Privacy Policy

Learning Bridge LTD is a company registered in England and Wales. We operate the tutoring platform currently trading as Mr Moussally. Our platform connects students with qualified UK teachers for GCSE, IGCSE, and A-level tuition across the UAE and UK.

For data protection purposes, Learning Bridge LTD is the data controller — the organisation responsible for deciding how your personal data is used and stored.

Students:

• Name and email address
• Year group, academic level, subject, and curriculum
• Session attendance, topics covered, and homework completion
• Session notes and progress records

Parents and guardians:

• Name, email address, and phone number
• Linked student details and booking history
• Payment status (not card details — see below)

Tutors:

• Name, email address, and professional details
• Teaching qualification and Teaching Reference Number (TRN)
• DBS certificate status
• Session delivery records and earnings

We do not store payment card numbers. All card data is processed and stored securely by Stripe. It never touches our servers.

Under UK GDPR, we rely on the following legal bases:

• Contract performance (Article 6(1)(b)): to provide the tutoring service — managing bookings, processing payments, tracking academic progress, and sending session confirmations.
• Legitimate interests (Article 6(1)(f)): to improve the platform, send session reminders, and prevent fraud. You may object to processing under this basis at any time (see §8).
• Legal obligation (Article 6(1)(c)): to retain financial records for 7 years as required by HMRC.

We share personal data only with the following trusted service providers, and only to the extent necessary to operate the platform:

• Stripe — payment processing. PCI-DSS compliant. US-based; transfers covered by Standard Contractual Clauses under UK GDPR.
• Resend — transactional email delivery (confirmations, reminders, progress reports).
• Supabase — database and authentication. US-based; transfers covered by Standard Contractual Clauses.
• Vercel — website hosting. US-based; transfers covered by Standard Contractual Clauses.

We never sell, rent, or share your data with third parties for marketing or advertising purposes.

Our platform serves secondary school students aged 11–18. If your child is under 18, a parent or legal guardian must register on their behalf using a parent account. The parent account is the primary account of record for billing and communications.

We do not knowingly collect personal data directly from children under 13 without parental consent. If you believe a child under 13 has registered without a parent account, please contact us immediately at aomar.moussally@gmail.com and we will delete the account.

• Account and progress data: retained while your account is active, then for 3 years after your last session. You can request deletion at any time (subject to legal retention requirements).
• Financial and payment records: retained for 7 years as required by HMRC.
• Session logs: retained for the lifetime of the account; included in any data export you request.
• Unsuccessful tutor applications: retained for 12 months, then deleted.

We use minimal storage on your device:

• Authentication cookie: set by our authentication provider (Supabase) to keep you signed in securely. Essential — the platform cannot function without it.
• Currency preference:stored in your browser's local storage to remember whether you prefer AED or GBP price display. Contains no personal data and is never transmitted to our servers.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data (we will comply except where law requires retention)
• Portability — receive your data in a structured, machine-readable format
• Restriction — ask us to pause processing your data in certain circumstances
• Object — object to processing based on legitimate interests

To exercise any of these rights, email aomar.moussally@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We will notify registered users by email before making material changes to this privacy policy. We will always provide at least 14 days' notice before such changes take effect.

The current version of this policy is always available at this page.