Privacy Policy

Learning Bridge LTD is a company registered in England and Wales. We operate the tutoring platform currently trading as Mr Moussally. Our platform is a marketplace that connects students — from primary school (Years 1–6) through GCSE, IGCSE and A-level — with independent, qualified UK teachers in the UK and worldwide.

For data protection purposes, Learning Bridge LTD is the data controller for the personal data held on the platform — the organisation responsible for deciding how it is used and stored. The teachers who teach through the platform are independent; they see only what they need to teach (section 4A), and their Tutor Agreement requires them to use it only for that and to keep it confidential.

Access from outside the UK. Some of the people who work on the platform, and some of our teachers, are based outside the UK, including in the United Arab Emirates. So your personal data is accessed from outside the UK as well as from within it. It stays stored with the providers in section 4. It is reached only over encrypted connections, each person sees only what their role needs (a teacher sees only the students they teach, section 4A), and teachers must keep it confidential under their Tutor Agreement. We handle it under UK GDPR wherever it is accessed from.

Students:

• Name, email address and, if given, phone number. A child whose parent added them may have a username instead of an email address
• Country (required) and, if given, city. On the sign-up form the country is pre-filled with a suggestion your browser works out from your device's time-zone setting; you can change it before you submit, and only the country you submit is sent to us
• Your device's time zone, read at sign-up so that lesson times are shown in your local time (you can change it later)
• Year group, academic level, subjects, exam board and qualification
• Your school, if you choose to give it. You can pick it from official school lists or type it in. It is optional. We use it to understand which curriculum and exam board you follow, so that lessons can match it. Teachers on the platform do not see it. School lists contain public sector information licensed under the Open Government Licence v3.0 (Department for Education, Welsh Government, Scottish Government, Department of Education Northern Ireland). (the licence)
• A parent's or guardian's name, email address and phone number, if given at sign-up — used to invite the parent to set up their own account
• The invite code used to join (section 4B)
• Session attendance, topics covered, and homework completion
• Session notes and progress records

Parents and guardians:

• Name, email address, and phone number
• Country (required; pre-filled from your device's time-zone setting as above, and you can change it) — used to show prices and to set the currency your lessons are booked in by default
• Your time zone, where your device provides it, so lesson times are shown in your local time
• The invite code used to join
• Linked student details and booking history
• Payment status (not card details — see below)
• Reviews you write (see below)

Tutors:

• Your full legal name, which is private — only Mr Moussally sees it, for your agreement, checks and payouts. Families and your public profile show the name you choose to display (for example ‘Zain Bux’, ‘Mr Bux’ or ‘Zain B.’)
• Email address, phone number (a private contact number only Mr Moussally sees), country, and professional details
• Teaching qualification and Teaching Reference Number (TRN)
• DBS or equivalent criminal-record check status
• Public profile details you choose to publish, such as your photo and biography, and the reviews and testimonials approved for it
• The invite code used to apply, if any
• Session delivery records, earnings and payouts
• Files and links you upload, with a record of who uploaded each one and when

Enquiries, consultations and waiting lists:

• When a family asks for the free consultation: your name, email address, phone number, your child's year group and subject, and anything you choose to tell us about what is worrying you
• When a teacher asks to join: your name, email address, subject and where you teach, and your phone number if you give it
• When you join a waiting list for a course: your name, email address and, if given, phone number

Work your teacher shares (students):

• Work or files a teacher shares with you or uploads for you, which may include your name or your work

Reports about content:

• If you report material, the details in your report (your name, contact details and what you tell us). We may share your report with the teacher concerned, without your contact details unless you agree

Messages between parents and teachers:

• The content of messages sent through the platform, and who sent them and when

Messages are stored on the platform and are not private from us. The platform's owner, Mr Moussally, can open any conversation on the platform, and does so only where necessary to investigate a safeguarding concern, resolve a dispute, respond to a report of misuse, or comply with a legal obligation. We do not read messages routinely and we never use their contents for marketing. We cannot post into a conversation we are not part of, and opening one does not mark it as read for the people in it. New-message notification emails may include a short preview of the message. Students have no access to messaging.

Reviews and testimonials:

• Your star rating and comment, your name, and the teacher and booking the review is about. For a testimonial written through a teacher's link, the email address you give us, if any

We publish a review or testimonial only after we have checked and approved it. A published review shows your first name and the initial of your surname, your rating and comment, and the month — never your surname or your child's name.

Lessons organised outside the platform: where a teacher arranges and is paid for a lesson directly (see section 5A of our Terms of Service), we keep the same lesson, attendance and progress records as for any other lesson, but we do not record the price of the lesson or any payment for it.

Where you heard about us:

• When you send us an enquiry, join a waiting list or create a parent account, we record how you found us: any campaign tags in the web address of the page you are on (such as utm_source=instagram), an advertising click reference if the address contains one (from Google, Meta or TikTok), the name of the website that linked you to that page (for example google.com, never the full address), and your answer to the optional “How did you hear about us?” question

We use this only to understand which of our marketing brings families and teachers to us. Nothing is stored on your device for it: we read it from the page you are on at the moment you press submit, and we do not use cookies or browser storage to remember it.

We do not store payment card numbers. All card data is processed and stored securely by Stripe. It never touches our servers.

What you must give us. The fields a form marks as required are the ones we need to set up your account, answer your enquiry or book lessons. Without them we cannot provide that service. Everything else is optional.

Under UK GDPR, we rely on the following legal bases:

• Contract performance (Article 6(1)(b)): to provide the tutoring service — managing bookings, processing payments, tracking academic progress, and sending session confirmations.
• Legitimate interests (Article 6(1)(f)): to improve the platform, tailor lessons to the curriculum a student's school follows, send session reminders, prevent fraud, keep the platform safe (including moderating messages as described above), record who invited whom, understand which of our marketing brings people to the platform (section 2, “Where you heard about us”), answer enquiries, publish approved reviews, find and fix errors, and keep records of who uploaded, reported and removed material shared by teachers so that we can answer a legal claim (teachers' uploads are also handled under their Tutor Agreement, as contract performance). You may object to processing under this basis at any time (see section 8).
• Legal obligation (Article 6(1)(c)): to keep financial records for at least 6 years, as the law requires.

We share personal data with the following trusted service providers, only to the extent necessary to operate the platform:

• Stripe — payment processing. PCI-DSS compliant. US-based; transfers covered by Standard Contractual Clauses under UK GDPR.
• Resend — transactional email delivery (confirmations, reminders, progress reports).
• Supabase — database and authentication. US-based; transfers covered by Standard Contractual Clauses.
• Vercel — website hosting. US-based; transfers covered by Standard Contractual Clauses.
• Vercel Web Analytics — counts page visits so we can see how the site is used. It sets no cookies and does not identify you.
• PostHog (EU Cloud, Frankfurt) — counts visits to our public pages and which pages lead to enquiries, so we can see what helps families find us. With each visit it receives the page address, the name of the website that linked to it, and any campaign tags or advertising click reference in the link. It stores nothing on your device, does not record your screen, is never used inside student, parent or teacher accounts, and nothing is sent if your browser asks not to be tracked.
• Sentry — error monitoring. When something goes wrong on the site, technical details of the error (such as the page and browser involved) are sent to Sentry so we can fix it. It also receives timing details from a small sample of ordinary page loads, so we can see where the site is slow. No screen recording is used. US-based; transfers covered by Standard Contractual Clauses.
• Wise — used to send teachers their payouts (teachers' payment details only).
• YouTube and Vimeo — some teachers' public profile pages include an introduction video hosted on YouTube or Vimeo. The video does not load until you press play. When you do, it is loaded from YouTube's privacy-enhanced service (youtube-nocookie.com) or from Vimeo with its “do not track” setting on, and that service then receives your IP address and browser details and may store information on your device, under its own privacy policy.

We never sell, rent, or share your data with third parties for marketing or advertising purposes.

Teachers on the platform are independent teachers, not our service providers, but they need some information to teach. A teacher can see a student's details only while they have a teaching relationship with that student: the student is in the teacher's course, has a 1-to-1 booking with them, joined using the teacher's own invite code, or has been linked to them by us. Even then:

• a teacher does not see the student's school, if one was given;
• a teacher sees a student's subject records (scheme of work, progress, homework and lesson history) only for the subjects that teacher teaches — never the student's other subjects;
• Teachers on the platform see your child's first name and the initial of their last name only (for example, ‘Amara H.’); the full name is visible only to you, your child and Learning Bridge's founder, who manages the platform.
• a teacher does not see a parent's surname, email address or phone number, nor the student's own email address or phone number. A parent is shown to them like a student (for example, ‘Sarah H.’), and a teacher contacts the family through the platform's Messages, so they can arrange and run lessons.

We can remove a teacher's access to a student at any time.

Public pages. Reviews and testimonials we have approved are published on the teacher's public page, in the form described in section 2.

If you join using an invite link or code — and students and parents always do, because sign-up is by invitation — we record the code you used, who it belongs to, and whether you joined as a student, a parent or a teacher. We use this to link a student to the teacher who invited them, to understand how people find the platform, and — where we run a referral programme — to work out whether a reward is due. The person who invited you can see that you joined using their link; while a referral programme is running they may also be told whether the milestone for their reward has been reached (for example, that an invited teacher has taught a given number of lessons), but nothing else about you.

Our platform serves students of all school ages, from primary school (Years 1–6, from about age 5) to age 18. A student of any age may create their own account, with an invite code from us or a teacher. A parent or guardian can instead add their child from their own account and look after the child’s login. Where a parent account is linked, the parent can see their child’s lessons and progress.

• Account and progress data: kept while your account is active. We review accounts and delete data we no longer need, and we aim to do so within 3 years of your last lesson. You can ask us to delete it at any time (subject to the legal retention below).
• School: kept with your account and deleted with it.
• Financial and payment records: at least 6 years, as the law requires; we keep them for 7.
• Session logs: kept for the lifetime of the account; included in any data export you request.
• Messages: kept while the related account is active, and afterwards only for as long as needed for the purposes in section 2.
• Enquiries and waiting lists: kept while we are in touch with you about them. We review them and delete the ones we no longer need.
• Unsuccessful tutor applications: we aim to delete them within 12 months.
• Upload, report and removal records: 6 years after the teacher leaves the platform.
• Where you heard about us: kept with the enquiry, waiting-list entry or account it was recorded on, and deleted with it.

We use minimal storage on your device:

• Authentication cookie: set by our authentication provider (Supabase) to keep you signed in securely. Essential — the platform cannot function without it.
• Small preferences in your browser's local storage: the currency used to display prices, the practice questions you have saved in The Exam Room, and whether you have dismissed a notice. They contain no personal data and are never sent to our servers.
• Teacher videos: only if you press play on a teacher's introduction video, YouTube or Vimeo may store information on your device (section 4). Nothing from either loads before you press play.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. Our page-visit counting (Vercel Web Analytics and PostHog, section 4) uses no cookies and stores nothing on your device. We store nothing on your device to record where you heard about us (section 2).

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — ask us to delete your data (we will comply except where law requires retention)
• Portability — receive your data in a structured, machine-readable format
• Restriction — ask us to pause processing your data in certain circumstances
• Object — object to processing based on legitimate interests

To exercise any of these rights, email info@mrmoussally.com. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We will notify registered users by email before making material changes to this privacy policy. We will always provide at least 14 days' notice before such changes take effect.

The current version of this policy is always available at this page. Our Terms of Service explain how lessons, payments and cancellations work.