Sessionata Privacy Policy

Effective date: 2026-10-24 Last updated: 2026-10-24

Change log

1. About this policy

This policy explains what personal information Sessionata collects, why, who can see it, how long we keep it, and the choices you have. It applies to sessionata.com and its related sites and apps (together, "Sessionata").

Sessionata is operated by Widaflow LLC, a Florida limited liability company, doing business as Sessionata ("we", "us", "our"), of 619 Island Place Way, Tampa, FL 33602. Questions go to privacy@sessionata.com.

The words "organization", "organizer" and "listing" mean what they mean in our Terms of Service.

The short version:

• We collect what we need to run your account, your bookings and payments, and the community features you use.
• We do not sell your personal information, and we do not use it for advertising.
• We use no advertising or analytics trackers. Our sign-in pages and our public profile pages at people.sessionata.com do load fonts from Google (section 10).
• Card numbers never reach us. Stripe handles them.
• Your profile is public unless you change it. Your name, handle and photo can always be found by people who are signed in.
• We can read messages. They are encrypted on the way to and from us, but they are not end-to-end encrypted.
• Deleting your account does not delete everything. Things you posted keep their text unless you ask us to remove it. Your booking, payment and competition records stay. Section 8 explains exactly what stays and why.

2. What we collect

When you create an account

• Email address. You sign in with it, and we send you things you need at it.
• First and last name, and the handle you choose (like @maya).
• Your password. Our identity service holds it. Sessionata's application pages never see it.
• Passkeys and authenticator apps, if you set them up. For a passkey we hold a public key. Your fingerprint or face never leaves your device.
• Sign-in sessions, so we can keep you signed in and show you your active sessions.

We do not ask for your date of birth.

When you sign in with Google or Microsoft

If you use "Continue with Google" or "Continue with Microsoft", the provider sends us your name, email address and the provider's ID for your account. We ask only for the basic scopes openid, email and profile. With Microsoft we also read your basic profile (name and email) through its User.Read permission.

• New account. We pre-fill your name and email from the provider and suggest a handle, which you can change. If Google says it has verified your email address, we treat it as verified. Microsoft does not say, so we send you a code to verify it.
• Connecting a provider to an existing account. We store which provider it is, the provider's ID for you, and the provider's user name for you (for Google, your Gmail address; for Microsoft, your sign-in name), so you can recognise it in your security settings. Connecting a provider never changes your account's email address or name.
• We never receive your Google or Microsoft password. We do not read your contacts, mail, files or calendar.

Your profile and activity

• Profile details you choose to add: a photo, a banner image, a bio and links.
• Your settings: profile visibility, whether people must ask to follow you, notification and email preferences, and display preferences such as theme.
• Your connections: who you follow, who follows you, follow requests, Connections (people who follow each other), contact lists, and who you have blocked or muted.
• What you post and send: posts, comments, hashtags, photos and other media, and messages, including group conversations, rooms, and messages to an organization's inbox.
• Presence: whether you are signed in, have a conversation open, or are looking at it. Only people in that conversation can see it. It expires about 90 seconds after your device stops reporting it, and is then deleted.
• Notifications we send you, and whether you have read them.
• Reports you make, and reports made about your content.
• Marketing email choices (section 6).

Organizations

• Memberships and roles in organizations you belong to.
• Invitations. When an organization invites someone by email, we store that email address so the invitation can reach them.

Classes, sessions and competitions

• Bookings: each booking, its state (booked, waitlisted, released and so on), your place on a waitlist, who made the booking, the price and how it was paid, and a history of changes.
• Attendance: when you checked in and how (at the door, by scanning a code, or from the app), and a weekly record of the sessions you attended.
• Your sharing choices: whether you appear on class rosters, and whether your attendance is shared with other attendees, coaches or the community. Both are off unless you turn them on.
• Classes and series you follow or join, and the notices sent to you about them.
• Competitions: your entries, your name, affiliation, division and age group as entered, judges' scores and comments, and results. An organizer can also enter a competitor by name only, without an account.
• We do not collect gender, emergency contacts or health information.

Purchases and payments

• Orders: what you bought, from which organization, when, the price, the fees, and the payment's status, including refunds, credits and disputes. Also passes and their balances, and memberships and subscriptions.
• Saved cards. Stripe holds your card. We keep a reference to it and the details needed to show it to you: brand, last four digits and expiry date, plus any nickname you give it. We record whether you have allowed one-click charges on it.
• Your full card number and security code never pass through or get stored on our systems. You type them into fields or pages served by Stripe.
• Payment notifications from Stripe, which we keep as received. They describe the payment and can include details such as your email address.
• If you sell: your organization's Stripe account ID and onboarding status. Stripe, not us, collects and checks the identity and bank details needed to pay you.

When you contact us

If you email us, we keep the email and our reply so we can help you.

Technical information

• Your time zone, which your browser tells us so times show correctly (section 10).
• Logs. Our services record errors and events so we can run and secure Sessionata. Some log entries include your account ID, and a few can include an email address.

3. How we use it

We use your information to:

• run your account: sign you in, keep it secure, and let you manage it;
• provide the features you use: your profile, posts, messages, follows, organizations, bookings, competitions and notifications;
• take payments for organizations, calculate fees, issue receipts, process refunds and handle disputes;
• send you messages you need, such as sign-in codes, receipts, invitations, booking confirmations and the notifications you have switched on;
• keep Sessionata safe: handle reports, enforce our Terms, and prevent fraud, spam and abuse, for example with rate limits;
• keep the records the law requires, such as payment records;
• fix problems and keep the service running.

We do not use your information for advertising. We do not sell it, and we do not build advertising profiles. We do not use your messages for anything except delivering them, keeping the service safe and handling reports.

4. Who can see what

Reports. If you report something, the person you reported is never told it was you.

Organizations are responsible for how they use what they see. Our Terms require them to use attendee information only to run their sessions and their organization.

We can access stored content. Messages and other content are stored in a form we can read. Our staff do not browse them. We access them only to keep the service running, to deal with a report, abuse or a legal requirement, or at your request.

5. Who we share it with

We share personal information only as described here.

Service providers

Sign-in providers

If you choose to sign in with Google or Microsoft, the provider knows you used it to sign in to Sessionata. Their own privacy policies apply to what they do.

Organizations

When you join, book with, buy from or message an organization, it receives the information in section 4.

Other people, as you choose

Your profile, posts and messages are shown to the people your settings and conversations allow.

When the law requires it, or to protect people

We may disclose information if the law requires it, such as a valid court order, or if we reasonably believe it is needed to protect someone's safety, to prevent fraud, or to protect our rights or our users.

If Sessionata changes hands

If Sessionata is sold, merged or reorganised, personal information may pass to the new owner. The new owner must honour this policy or tell you about any changes.

6. Email

We send two kinds of email, and they are kept separate:

• Transactional email is about your account and what you do: sign-in and verification codes, password resets, receipts, invitations, booking messages, and the notifications you have chosen to get by email. It comes from no-reply@mail.sessionata.com. You cannot opt out of messages you need to use your account. You can choose which notifications reach you by email in your notification settings.
• Marketing email (newsletters, announcements, promotions) would be sent only if you have opted in, separately for each category, in your account's email preferences. Every category is off until you turn it on. Every marketing email carries a one-click unsubscribe. Using it puts your address on a suppression list that blocks all marketing email to that address. The list keeps only a one-way fingerprint (hash) of the address, and it stays in force even if you delete your account.

Sessionata does not send marketing email today. The marketing channel is switched off. If we switch it on, we will update this section first.

7. How long we keep it

We keep your information while your account is open, and after that only as described in section 8. Some things are deleted on a fixed schedule:

8. Deleting your account, and what survives

You can delete your account from your account settings on sessionata.com. It is immediate and cannot be undone. If you are the only owner of an organization, you must hand ownership to someone else first. Deleting your account does not cancel your subscriptions or release your bookings, so do that first (see our Terms, section 10).

When you delete your account, we delete:

• your sign-in (your account at our identity service, including passwords, passkeys and connected Google or Microsoft sign-ins);
• your organization memberships, and invitations sent to you;
• your profile: photo, banner, bio and links, and your entry in people search;
• your follows, followers, follow requests, Connections, contact lists, blocks and mutes;
• the notifications you received and your notification settings;
• your room settings and any connected chat apps;
• your name on messages you sent to organizations' inboxes.

Your handle is held for 30 days so no one else can take it, then released.

What stays after you delete your account, and why:

• Your posts, comments and messages, including their text. Conversations are shared with other people, so the threads stay. Things you wrote are shown under a neutral label instead of your name, but their text and attached media are kept unless you ask us to remove them (below).
• Your booking, attendance and competition records with organizations. Competition results keep the name shown on them.
• Payment and order records, including subscriptions, refunds and disputes. Organizations and we must keep accurate books, and the law requires financial records.
• Your saved-card details (brand, last four digits and expiry) and copies of payment notifications from Stripe.
• The moderation log. It is permanent and cannot be edited, so that moderation stays accountable.
• Report snapshots, for up to 18 months after a report is resolved, to deal with abuse.
• Your marketing email choices, and your unsubscribe (as a hash of your email address), so we keep honouring it.
• Copies in backups and logs, until they age out (section 7).

These records are kept under an internal account ID. Once your account is deleted, that ID no longer leads to your name, email or handle in our account records.

Asking us to remove more. Write to privacy@sessionata.com. On request we can also:

• remove the text and media of everything you posted or sent, leaving a "removed" marker;
• delete your customer record at Stripe, which removes your saved cards there.

We may need to confirm it is you first. We will reply within 30 days. For anything else, such as a copy of your information or a correction, write to the same address and we will tell you what we can do.

9. Your choices

• Profile visibility: public (the default), signed-in only, or connections only.
• Private profile: make people ask before following you.
• Rosters and attendance: choose whether you appear on class rosters and who sees your attendance. Both are off unless you turn them on.
• Block and mute anyone.
• Notifications: choose what reaches you and how.
• Marketing email: off unless you turn it on, by category.
• One-click charges: off for each card until you turn it on.
• Sign-in methods: connect or disconnect Google or Microsoft, keeping at least one way in.
• Update your details in your account settings at any time.
• Delete your account, and ask us to remove more (section 8).

10. Cookies and similar technologies

We use only the cookies and browser storage the service needs to work.

On sessionata.com:

Your browser also keeps a few small things for the current tab only (for example, a random ID so your presence shows correctly), and a list of the emoji you used recently.

On our sign-in pages (id.sessionata.com):

Third parties:

• Stripe. When you add a card, Stripe's payment form loads from Stripe. Checkout pages are hosted by Stripe. Stripe may set its own cookies there to process payments and prevent fraud. See Stripe's cookie policy.
• Google Fonts. Our sign-in pages (id.sessionata.com) and our public profile pages (people.sessionata.com) load fonts from Google, so Google receives your IP address and browser details when those pages load. The main sessionata.com site, including your account pages, serves its own fonts.

We do not use advertising or analytics cookies, tracking pixels or third-party analytics. Because we do not track you across sites, we do not respond differently to "Do Not Track" signals.

11. Children

Sessionata is not for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has an account, contact privacy@sessionata.com and we will delete it. People aged 13 to 17 need a parent's or guardian's permission to register and buy (see our Terms).

We do not ask for date of birth, so we cannot check ages automatically. Organizers who record a competitor's age group do so as a label on results.

12. Security

• All connections to Sessionata are encrypted (TLS).
• Passwords are held by a dedicated identity service and never reach Sessionata's application pages. Passkeys and multi-factor authentication are available to every account.
• Card handling is delegated to Stripe. We never hold card numbers.
• Access is checked on every request, so each account can see only what it is allowed to.
• Every moderation action is recorded in a log that cannot be changed.
• Messages and content are stored so that we can read them. They are not end-to-end encrypted.

No system is perfectly secure. If you find a security problem, tell us at security@sessionata.com. Our help site has a more technical Security & data-handling overview.

13. Where your information is

Sessionata is operated from the United States. Your information is stored on Microsoft Azure servers in Central US. Our service providers may process it in other countries.

14. Changes to this policy

We may update this policy. If a change is significant, we will tell you before it takes effect, by email or on the service, and update the date and change log at the top.

15. Contact

Postal address: Widaflow LLC (doing business as Sessionata), 619 Island Place Way, Tampa, FL 33602.