Privacy Policy

Last updated: 3 October 2026

1. Introduction

LearnMusic is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our marketplace platform, our assistant Evelyn, and AI Practice Assistant.

In this policy, Music Education Technology Ltd is the operating entity referred to as we, us, and our. We handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

2.1 Account Information

  • Name and email address
  • Authentication identifiers from our sign-in provider
  • Phone number (optional)
  • Profile photo (optional)

Authentication is currently handled by Clerk. We do not store your plaintext password.

2.2 Teacher-Specific Data

  • Qualifications and certificates
  • DBS certificate details
  • Teaching experience and bio
  • Bank account details (for payments via Stripe)
  • Government ID (for identity verification)

2.3 Student-Specific Data

  • Learning preferences and goals
  • Instrument and skill level
  • Booking history
  • Payment information (processed by Stripe)

2.4 Usage Data

  • Messages sent through the platform, where needed for support, moderation, or safeguarding review
  • Lesson attendance and completion
  • An approximate last-active time from signed-in service requests, and the last sign-in time supplied by our authentication provider.
  • Device information and IP address
  • With analytics consent: signed-in sessions, page visits, page views, named actions and activity times linked to your account for improving customer journeys. We use route patterns, not private URL values, and exclude message text, form contents, lesson content and payment details.

2.5 Teacher Games and Marketing Data

  • Teacher Games entry status, terms acceptance, reservation, waitlist, vesting, and public leaderboard consent records
  • Teacher Games performance records used for scoring, such as lessons, revenue bands, reviews, retention, growth, and consistency signals
  • First-party campaign events such as page views, CTA clicks, account creation, profile-threshold completion, checkout starts, reserved places, waitlist joins, and vesting
  • Campaign attribution fields such as UTM values, landing page, referrer, ad click IDs, consent state, first-touch references, and last-touch references
  • Retargeting audience snapshots, conversion export audit rows, suppression audit rows, and daily campaign reports

2.6 AI Practice Assistant Data

  • Audio recordings during practice sessions (processed for feedback, not stored long-term)
  • Practice duration and frequency
  • Progress and performance metrics

2.7 Advertising Lead Form Enquiries

If you send us your details through a LearnMusic advertising form, we collect the fields listed under Advertising Lead Forms below.

3. How We Use Your Data

We use your data to:

  • Provide and improve our services
  • Match students with suitable teachers
  • Process payments securely
  • Ensure platform safety (message monitoring)
  • Verify teacher identities and qualifications
  • Send important notifications about your account
  • Provide AI practice feedback
  • Analyse usage to improve our platform
  • Use approximate account activity in internal aggregate reporting
  • Operate Teacher Games, including eligibility, scoring, audit, moderation, winner verification, and prize administration
  • Measure and improve Teacher Games marketing campaigns where consent and applicable law allow
  • Prepare consent-gated conversion, audience, and suppression data for advertising platforms where approved
  • Answer enquiries sent through our advertising forms and help you set up a teacher profile
  • Answer your questions and suggest next steps through Evelyn, our assistant

5. Data Sharing

We share data with:

  • Stripe: For payment processing
  • Clerk: For authentication
  • HubSpot: Our customer relationship management system, where we keep enquiry and contact records
  • DeepSeek: To generate Evelyn's replies and assess platform messages for scams, fraud and safety concerns. See Evelyn, Our Assistant and Automated message safety checks.
  • Cloud providers: For platform hosting
  • Advertising platforms: For campaign measurement as described below, and consented conversion uploads, retargeting, and suppression where approved
  • Teachers/Students: Limited profile information as needed for bookings
  • Law enforcement: When legally required

We do not sell your personal data to third parties.

Google Ads receives a basic signup measurement even if you decline marketing cookies or have not made a choice. In that case, the measurement uses no advertising cookies and includes no email address, email digest, or ad click identifier. Google may use these signals to estimate campaign results. If you accept marketing cookies, we can use ad click attribution and, for teacher signups, a hashed email address to improve conversion matching.

Teacher Games ad-platform payloads are minimised. They should not include exact lesson revenue, exact Teacher Games score, rank, safety or fraud flags, private address, postcode, student identities, internal admin notes, or full teacher profile data.

6. Advertising Lead Forms

If you request information through a LearnMusic advertising form, we receive the full name and email address you submit, together with the form and campaign identifiers. We use this information to answer your request and help you set up a teacher profile. We keep the relationship record in our customer relationship management system, HubSpot. Submitting this form does not subscribe you to unrelated marketing. You can ask us to stop contacting you or delete your enquiry using the contact details on this page.

6.1 What a teacher advertising form collects

Our teacher advertising form asks you for two things, and nothing else:

  • Your full name
  • Your email address

With your submission we also receive the form, campaign, and lead identifiers the advertising platform supplies, and the time you submitted it.

The form asks no further questions. It does not ask for a phone number, your city or area, the instrument you teach, whether you teach online or in person, a postcode, a date of birth, income, health information, or any other special category data. Your name and email address are what you told us in an enquiry; they are not verified teaching credentials, and they do not create a teacher profile on their own.

6.2 How we use and share an enquiry

We rely on our legitimate interest in answering the request you made, and on taking steps at your request before a contract if you go on to create a teacher profile. We send you the setup response the form offered. We do not add you to a newsletter or to unrelated marketing because you submitted the form, and submitting it is not consent to advertising cookies or to conversion matching.

HubSpot is provided by HubSpot, Inc. Our portal is configured in HubSpot's EU hosting region. HubSpot and its sub-processors may also process data outside the UK and the EEA; where they do, we rely on the transfer safeguards required by UK data protection law.

To stop us contacting you, or to have your enquiry deleted, use the data protection contact in the Contact & Complaints section below. We apply the same request to the record in HubSpot and to any lead export we still hold.

7. Evelyn, Our Assistant

Evelyn is an optional AI assistant on our website. It answers questions about LearnMusic and learning music, suggests next steps, and can prepare changes to your teacher profile. A change Evelyn prepares only takes effect if you confirm it.

7.1 What Evelyn uses

  • The messages you send Evelyn, and its replies
  • The kind of page you are on, such as a teacher's profile or your dashboard, rather than its full web address
  • If you are signed in: your account type, your teacher profile's status and what it still needs, whether payouts are set up, and whether a free first lesson is available to you
  • If you ask Evelyn to prepare a teacher profile: the details it proposes, such as your display name, headline, bio, instruments and lesson types

Evelyn is not given your email address, phone number, account identifier, messages with teachers or students, bookings, or payment details. If you are not signed in, we use your IP address to apply message limits, and hold it only in hashed form for no more than 24 hours.

7.2 What we remove first

Before a message goes to our AI provider, we automatically remove email addresses, phone numbers, payment card numbers, and bank account numbers (IBANs). Automatic removal can miss details written in unusual ways, so please do not share personal details, passwords, or payment details with Evelyn.

7.3 Who generates Evelyn's replies, and where

Evelyn's replies are generated by DeepSeek, an AI service provided by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. What Evelyn uses, after the removal above, is sent to DeepSeek and processed on servers in the People's Republic of China. DeepSeek receives your name only if you type it into the conversation.

The UK has not made adequacy regulations for China, which means UK law does not treat China as giving personal data the same level of protection as the UK. We limit what is sent as described above. DeepSeek handles the text under its own terms: we do not control how long DeepSeek keeps it, or whether DeepSeek uses it to improve its services. If that is not acceptable to you, please do not use Evelyn. Everything it helps with can be done on LearnMusic without it.

7.4 What we keep

  • Your conversation, on our servers for up to 2 hours after your last message so Evelyn can follow it, then deleted automatically
  • A copy of the conversation in your browser tab while it is open, as described in our Cookie Policy
  • A record of each message sent to Evelyn and the reply it gave, after the removal described in 7.2, kept for 12 months and then deleted automatically. The record is not linked to your account, email address or IP address: alongside the text it notes only whether the message came from a visitor, a student, a teacher or our staff, and the kind of page it was sent from. Our team reads these records to understand what people need and to decide what to improve on LearnMusic
  • A record of each change Evelyn prepared for you and whether you confirmed it, kept with your account data
  • Counters used to apply message limits, which expire within 24 hours

We do not record the text of your conversations in our logs.

7.5 Legal basis

We rely on our legitimate interest in answering the questions you choose to ask and helping you use LearnMusic. When you ask Evelyn to prepare a change to your teacher profile, we rely on providing the service you asked for.

We keep the conversation record in 7.4 under our legitimate interest in understanding what people need from LearnMusic and improving it. Because the record is not linked to you, it is not used to make decisions about you, and we cannot find or delete one person's messages in it on request. If you would rather your questions were not kept, please do not use Evelyn, and please do not write your name or other personal details in it.

7.6 Automated message safety checks

When automated message safety checks are enabled, DeepSeek assesses a proposed message and a limited recent conversation history before delivery. We include the sender's account type, display name, account age, email domain, recent contact counts, booking and conversation relationship, and declared learner age or whether lessons are for a child or adult, where recorded. Learner information may describe a child taught through a parent's account; it does not verify anyone's age.

We label conversation participants as sender and recipient instead of sending account identifiers. We remove email addresses and phone numbers from message text first. Account metadata excludes full email addresses, IP addresses, credentials and profile biographies. Attachment contents are not sent, although filenames and file types may be included. Automatic removal can miss details written in unusual ways.

This information is processed by DeepSeek on servers in China. The provider terms described in section 7.3 also apply to these safety checks: we do not control how long DeepSeek keeps it, or whether DeepSeek uses it to improve its services.

A suspicious or uncertain AI assessment holds the message for an administrator to review before delivery. An administrator can release or decline the held message. AI classification alone does not suspend or ban an account.

For moderation, we store structured assessment status, intent, category and reason codes, risk and confidence scores, and model information. Classification records do not contain a separate copy of the chat text. Original messages remain subject to the message retention described in section 8.

8. Data Retention

  • Account data: Retained while your account is active, plus 7 years for legal compliance
  • Approximate last-active time: Only the current value is kept and overwritten. It is cleared when you disable this processing in Settings or delete your account.
  • Detailed consented account journeys: 90 days, then deleted. Anonymous daily totals may be retained for longer-term trends. Withdrawing analytics consent deletes the current browser session history and stops new collection; disabling Account activity in Settings clears all optional account journey history.
  • Messages: Retained for 2 years for safeguarding review
  • Evelyn conversation record: 12 months, not linked to your account (see section 7.4)
  • Payment records: Retained for 7 years (legal requirement)
  • Teacher Games entry, scoring, audit, and prize records: Retained for competition administration, accounting, dispute handling, and legal limitation periods
  • Marketing attribution, conversion export, audience snapshot, suppression, and daily report records: Retained for campaign governance, consent evidence, audit, and reconciliation before aggregation or deletion where appropriate
  • Advertising lead form enquiries: Where we collect leads by export rather than automatic sync, the working export is deleted once the enquiry is recorded in HubSpot. The HubSpot record is kept while we deal with your enquiry and any account that follows, and is deleted when you ask us to delete it.
  • AI audio data: Processed in real-time, not stored long-term
  • Evelyn conversations: Up to 2 hours after your last message on our servers, then deleted automatically. Section 7 covers what DeepSeek receives.

9. Your Rights

Under UK GDPR, you have the right to:

  • Access: Request a copy of your data
  • Rectification: Correct inaccurate data
  • Erasure: Request deletion of your data (subject to legal requirements)
  • Portability: Receive your data in a portable format
  • Object: Object to certain processing
  • Withdraw consent: Where processing is based on consent

You can object immediately to the optional last-active processing in your account Settings. This clears the stored activity time and optional account journey history, stops future updates, and removes the account from activity reporting. This does not delete booking, payment, message, safeguarding, or other records that we need for separate service, legal, or safety purposes.

To exercise your rights, use the data protection route at: team@learn-music.co.uk

10. Security

We implement industry-standard security measures including:

  • Encryption in transit (TLS) and at rest
  • Regular security audits
  • Access controls and authentication
  • Secure payment processing via Stripe

11. Cookies

We use essential cookies for authentication and security. Browser analytics, including identified signed-in page visits, sessions and named actions, remains off unless you consent. A session uses a random identifier held in the current browser tab and resets after 30 minutes of inactivity. We do not collect message text, form contents or private URL values in these events. We also use marketing cookies or similar technologies for campaign measurement where you consent. The server-side approximate last-active time described above does not store or read information on your device. You can manage cookie preferences in the cookie banner and through your browser settings. See the Cookie Policy.

12. Children's Privacy

LearnMusic may be used by minors with parental consent. Parents or guardians are responsible for providing consent and supervising their child's use of the platform.

We do not use the approximate account-activity signal to send individual activity-triggered interventions to student accounts, including possible child accounts. We do not put message, safeguarding, verification, or lesson content into this signal.

Evelyn's replies are generated by an AI provider outside the UK, as section 7 explains. If you are under 18, check with a parent or guardian before using Evelyn, and do not share personal details with it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or platform notification.

14. Contact & Complaints

For privacy-related questions, UK GDPR rights requests, or privacy complaints, use the explicit routes below.

Data protection contact
Email: team@learn-music.co.uk

For platform complaints, use the complaints route. If you're unsatisfied with our response to a privacy or data protection complaint, you can complain to the Information Commissioner's Office: ico.org.uk

Operating entity: Music Education Technology Ltd
Company number: 16383674, registered in England and Wales
Registered office: Flat 5 Imperial Heights, 105 Lilliput Road, BH14 8JY
Operating from: United Kingdom

LearnMusic is a trading name of Music Education Technology Ltd, a company registered in England and Wales (company number 16383674). Registered office: Flat 5 Imperial Heights, 105 Lilliput Road, BH14 8JY.