Privacy Policy

1. Who we are (data controller)

The data controller responsible for your personal data is 8BM, United Kingdom (trading as 8Billionminds). Our Platform is operated from the United Kingdom. UK GDPR and the Data Protection Act 2018 apply to our processing. Where the EU GDPR applies to our processing of personal data of individuals in the European Economic Area (EEA), we comply with those requirements as well.

Privacy contact: hello@8billionminds.com (consistent with our Terms & Conditions).

Registered company details: our full legal entity name, company registration number and registered office address will be published here following completion of our legal review. Until then, you may request these details by emailing hello@8billionminds.com.

EU representative: where we are required under EU GDPR to appoint a representative in the EU, we will publish their contact details on this page.

Supervisory authority (UK): the Information Commissioner’s Office (ICO) — ico.org.uk.

2. Scope and minimum age

This policy applies to visitors and registered members who use the Platform online. Our Terms & Conditions require you to be 16 years of age or older to register and use the service as a member. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will take appropriate steps to delete it.

3. Personal data we collect

Depending on how you use the Platform, we may process:

• Account and profile data — name, email address, password (stored in hashed form), time zone, town/location fields, profile photo, “about me”, qualifications, availability, subjects you teach or want to learn, and related profile settings.
• Authentication data — if you sign in with Google or LinkedIn, we receive information from that provider (such as name, email and provider user id) as permitted by your settings with them.
• Lesson and learning activity — lesson requests, scheduled times, subjects, messages linked to lessons, whiteboard/session metadata, completion records, duration, and related notifications.
• Reviews and feedback — ratings and comments you give or receive about completed lessons.
• Disputes — dispute reasons, descriptions, outcomes, and related lesson and payment identifiers where relevant.
• Payments — for paid lessons, Stripe processes payments; we store references such as payment identifiers and lesson payment status. We do not store full card numbers on our servers.
• Communications — messages between members, support or contact enquiries, and email notification preferences.
• Technical and usage data — IP address, browser type, device information, dates/times of access, pages viewed, and similar log data (IP addresses are personal data under UK/EU GDPR).
• Security and fraud prevention — session identifiers, activation/verification codes, and records of sign-in activity where needed to protect the Platform.

Public profile pages

Members. When you create a member profile, much of the information you choose to add may be visible to other logged-in members. Depending on what you enter, this can include your display name, profile photo, “about me”, town or area, time zone, subjects you teach or want to learn, availability, aggregated lesson statistics, reviews, and optional links (for example social or website URLs).

Public pages, visible to anyone. If you offer subjects to teach or share, we may publish a public page for you that anyone can see, including people who are not logged in and search engines such as Google. We may also show a short version of your details on public subject pages (for example “Learn Spanish”). These public pages show only:

• your first name and the first letter of your surname (for example “Alex M.”);
• your profile photo;
• your town or city;
• the subjects you offer, with your level, your price (or that the lesson is free) and your own description of each subject; and
• your “about me” text.

Public pages do not show your full surname, email address, date of birth or age, exact location or postcode, links to social media or websites, qualifications, education or employer, or payment details. We try to remove email addresses, web addresses and phone numbers from the text you write, but we cannot detect everything, so please do not put information in your “about me” text or subject descriptions that you are not willing to make public. Search engines and other websites may keep copies of public pages for some time after we change or remove them.

We publish these pages because they help learners find teachers, which is part of running the Platform (legitimate interests; see section 4). You can ask us to remove your public page, or object to it, at any time by emailing hello@8billionminds.com, and we will remove it promptly. Your public page is also removed if you delete your account or turn off “accepting requests” in your account settings.

Your registration email address and password are never displayed on public profiles. See also section 7 of our Terms & Conditions.

4. How we use data and lawful bases

We use personal data to:

• provide the Platform, match learners and teachers, and deliver lessons (contract / steps prior to contract);
• process payments and payouts via Stripe where applicable (contract and legal obligation);
• handle disputes, enforce our Terms, and protect members (legitimate interests and legal obligation);
• send service emails and notifications you expect as part of using the Platform (contract / legitimate interests);
• improve security, prevent abuse, and maintain logs (legitimate interests and legal obligation);
• show limited public teacher pages, so that learners and search engines can find teachers (legitimate interests; you can object at any time, see “Public profile pages” above); and
• comply with accounting, tax and regulatory requirements (legal obligation).

Where we rely on consent (for example, for non-essential cookies or certain marketing if offered), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Simply browsing or using the Platform does not replace valid consent where consent is required by law.

5. Cookies and similar technologies

We use cookies and similar technologies for strictly necessary functions (such as keeping you signed in) and, where you agree, for analytics and measurement (for example via Google Tag Manager / Google Analytics as configured). We do not use third-party advertising cookies such as Google DoubleClick DART, and we do not serve third-party display ads on the Platform.

On our public pages, a cookie consent banner lets you accept or reject non-essential cookies before they are set. You can change your choices at any time via the banner or your browser settings. For more information about Google’s practices, see Google’s Privacy Policy.

6. Sharing and processors

We share personal data only as needed to run the Platform, including with:

• Stripe — payment processing and connected accounts for tutors (Stripe Privacy Policy).
• Google — optional sign-in and, if you consent, analytics/tag management.
• LinkedIn — optional sign-in.
• Hosting and infrastructure providers — who store and run the Platform on our behalf under contract.
• Other members — information you choose to make visible on your profile or in lessons, messages and reviews.

We require processors to protect personal data and use it only on our instructions. We do not sell your personal data.

7. International transfers

Your data may be processed in the United Kingdom and in other countries where our service providers operate (including the United States). Where personal data is transferred outside the UK or EEA, we use appropriate safeguards such as adequacy regulations, standard contractual clauses, or equivalent mechanisms required by UK/EU GDPR.

8. How long we keep data

• Account data — while your account is active and for a reasonable period after closure to resolve disputes and meet legal obligations.
• Lesson, review and dispute records — typically for the life of the account and thereafter as needed for legal claims, tax, or regulatory requirements (often up to six years for financial records where applicable).
• Server logs — for a limited period necessary for security and troubleshooting, then deleted or anonymised.
• Marketing preferences — until you unsubscribe or withdraw consent.

We may retain anonymised or aggregated data that cannot identify you for longer.

9. Your rights

Depending on where you live, you may have rights including access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. These rights apply to users worldwide where UK/EU data protection law applies to our processing; we honour equivalent requests from other users where feasible.

To exercise your rights, email hello@8billionminds.com. We may need to verify your identity before responding.

You also have the right to lodge a complaint with a data protection supervisory authority, including the ICO in the UK or your local authority in the EEA.

10. Security

We use technical and organisational measures appropriate to the risk, including access controls and encryption in transit. No method of transmission or storage is completely secure; please use a strong password and keep your login details confidential.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be notified through the Platform or by email where appropriate.

12. Contact us

Questions about this policy or our use of personal data: hello@8billionminds.com.