SESSIONLY
PRIVACY POLICY
Version 5 · Effective date: 8 October 2026
Sessionly, a California general stock corporation, entity number 6142110.
What changed in this version. Four things. We now describe the invitations we send: what we hold about someone we have invited but who has no account yet, where it came from, that we collect no photograph, that an unclaimed invitation is deleted after fourteen days, and that a request not to be invited is kept indefinitely so that we can honour it. We corrected section 3, which described only the count of profile views and did not describe the daily tally of site requests that has been running since early September. We corrected section 8, which said Sessionly was available in the United States only — that was not accurate and we have said what the rule actually is. We said in section 5 that an AI assistant helps us draft an invitation, and what is sent to it. And we corrected section 14, which claimed every version of this policy is retained. One early version is not, and we have said so.
What changed in version 4. We named the second AI provider we use, which the previous version did not — one provider receives information about you, the other is used only for an internal tool that receives no records about any user. We removed a feature that would have sent an expert's profile to an AI provider, so it is no longer described here. We said more precisely what travels together when a session is booked. And we stated how long our hosting provider keeps request logs.
The short version
We collect what we need to run Sessionly and very little else.
We do not track you around the internet. We set no analytics or advertising cookies. We do not record your sessions and we never have.
We do send some of what you type to a third-party AI provider — the goals you write when booking, and your search queries — and we explain exactly what and why below, because most services doing this do not tell you.
We do not sell your information, and we never have.
1. Who we are
The company responsible for your information — the data controller — is:
Sessionly, a California corporation
100 N Clark Drive, Apt 403
Los Angeles, CA 90048
hi@sessionly.co
This corrects an error in the previous version of this policy, which described Sessionly as a Delaware corporation. Sessionly is and always has been a California general stock corporation.
2. Who this covers
Anyone who uses Sessionly: a student who books a session, an expert who provides one, someone who applies to become an expert, or a visitor who never creates an account.
It also covers you if we invited you. We sometimes prepare a draft profile for someone we would like to see on Sessionly, before they have any account with us. If that is you, this policy describes what we hold, how long we hold it, and how to make us delete it — and you do not have to create an account to ask.
3. What we do not do
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law.
We do not record sessions. There is no recording feature and no copy of your session exists after it ends. California requires everyone on a call to consent before it can be recorded, so if we ever build recording it will be with both people's active agreement, and we will update this policy before it goes live rather than after.
We do not track visitors. Nothing we run follows a person from page to page or from site to site. We set no cookie for it, run no script in your browser, store no IP address and no browser identifier, and send nothing to anyone else.
Until recently we recorded an IP address, a browser identifier and a referrer for anyone who viewed an expert's profile, whether or not they had an account. We removed all of it, and deleted the records we had.
What we do count, on our own servers. Two things.
How many times each expert profile has been viewed — a number on the profile, with nothing attached to it.
A daily tally of requests to the site. For each day we add one to a count for: the page requested, the name of the site a visitor came from if they followed a link here (the site's name only, never the page), the country the request came from, and whether it came from a phone, a computer, or an automated crawler.
These are counts and nothing else. Nothing in them identifies a visitor, there is no way to tell one visitor from another or to recognise anyone coming back, and nothing is shared with anyone — only we can see them.
We are describing the daily tally more fully than earlier versions of this policy did. It has been running since early September, and the previous wording mentioned only the profile count. Nothing about what we collect has changed — the description has, and it should have said this from the start.
4. What we collect, and why
| What we collect | Where it comes from | Why | Legal basis (EU/UK) |
|---|---|---|---|
| Name, email address, password (stored hashed, never readable), time zone, country | You, at signup | To create and secure your account, and to show your name to the person on the other side of a session | Performance of our contract |
| Google account identifier and profile name, if you sign in with Google | Google, when you choose that option | To sign you in without a separate password | Performance of our contract |
| Email verification status | Generated when you confirm your address | To confirm the address is yours before you can book or apply | Performance of our contract; preventing fraudulent accounts |
| Expert application: professional background, headline, biography, skills, categories, photograph, a link to a public profile, your stated session price | You, when you apply to be an expert | To decide on your application, and to build your public profile if approved | Steps taken at your request before entering a contract |
| Identity and bank details for approved experts | Collected directly by Stripe, never by us | Because we cannot pay you without them, and payment law requires them | Legal obligation; performance of our contract |
| Booking records: who booked whom, when, length, price, the Platform Fee, and the goals you write | You, and generated by the platform | To run the session, pay the expert, and answer questions about a booking later | Performance of our contract |
| Payment card details | You, entered directly into Stripe | To take payment. We never see or store your card number — we keep only the last four digits and a reference | Performance of our contract |
| Your expert's first name, sent to your bank | Generated when you are charged | Your statement reads SESSIONLY* followed by the expert's first name, so you recognise the charge. This means an expert's first name reaches the student's bank | Performance of our contract |
| Session video and audio | Streamed live between the two participants | To deliver the session. Not recorded, not stored | Performance of our contract |
| Emails we send you and whether they were delivered | Generated when we email you | To confirm bookings, send reminders and resets, and to tell whether an email failed. We do not track whether you opened it or clicked anything | Performance of our contract |
| Messages you send us | You, by email | To answer you | Performance of our contract; our legitimate interest in helping people who use Sessionly |
| Marketing preferences | You, if you opt in | To send occasional updates. You are never opted in by default | Your consent |
| Technical request data, including IP address and browser type | Automatically, at our hosting provider | To keep the service running and secure. This happens at the server, not on your device | Our legitimate interest in operating and securing the service |
| How you heard about us | You, at signup, optionally | To understand which of our efforts reach people | Our legitimate interest |
| A draft profile for someone we invited: their name, email address, country, a headline, a biography, the names and lengths of Sessions they might offer, the notes we made, which channel we used and the date we sent it | Public information about their work, and what we were told about them. Not from them — this is prepared before they have an account. No photograph is collected and none is created | To invite a specific person to join Sessionly, and so that a profile exists for them to read, correct or reject rather than build from nothing | Our legitimate interest in recruiting experts, balanced against holding no more than an invitation needs and deleting it if it is not taken up |
| When you tell us nobody here fits: your own email address, what you were searching for at the time, the category you were browsing, where on the site you submitted it, and your note | You, through the "nobody here fits" form. Your account identifier and role are attached if you are signed in | To decide which experts to recruit next, and to tell you if we act on it | Our legitimate interest in deciding what the platform should offer |
| A record that someone asked not to be invited, held as a one-way hash of their email address and nothing else | The person who asked, or a decision of ours | So we can check a new invitation against it and not contact someone who has told us not to. The hash cannot be turned back into an email address — it exists only to be matched against one, so that honouring the request does not require us to keep the address | Our legitimate interest in honouring an objection, which is also why the record has to outlive the data it protects |
| Whether an invitation was claimed, and when | Generated when someone claims a profile we drafted | To know which drafts are live and which to delete | Performance of our contract, once claimed |
5. What we send to an AI provider, and why we are telling you
We use two AI providers, and they are used for different things. Only one of them receives information about you.
OpenAI is used in two places, and both involve something you typed:
| Where | What is sent | What happens to it |
|---|---|---|
| Session preparation | The goals you write when booking, together with your expert's name, their headline, and the name and length of the session you booked | Used to generate a short preparation agenda. Both what you wrote and what was generated are stored on your booking record |
| Search | Your search query, and our own list of categories | Used to interpret what you are looking for. Nothing about your account is sent |
Anthropic is used for two things, and neither of them receives any record about a registered user.
An internal tool our own staff use. It receives what a member of our staff types and some aggregate counts — how many students, how many experts, how many sessions this month.
Helping draft an invitation. When we prepare a draft profile for someone we would like to invite, a person at Sessionly writes it with the help of an AI assistant from Anthropic, and sends it public information about that person's work — their name, where they work, and what they have published about their work.
The person being described is not a Sessionly user and has given us nothing. What we send is what anyone could read about their work. A person reads and approves every word before it is used, the draft is not published anywhere, and it is shown only to that person — after they verify their email address — so they can decide whether to claim it, change it, or have it deleted.
Nothing from inside a session is sent to either of them, because sessions are not recorded.
A note for students specifically. The goals you write before a session are free text about your own situation, and may touch on your health, your finances or a legal problem. That text leaves our systems, and it leaves alongside the name of the expert you booked. If there is something you would rather not send to a third party, keep it out of the booking note and raise it in the session instead.
A note for experts specifically. When a student books you, your name and headline are sent to OpenAI as part of that booking, whether or not you use any feature yourself. This is described in the Expert Agreement as well as here.
6. Who else receives your information
| Who | What they get | What they do with it |
|---|---|---|
| Stripe | Payment details; for experts, identity and bank information | Takes payments and pays experts. Stripe is a separate controller of what it collects directly from you |
| Agora | Live audio and video during a session, and the technical data to connect it. Nothing is recorded | Carries the video call. Agora holds its own connection analytics — join and leave times, duration and quality |
| Resend | Your email address and the content of the emails we send to you | Delivers our outbound email. Open and click tracking are not enabled. Mail you send us does not pass through Resend |
| Vercel | Technical request data including IP address | Hosts and serves the site |
| MongoDB Atlas | The information in section 4, at rest | Stores our database |
| OpenAI | As set out in section 5 | As set out in section 5 |
| Anthropic | What our own staff type into an internal tool, and aggregate counts; and public information about a person we are drafting an invitation for — their name, where they work, and what they have published about their work. No record about any registered user | Answers our staff's queries about how the platform is doing, and helps draft an invitation as section 5 describes |
| ImprovMX | Mail you send to any sessionly.co address, in transit | Receives it and forwards it to our mailbox |
| Your Google account identifier, if you sign in with Google; and our mailbox — mail you send us is delivered to and kept in a Google mailbox | Signs you in, and holds the mail you send us |
That is the complete list. No analytics provider, no advertising network, no data broker, no marketing platform.
We will also disclose information where the law requires it — a court order, a subpoena, a regulator — and where we need to in order to investigate fraud or protect someone's safety. If we are ever bought or merged, your information may transfer with the business, and we will tell you before that happens.
7. How long we keep it
| What | How long |
|---|---|
| Your account and profile | While your account is open |
| Booking and payment records | Seven years after the booking, because tax and financial record-keeping rules require it, even if you close your account |
| Session video and audio | Not retained. It exists only during the call |
| Approved expert applications | For the life of the expert relationship, then with the booking records above |
| Applications we declined, or that were never finished | We keep these only as long as we need to. We are setting a defined period with our lawyers, and will state it here once it is fixed. In the meantime we delete them when the reason we held them has passed |
| Technical request logs at our host | Our host keeps these for a short period and deletes them automatically. We do not control that period and it may change with our hosting plan |
| Messages you send us | Kept in our email for as long as we need them to deal with your query and anything that follows from it. They are not stored in our systems and are not attached to your account |
| Marketing preferences | Until you withdraw them, then a record that you withdrew, so we do not contact you again by mistake |
| A draft profile we prepared for someone we invited, and the email address we held for it | Fourteen days from the day we create the invitation — not from the day it is sent, which may be later. If it is not claimed in that time, a daily job removes the draft text and the email address and marks the invitation expired. The record that an invitation existed is kept — the dates, the channel and the country, with nothing that identifies the person. The invitation itself is an ordinary email sent by a person from their own mailbox — it is not stored in our systems, and like any sent message it stays in that mailbox until it is deleted there. Claimed instead, and it stops being a draft — it becomes that expert's profile content and is kept under the rows above, for as long as their account is open. You can ask us to delete it sooner and we will |
| An invitation with no draft profile — a name and an email address only | Until the invitation is claimed or we withdraw it. An invitation nobody has taken up is an offer that has lapsed, so we withdraw ones that have gone unanswered and the name and address go with them. We do not keep an invitation open indefinitely in the hope that someone answers months later |
| A record that someone asked not to be invited | Indefinitely. This is the one thing we keep with no end date, and deliberately: a suppression record that expires stops suppressing. It is a hash of an email address and nothing else, and deleting it would mean we could invite you again by mistake. Ask us to remove it and we will, but then we may not recognise you as someone who asked |
| What you sent through the "nobody here fits" form | Kept while we are deciding, then deleted once we have acted on it or decided not to. Your search term and your note are kept together with your email address, which is why we delete the record rather than keep it as a statistic |
When a period ends, we delete the information or strip it of anything that identifies you.
8. Where your information goes
Sessionly is operated from California, and our service providers are based in the United States.
You cannot create a Sessionly account from the European Union, the European Economic Area or the United Kingdom. We ask which country you are in when you sign up, and we do not accept a signup from one of those countries. A previous version of this policy said Sessionly was available in the United States only. That was not accurate, and this says what the rule actually is.
From anywhere else, you can create a student account, and your information is processed in the United States. Experts are effectively United States only for a different reason: we can only pay into US bank accounts, which the Expert Agreement explains.
If the rule changes, we will say so here before it does.
9. Your choices and your rights
Whoever and wherever you are, you can ask us to give you a copy of the personal information we hold about you, correct anything wrong, delete your account and what is attached to it, or stop sending you marketing.
Write to hi@sessionly.co and we will respond within 30 days. The email address works whether or not you can sign in, which matters if you are locked out of your account.
Deleting your account: you cannot do this from inside the product yet. Email us and we will do it. We would rather tell you that than point you at a button that is not there.
If you are in California, you have the right to know what we collect, to have it deleted, to have it corrected, and not to be treated differently for asking. As above, we do not sell or share personal information as those terms are defined, so there is no opt-out to offer you.
10. Cookies
We set only the cookies necessary for Sessionly to work — keeping you signed in, and keeping your session secure. No analytics cookies, no advertising cookies, no tracking pixels, no session replay.
There is no cookie banner because there is nothing to ask you about.
The full detail is in our Cookie Policy.
11. Children
Sessionly is for people aged 18 and over. You may not create an account if you are under 18. We do not knowingly collect information from children, and if we learn that we have, we will delete it. If you believe a child has given us information, tell us at hi@sessionly.co.
12. Security
Passwords are stored hashed and are never readable by us or anyone else. Card numbers never reach our systems. Access to the database is limited.
No system is perfectly secure and we are not going to claim otherwise. If there is ever a breach affecting your information, we will tell you and the relevant authorities as quickly as the law requires and as quickly as we are able.
13. What we have not built yet
We would rather tell you than let you assume.
There is no session recording, and no feature that would create one. There is no self-serve export of your data — ask us and we will assemble it by hand. There is no self-serve account deletion; email us.
No account is closed for inactivity. Our Terms allow us to close an account that has not been used for a long period, but we have not set that period, no job does it, and we have never closed one. The Terms say we will state the period before we first use the rule.
14. Changes
If we change something material we will tell you by email and update the date at the top. Continuing to use Sessionly after that means you accept the new version. If you do not, you can close your account.
Every version of this policy in force since 3 August 2026 is retained, and we can show you the exact text of any of them. One earlier version cannot be. The policy published on 11 June 2026 was replaced in place on 3 August 2026, before we built the system that keeps each version as a separate record, and its original text no longer exists. If you accepted that version and want to know what it said, we cannot show you.
That failure is the reason we changed how this works. Every version since is stored as its own record with a fingerprint of its contents, so that it cannot be altered after the fact and cannot happen again. We would rather tell you that than leave a sentence here claiming a completeness we cannot deliver.
15. Contact
Sessionly, a California corporation
100 N Clark Drive, Apt 403
Los Angeles, CA 90048
hi@sessionly.co