Privacy Policy

SessionKite (“we”, “us”) runs SessionKite, a service that helps tutors, coaches, studios and schools manage students, classes, attendance, payments and communication with parents. This policy explains what personal information we handle, why, and what control you have over it.

You can reach us about anything in this policy at support@sessionkite.example.

SessionKite is used by different people, and our responsibilities depend on who put the information in:

• For information about your account, how you use SessionKite, and billing for your own plan, we decide how the information is used. We are responsible for it.
• For student records, attendance, notes and messages that an instructor or institution enters, that instructor or institution decides why and how the information is used. We handle it on their behalf and under their instructions. If you are a student or parent and want to see or change those records, you can ask your instructor or institution, and you can also contact us.

Account information

Your name, email address, password (stored only in scrambled form, never in plain text), account type, time zone, language and, if you add them, a phone number and photo.

Student and class information

Entered by instructors and institutions, and sometimes by parents and students: student names and contact details, date of birth or age group, guardians, enrolments, class schedules, attendance, goals, practice logs, lesson and progress notes, and feedback.

Payment information

Amounts, dates, invoices and payment status. Card and bank details are collected and held by our payment providers, not by us. We receive confirmation of what was paid, and the last four digits and brand of a card where the provider shares them.

Messages

Messages sent through SessionKite between instructors, institutions, parents and students, including messages sent on our users’ behalf by WhatsApp, email or text message, and delivery information for them.

Technical information

Device and browser type, app version, approximate location derived from the network address, and security logs such as sign-in attempts and who changed which record. If you accept analytics cookies, we also collect how pages and features are used.

Many students are children. We treat their information as sensitive and apply these rules:

• Children’s information is entered and managed by their instructor or institution and by their parent or guardian. We do not market to children, and we do not show advertising to anyone.
• We use children’s information only to provide the service: scheduling, attendance, progress, payments and messages between the instructor and the family.
• We do not track or build behavioural profiles of children, and we do not use their information for targeted advertising.
• A parent or guardian can link their account to their child’s record, see what is held, ask for corrections, and ask for the record to be deleted.
• Instructors and institutions must have the permission of a parent or guardian before they add a child under the age of consent where they teach (under 13 in the United States and under 18 in India), and they confirm this when they use the service.

If you believe we hold a child’s information without a parent’s permission, please contact us and we will look into it promptly.

• To run SessionKite: create accounts, show each person the records they are allowed to see, and send the messages and reminders you ask for.
• To process payments and keep accounting records.
• To keep the service safe: prevent fraud and abuse, protect accounts, and investigate problems.
• To provide optional features such as AI-assisted progress notes, which an instructor reviews before anyone else sees them.
• To improve SessionKite, using analytics only if you have accepted analytics cookies.
• To contact you about your account, security, billing and important changes.
• To meet legal obligations.

Access inside SessionKite follows the links between people:

• An instructor sees the students they teach or created, and their guardians.
• An institution sees its own instructors and students.
• A parent or guardian sees their linked children, and a student sees their own record.
• Staff of a network of institutions see the institutions in that network.
• Our own staff can reach information only when needed to run, secure or support the service, and such access is recorded.

When an instructor joins or leaves an institution, or a student moves between instructors, what each side can see changes accordingly. Nothing is deleted by linking or unlinking, and you are shown what will be shared before you agree.

We do not sell personal information. We share it only with:

• Service providers that help us run SessionKite, under contracts that limit their use of it: cloud hosting and database, payment processing, messaging (including WhatsApp, email and text message), error monitoring, and AI processing for optional features.
• Other users, as described above, when you link accounts or accept an invite.
• Authorities and advisers when the law requires it, to protect people’s safety, or to establish or defend legal claims.
• A successor if our business is sold or merged, in which case this policy continues to apply unless you are told otherwise.

Some features use artificial intelligence to draft text, such as progress notes. Only the information needed for the draft is sent to the provider, drafts are reviewed by the instructor before they are shared, and we require providers not to use this information to train their models. You can choose not to use AI features.

SessionKite is used in India and the United States, and our providers may process information in those countries and others. When information leaves your country we rely on contracts and safeguards that require it to be protected to the standard this policy describes.

We keep information while your account is active and as long as an instructor or institution needs the records to run lessons. When an account or record is deleted, we remove or anonymise the personal information, except what we must keep for legal, tax, fraud-prevention or dispute reasons (such as payment records), which we keep only as long as needed and then delete.

Security logs are kept for a limited period and then deleted.

Depending on where you live, you can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct information that is wrong or incomplete;
• delete your information, or restrict how we use it;
• withdraw a consent you gave, such as for analytics cookies, at any time;
• object to certain uses, and nominate someone to exercise your rights if you cannot.

You can request deletion of your account from Account settings. A person reviews the request because the account may be linked to other people’s records. You can also write to support@sessionkite.example. We answer within 30 days, and we will not treat you worse for using your rights.

In India these rights are those given by the Digital Personal Data Protection Act, 2023. In the United States they include the rights given by state privacy laws such as California’s, and the protections for children in COPPA. If you are not happy with our answer, you can complain to the data protection authority where you live.

Access to records is limited by rules enforced in the database itself, so one account cannot read another’s data even if the application has a bug. Information is encrypted in transit, passwords are stored hashed, sign-in links expire, and changes to links between accounts are logged. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.

We use essential cookies to keep you signed in, and analytics cookies only if you accept them. Details are in our Cookie Policy, and you can change your choice at any time from “Cookie settings” at the bottom of every page.

If we make a significant change we will tell you in the app or by email before it takes effect. The date at the top shows when this page was last changed.

For questions, requests or complaints about privacy, write to support@sessionkite.example. Please put “Privacy” in the subject. This address is also our grievance contact for the purposes of Indian law, and we will acknowledge your message promptly and respond within the time the law allows.