yelp, or Instagram). All of these widgets are treated as Functional / embedded media and are blocked until you consent.

Heatmaps and session measurement. Where enabled, we use tools that record general on-page engagement — such as scroll depth, where visitors click, and how far they get through a page — so we can improve page layout and content. These tools are configured to mask text you type into forms, including your name, email address, phone number, and event details, so that the contents of what you enter are not captured. We do not use session recording to read your form entries or messages. These tools are treated as Analytics and are blocked until you consent. These providers may act as our service providers or, for advertising purposes, as independent third parties that use the data for their own purposes as described in their own privacy policies.

Your consent and how to withdraw it. When you first visit the Site from a location where consent is required, we present a consent banner. Non-essential Tracking Technologies — including all analytics, advertising, and third-party embedded media technologies — are blocked and do not load, transmit, or receive any information until you affirmatively consent. By selecting "Accept" or by enabling a category in our preference center, you give your express prior consent to the installation and use of the technologies in that category, including the transmission of the information described above to the listed third parties for the stated purposes, including advertising.

You may change or withdraw your consent at any time — with no effect on your ability to use the Site or our Services — by:

• Opening our preference center at Your Privacy Choices (also linked in the footer of every page);

• Enabling a browser or extension-based opt-out preference signal, such as Global Privacy Control (GPC), which we honor automatically as a request to opt out of sale/sharing for that browser (see Section 8); or

• Blocking or deleting cookies in your browser settings, and using platform-level controls such as Google's Ads Settings and Meta's Ad Preferences.

Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

6. Retention

We keep personal information only as long as reasonably necessary for the purposes described in this Notice, using the criteria and periods in the table in Section 1. Where a period is not stated, we retain the information for as long as needed to provide the Services and then for the length of the applicable statute of limitations plus any period required by tax, accounting, or other law. We then delete, de-identify, or aggregate it.

<a id="california-rights"></a>

7. Your California Privacy Rights

If you are a California resident, you have the following rights under the CCPA. We honor these rights as a matter of policy whether or not we meet the CCPA's applicability thresholds in any given year. Right to know / access — the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclosed it (covering the 12-month period preceding your request, or a longer period if you ask and it is not impossible or disproportionate for us to provide). Right to delete — subject to legal exceptions such as completing a booking, keeping tax records, security, and legal claims. Right to correct — inaccurate personal information we maintain about you. Right to opt out of sale or sharing — including cross-context behavioral advertising. See Your Privacy Choices. Right to limit use and disclosure of sensitive personal information — we do not use sensitive personal information for purposes that trigger this right, so no separate link is required. Right to non-discrimination and no retaliation — we will not deny you services, charge you a different price, or provide a different level or quality of service because you exercised a privacy right.

How to submit a request

You may submit a request using either of these methods: Email: steven@pianobysteven.com with the subject line "California Privacy Request" Web form: [INSERT REQUEST FORM URL — e.g., pianobysteven.com/privacy-request] (a Squarespace form is sufficient)

Verification

To protect your information, we will verify your request by matching at least two data points you provide (for example, the email address and phone number you used to contact or book us) against our records, and by asking you to confirm from that email address. For deletion requests and for requests for specific pieces of personal information, we may ask for additional confirmation. We will not ask you to create an account to make a request, and we will only use information you provide for verification to verify your identity and respond.

Authorized agents

You may use an authorized agent to submit a request. The agent must provide written, signed permission from you, and we may contact you directly to confirm the authorization and verify your identity. If the agent holds a valid power of attorney under California Probate Code sections 4000–4465, we will not require separate confirmation from you.

Our response

We will confirm receipt within 10 business days and respond substantively within 45 calendar days. If we need more time, we will tell you within that 45-day window and may take up to another 45 days. Requests to opt out of sale/sharing are honored within 15 business days. There is no charge unless a request is manifestly unfounded or excessive, in which case we will explain why before proceeding.

Other California disclosures

‍ ‍Shine the Light (Cal. Civ. Code § 1798.83): We do not disclose personal information to third parties for their own direct marketing purposes. You may request confirmation of this once per year at the contact address above. Minors (Cal. Bus. & Prof. Code § 22581): If you are a California resident under 18 and registered with the Site, you may request removal of content you posted publicly. Removal may not be complete or comprehensive.

8. Opt-Out Preference Signals (Global Privacy Control)

We recognize and honor opt-out preference signals, including Global Privacy Control (GPC). When we detect a valid signal from your browser or extension, we treat it as a request to opt out of the sale and sharing of personal information associated with that browser or device, and we disable advertising and targeting Tracking Technologies for that session. Because the signal is tied to a browser or device rather than to you personally, it does not carry over to other browsers or devices, and it does not by itself identify you for purposes of other rights requests. If you would like the opt-out applied to your identified profile with us, contact us using the methods in Section 7.

<a id="privacy-choices"></a>

9. Your Privacy Choices

‍ ‍Manage cookies and tracking: open our Privacy Choices / Cookie Preferences center, linked in the footer of every page. Do Not Sell or Share My Personal Information: use the same preference center, or email steven@pianobysteven.com with the subject line "Do Not Sell or Share." Marketing email: click "unsubscribe" in any marketing message, or email us. We honor unsubscribes promptly and keep a suppression record so you are not re-added. Text messages: reply STOP to any message.

10. Residents of Other U.S. States

If you live in a state with a comprehensive consumer privacy law — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, or others as they take effect — you may have rights to access, correct, delete, and obtain a portable copy of your personal data, to opt out of targeted advertising and the sale of personal data, and to appeal a denial of a request. Use the same request methods in Section 7. If we deny your request, you may appeal by replying to our response with the word "Appeal"; we will respond to the appeal within 45 days and will tell you how to contact your state attorney general if you disagree with the outcome.

11. International Visitors

We are based in the United States and process personal information here. If you access the Services from outside the U.S., you understand that your information will be transferred to and processed in the U.S., which may have different data protection rules than your home country. Where the EU or UK GDPR applies to a specific engagement, our lawful bases are: performance of a contract (delivering services you request), consent (marketing and non-essential cookies), legitimate interests (site security, fraud prevention, and service improvement), and legal obligation (tax and accounting).

12. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the size of our business and the sensitivity of the information, including access controls, encryption in transit, use of reputable processors, and limiting who can access booking and payment records. No system is perfectly secure, and we cannot guarantee absolute security.

13. Accessibility and Alternative Formats

We aim to make this Notice accessible to people with disabilities. If you use assistive technology and have difficulty accessing this Notice, or if you would like a copy in an alternative format, contact us at steven@pianobysteven.com and we will provide one at no charge.

14. Changes to This Notice

We review this Notice at least annually and update it when our practices or the law change. When we update it, we will revise the "Last Updated" date above. Material changes will be communicated through a notice on the Site and, where appropriate, by email.

15. Contact Us

Steven Solomon Music LLC d/b/a Piano By Steven 12400 Ventura Blvd., #662 Studio City, CA 91604 United States Email: steven@pianobysteven.com

Appendix A — Short Notice at Collection (for use on forms and at checkout)

Place this text, or a link to it, at or before the point where you collect information on any form: Notice at Collection. We collect your name, contact details, and event details to respond to your inquiry, provide services, and — if you opt in — send marketing. We also collect device and site-activity information through cookies and similar technologies. We do not sell your information for money; with your consent, we share advertising identifiers and site activity with advertising platforms for cross-context behavioral advertising, which you can turn off at any time. Retention periods, the full list of categories, and your California rights are described in our Privacy Notice.