Privacy Policy

• Sessio ApS
• CVR: 45830012
• Burmeistersgade 2, 1. th, 1429 København K, Denmark
• Email: [email protected] (privacy & legal) / [email protected] (general support)

This Privacy Policy covers:

• The Sessio mobile app (iOS and Android)
• sessio.io, our marketing website
• Email and form-based contact with us
• Royalty and profile hunts, including hunts an organisation you have authorised runs for you (section 3.5)
• The public find-my-money scan on sessio.io, including scans run without an account
• The map of professional music-industry places in the Sessio app (section 3.6)
• Any future services we add and link to this Privacy Policy

3.1 Information you give us

Account and profile.

• Email address, password (stored only as a salted hash — never in plaintext).
• Display name, country, optional city.
• Profession(s), instruments, genres, experience level (from a fixed option list).
• Short biographical text ("BIO"), optional.
• Optional career fields: "Member of," "Represented by," and "Credits / Worked with" (free-text).
• Optional audio embed link to Spotify or SoundCloud (a single URL pointing to a public track — Sessio does not connect to your Spotify or SoundCloud account; we only display the link).
• Profile photo (required at onboarding).

Sessions.

• Title, optional description, optional genre tag.
• Date and time, location type (in-person or remote) and free-text location detail.
• Visibility settings: discoverability toggle on your profile, Public-session toggle, "Looking For" professions, and "Who Can View" scope (Everyone / Connections / Favourites).
• Optional reference playlist URL (free-text URL).
• Optional cover image (host-uploaded).
• The list of participants you invite or who accept invitations.
• Group chat thread tied to the session.

External email invites.

When you invite a non-Sessio user to a session via email, we store the recipient email, your user ID as the inviter, and the session ID. We send a transactional email containing a magic link scoped to that session. The recipient email is used only to deliver invitations and to attribute conversions if the recipient later signs up. The lawful basis for this processing is legitimate interest (GDPR Art. 6(1)(f)), with anti-harassment safeguards (a per-recipient rate limit of 15 invitations per rolling 7-day window) and a delete-on-request route via [email protected].

Messages and communications.

• Direct 1:1 messages between connections.
• Session group-chat messages.
• Support emails or in-app reports.

We store messages so that you and your collaborators can refer back to them.

Files you upload.

You can paste or upload your works list, royalty statements and rights exports from a collecting society or distributor, and your publishing agreement, and you can attach a file to a conversation with Ask Sessio. These files usually name your co-writers and each person's share of a work. We keep your works lists, statements, exports and agreements. When you upload a publishing agreement, an AI model reads its terms (the publisher, its share of your part, the territory, the term and the retention period, and the works it names) so that we can apply them to your own songs; a term it is unsure of waits for you to confirm it. A file attached to Ask Sessio is kept for 7 days, but in the organisation workspace the text the assistant read from it stays in the conversation (see Sections 5 and 8).

Identity check.

Before you send a claim, we ask you to verify your identity. If you verify with your ID, you photograph your identity document and your face on the page of our identity-check provider, Didit (see Section 6). Didit checks that your face is a live one, not a picture, and that it matches the document, compares it with the faces from earlier checks for Sessio so that one person cannot verify several accounts, and sends us the result with the details it read from your document. Of those details we use only your name. We keep the result, and we keep a name only when it matches a writer credited on works your own scan found, and then as the register prints it. We do not keep the photos or the other details.

3.2 Information collected automatically

• IP address, browser type, device type, operating system, app version.
• Pages visited, screens viewed, features used, time spent, session start/end.
• Crash reports and performance diagnostics.
• Marketing attribution: UTM parameters from links you click; install attribution for the app.
• Cookies and similar technologies on sessio.io (see Section 10).

We use this data to operate the Platform, debug issues, and understand product usage in aggregate.

3.3 Information from third parties

• App Store and Google Play may share install attribution and crash reports with us according to their own privacy practices.
• If you embed a Spotify or SoundCloud track on your profile, the embed loads content directly from those services when other users view your profile. In this embed context Sessio does not connect to your Spotify or SoundCloud account and receives no account data; we only display the public URL you chose to share. Separately, a profile hunt may read your public artist or channel pages on services like these — see section 3.5.
• Public and licensed music-industry sources, when a royalty or profile hunt runs for you — see section 3.5.

3.4 Connected calendars (Google Calendar)

Connecting a Google Calendar is optional. If you — or an organisation you administer on Sessio, such as a publisher or label workspace — choose to connect a Google account, Google asks you to grant access on Google's own consent screen. You can decline, and you can revoke access at any time (see below). We only request this access when you actively start the connection.

Why we offer it. Connected calendars let a workspace see when a roster artist is busy or available, map each Google sub-calendar to the right person, and keep Sessio sessions in sync with the calendar you use every day.

When connected, we access the following through the Google Calendar API:

• Authorisation tokens — a short-lived access token and a long-lived refresh token that let Sessio call the Google Calendar API on your behalf. The refresh token is encrypted at rest (AES-256-GCM) and is never shown to other users.
• Calendar list — the names and identifiers of the calendars in the connected account, so you can choose which calendar belongs to which person.
• Event data, read (calendar.readonly scope) — for the calendars you map, the events' times and busy/free status, used to display availability inside the Sessio calendar.
• Event write-back (calendar.events scope) — when you create or change a Sessio session for a person whose calendar is connected, we add or update the matching event in that Google Calendar. We only create and update the session events that Sessio itself manages; we do not read, change, or delete your unrelated personal events.

Lawful basis. We rely on your consent — given on Google's consent screen and within Sessio — and, for organisation features, on performance of our contract with that organisation (GDPR Art. 6(1)(a) and (b)). You can withdraw consent at any time by disconnecting.

Google API Limited Use. Sessio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google Calendar data only to provide and improve the calendar features described above; we do not use it for advertising; we do not sell it; we do not transfer it to others except as necessary to provide these features, for security purposes, or to comply with applicable law; and we do not allow humans to read it, except with your consent for support you have asked us for, for security, to comply with law, or where the data has been aggregated and anonymised.

Revoking access and deletion. You can disconnect at any time from your Google Account's "Third-party apps with account access" page (myaccount.google.com/permissions) and, where available, from the connection settings in the Sessio workspace. On disconnection or account deletion we revoke and delete the stored Google tokens and the calendar-mapping data, and we stop accessing the account. Session events already written to your Google Calendar stay in your own calendar until you remove them there.

3.5 Information we collect from public and licensed industry sources (royalty and profile hunts)

When you use Sessio's Find My Money or profile hunt, or when an organisation that represents you runs these tools on your behalf under a grant you have approved, we collect and process information about your professional activity from external sources. Those sources are: public music-industry registers and databases (for example works, recordings and repertoire registers operated by collecting societies); licensed commercial data feeds we have a written agreement with; public pages on artist and label websites; public artist or channel pages on streaming, video and social-media services; and public music-credit, release and catalogue databases. Examples can include Spotify, YouTube, Instagram and Discogs. The relevant result shows the source name and link where the source permits us to do so.

What a hunt can return. Find My Money can return work and recording titles, identifiers (such as ISRC, ISWC, IPI, IPN or ISNI), credits and roles, releases, and the royalty pools they relate to. For a profile hunt, this is limited to your professional or stage name, public professional biography, credited roles, public profile image and links to public professional pages. We do not use private posts, contact lists or messages, collect precise location from those pages, use facial recognition, or infer sensitive traits from text or images.

How we access a source. We use a source only after documenting the access and reuse route that applies to it, for example its published terms, a written licence or written permission. A source being public does not by itself mean we may reuse it, and we do not bypass access controls or contractual restrictions.

Open identifier data. Some of the identifiers we use to find your music, and the links between them (for example which recording code, ISRC, belongs to which work code, ISWC, or which release a recording appears on), come from open music databases: MusicBrainz, published under CC0, and Credits.fm, published under the Creative Commons Attribution 4.0 licence. These are identifiers and links for works and recordings. Where such a record names a writer's rights identifier, the rules in this section on people named in external records apply to it.

Where the royalty estimate's numbers come from. To estimate royalties, we obtain play counts for recordings (identified by their ISRC codes) from Soundcharts S.A.S., a licensed music-data provider in France: how often each recording was streamed on each platform over the last year, and how often radio stations played it. Where a work has no recording code, we may look it up there by its title. We use the counts to compute the indicative royalty estimate in a hunt, and we show you the counts for your own recordings, including which radio stations played them; an organisation sees them only for a single song in its own catalogue. We do not pass them on to anyone else, and the estimate is a modelled range, not a statement of money owed. The collecting societies always decide final amounts. A play count is a fact about a recording, so we keep it on the recording, with its source and the date we read it, and a later count is added beside it rather than over it. When your account is erased, we delete the counts held for your own scans; the counts kept on the recording stay.

Automated matching. We use automated matching and ranking to generate possible results. These results are leads, not decisions about identity, ownership or payment. We do not make a decision with legal or similarly significant effects based only on automation: a person reviews the evidence, and you decide whether anything is submitted outside Sessio.

Lawful basis. When you start a hunt yourself, we process this information to perform our contract with you (GDPR Art. 6(1)(b)). When an organisation holding your approved representation grant starts a hunt for you, we rely on legitimate interests (Art. 6(1)(f)). Section 4 sets out both entries in full.

What an organisation and its operators can do. A trained operator may verify a suggestion and, if the approved grant allows it, add it to your hunt findings. An organisation you have given the highest level of representation can also apply professional details a profile hunt finds to your Sessio profile, within the limits described above. That write only touches profile details such as your biography, professions, instruments and links; it never changes your works, your splits or your rights identifiers. You can change or remove anything added this way, and you can lower or withdraw an organisation's access at any time. Every hunt or profile action an organisation runs for you is listed in your app under Privacy & Data, in "Organisation activity". A claim is submitted outside Sessio either by you, or by Sessio's own team under the authorisation you gave us and can revoke at any time (see section 5): an organisation can never file a claim as you.

Hunts an organisation runs for you. Before an organisation receives its first result about you, we tell you that it has asked us to run a hunt and we name the organisation. It then receives only the hunt results and supporting information its grant permits, and it is separately responsible for how it uses them. Sessio is responsible for the information collected and matched when a hunt runs, whether you started it or an authorised organisation started it for you. You can object to organisation-run hunts at any time in the Sessio app under Settings → Privacy & Data: that stops future organisation-run hunts about you and stops organisations receiving further results from them, and it leaves hunts you start yourself untouched. To see, correct, delete or object to any of this, contact us at [email protected]; you do not need to go through the organisation.

The public scan on sessio.io. You can run a royalty scan on sessio.io by entering a name, without an account. That scan searches information we already hold, and its results are not stored: we do not save the name you type or the results it returns. To see full results you create a Sessio account, and everything described above then applies.

People named in external records. External records may name co-writers or performers who do not use Sessio. We process their details only to understand and verify the specific work or recording; we do not create account-like records for them, rank them, contact them, or use their details for unrelated recommendations. If a name remains in a saved finding, we do not copy it out into anything else — who can see that finding is set out in full in the public notice below. Because individual notice would involve disproportionate effort, we rely on Article 14(5)(b) and provide this public notice as a safeguard.

Revoking access and deletion. You can delete any hunt finding or claim draft at any time in the Sessio app, and you can lower or withdraw an organisation's representation grant whenever you want, which stops that organisation's future hunts. Section 8 sets out how long we keep hunt data.

3.6 Places on the Sessio map

The Sessio app includes a map of professional music-industry places — studios, venues, music schools and industry organisations. For each place we show business information the place publishes itself — its name, the kind of place it is, city, website and an access label — with its location cited from OpenStreetMap (© OpenStreetMap contributors). Our sources are the places' own websites, official member directories and business registers.

The map never shows personal addresses or your location: this directory requests no location permission, and where a place appears to be run from a private home we do not show a street address at all. We show this directory to signed-in Sessio members on our legitimate interest (GDPR Art. 6(1)(f)) in helping working musicians find professional places. Because the information comes from what each place has published itself, this section serves as the public notice for the people behind those places (Art. 14(5)(b)).

If you run a listed place and want its entry corrected or removed, contact [email protected].

3.7 People on the Sessio map

If your profile is discoverable, you show up on the Sessio map as one face in your city's group, and in a city you have a public trip to while that trip is running. The map only ever shows the city: no street, no neighbourhood, no distance, and never where your phone is. Turn Discoverable off in Settings and you are off the map, the same way you leave Connect.

One thing on the map does use your location: tap the paper plane and Sessio asks your phone where you are, so the map can centre there and show the standard blue dot. That happens on your device and nowhere else. We never receive it, we never store it, and it never changes what you or anybody else is shown.

3.8 The Discogs artist index

Sessio keeps a searchable copy of the artist lists that Discogs publishes as open data once a month. Those lists describe about ten million people credited on records worldwide, almost none of whom use Sessio. For each person we copy only what Discogs already publishes: the Discogs artist number that appears in the address of their own Discogs page, the name shown there, any aliases and spelling variants recorded on it, their real name where Discogs publishes one, and the first 500 characters of their profile text. The lists carry no email addresses, no postal addresses and no phone numbers, and we do not go looking for any. This is separate from the public Discogs pages a hunt may read (section 3.5): these are the bulk lists Discogs publishes for anyone to download.

Why we keep it. Someone looking for money they are owed, or trying to credit the right person on a session, often has nothing to go on but a half-remembered or misspelled name. Searching our own copy answers that in an instant, which asking Discogs one name at a time cannot. We use it for that search and nothing else: we do not score or rank you, we do not build a profile of you, we add nothing Discogs has not already published, and we do not connect a Discogs entry to anybody's Sessio account. Results go only to the signed-in person who typed the name, never to an organisation.

Because Discogs refreshes these lists monthly, our copy can be up to a month behind, and every result we show says which monthly edition it came from. If something about you is wrong on Discogs, correcting it there carries through to us at the next refresh. We keep this copy on our legitimate interest (GDPR Art. 6(1)(f)) in helping musicians identify the right people and find money owed to them. Because the information comes from what Discogs publishes openly rather than from the people it describes, and because those lists carry no way of writing to the people in them, this section is the public notice for them (Art. 14(5)(b)).

How to be removed. Email [email protected] and ask to be taken out of the Discogs index. Send the name or a link to your Discogs page; you do not need a Sessio account and you do not need to give a reason. We delete the entry and record the removal, so the next monthly refresh does not bring it back. One limit, stated plainly: this removes you from Sessio's copy only. Your page on Discogs belongs to Discogs, and only they can change or remove it.

We rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and operate your account, enable discovery, connections, sessions, messaging, and send transactional emails.
• Performance of a contract (Art. 6(1)(b)), royalty and profile hunts — when you start a royalty or profile hunt, we process the external information objectively necessary to run that hunt and prepare the findings or drafts you requested.
• Consent (Art. 6(1)(a)) — to notify you about product updates if you opted in, send marketing newsletters, set non-essential cookies via the cookie banner, and enable the optional signals described under Collaboration-signal ranking in section 5 (opt-in). You can withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)) — for analytics and product improvement, fraud prevention and security, external email invites to non-members (subject to the safeguards described in Section 3.1), and collaboration-signal ranking in Find My Money (see Section 5).
• Legitimate interest (Art. 6(1)(f)), organisation-run hunts — when an organisation holding your approved representation grant starts a hunt for you, we process the external information necessary for Sessio's, your and the authorised organisation's legitimate interest in identifying royalties and professional credits that may belong to you. We notify you, limit the organisation's access to its grant, and allow you to object at any time.
• Legitimate interest (Art. 6(1)(f)), discoverability and session suggestions — when your profile is discoverable, we show it to other creators and to organisations using Sessio, and we may suggest it to an organisation planning a session (see Discoverability in section 5). We rely on Sessio's, your and the organisation's legitimate interest in collaborators finding each other for real work. You can turn discoverability off at any time, and you can object at the address in section 16.
• Legitimate interest (Art. 6(1)(f)), facts about works - we keep facts about works, recordings and collecting societies that we learn from what members upload (see Learning about works in section 5). We rely on our and every rightsholder's legitimate interest in accurate rights records, so that works are matched to the right people. Where a fact is worked out from a line of your own statement, the share and amount printed on that line are kept beside it as the inputs of the calculation (see section 5). You can object at the address in section 16.
• Legal obligation (Art. 6(1)(c)) — to retain financial and tax records under Danish law and to respond to legal process.

You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Your confirmation controls whether we add a suggested field or send a claim; it is not the legal basis for the earlier search and matching.

• Create and operate your account.
• Match you with collaborators via Explore (no automated decision-making with legal effects on you — Explore is a discovery surface, not an automated ranking with consequences).
• Schedule sessions; deliver invitations and reminders; auto-create group chats.
• Show availability and add your Sessio sessions to a connected Google Calendar, where you or your organisation have connected one (see Section 3.4).
• Send transactional notifications by push, email, or in-app.
• Keep the facts about works, recordings and collecting societies that we learn from what members upload, so that matching improves for everyone (see Learning about works below).
• Detect, prevent, and respond to abuse, fraud, and unauthorised access.
• Improve the Platform through aggregated analytics.
• Comply with legal obligations.

We do not sell your personal data. We do not engage in cross-site behavioural advertising. We do not make automated decisions that produce legal or similarly significant effects on you.

Discoverability. Being discoverable means other creators and organisations using Sessio can find your profile, and organisations planning a session can see you suggested as a collaborator. Organisations on Sessio are publishers and labels, and they can browse and search discoverable profiles from their own Sessio workspace when they are looking for someone to work with. If your profile is discoverable, you also appear on the Sessio map at the level of your city, as described in section 3.7. When an organisation is planning a session and looking for a collaborator outside its own roster, we may also suggest discoverable profiles that fit, ordered so the most experienced people appear first. Either way, what they see is your profile as it already appears on Sessio: your name, photo, professions and the other details you have put there. They never see your contact details or your rights identifiers, and they cannot reach you outside Sessio — an invitation comes to you on Sessio and you decide whether to accept it. We do this on our legitimate interest in helping people find collaborators for real work; you can object at any time at the address in section 16. You can turn discoverability off at any time in the Sessio app or on the web under Settings, and you stop appearing for all of it.

Royalty and profile hunts. We use the information described in section 3.5 to find works, recordings, credits and royalty pools that may relate to you, to propose profile enrichments you approve field by field, and to prepare your royalty claims. With your explicit authorisation — the claim mandate, which you can revoke at any time — Sessio's own team then files those claims with the collecting societies on your behalf, manually and one society at a time. Nothing is submitted automatically, and nothing is submitted without that authorisation. Every claim and its status is visible to you in the Sessio app. When you sign a mandate, the details you confirm in it — your name and any artist names, date of birth, address, e-mail, rights identifiers and society memberships — are what we send to the societies the mandate covers, and nothing else about you. Section 8 says how long we keep the signed document. Estimates shown in a hunt are indicative; collecting societies decide final amounts.

Learning about works from what members upload

When a member uploads a works list, a royalty statement or a rights export, we keep the facts it states about the works in it, and we keep them on the work, not on the member: the work's titles, its ISWC and the ISRC codes of its recordings, the writers and publishers registered on it with their roles and rights identifiers, the collecting societies' own work numbers, its releases, and how often its recordings were streamed or played. None of these facts includes a share or an amount. Each fact carries its source and the date we saw it, and a later file adds to what we know instead of overwriting it.

This is how Sessio gets better at matching works to the right people for every member: when one member's file carries an identifier that another member's copy of the same song was missing, both benefit. We rely on the legitimate interest described in section 4, and you can object at the address in section 16. We do not use your personal data to train AI models. When your account is erased, we delete the record that a fact came from you and keep the fact about the work, including a writer's listing on it as the register itself publishes it.

From a line of your own statement we also work out what the society paid for the whole work in that country, area and year, by dividing your amount by your share, and we keep that figure on the work. So that the arithmetic can always be checked, we keep beside it the share and the amount printed on your line, and the calculation with each input as your statement printed it. Where the statements of at least three members agree on what a play was worth in a country, area and year, we use that per-play figure to estimate what members may be owed; the estimate uses only that figure, never your share, your amount or your name. When your account is erased, the figure keeps the share and amount from your line beside it, and they no longer carry your name.

Collaboration-signal ranking (Find My Money)

We use two kinds of signals to help identify works where you may be missing a credit or royalty payment. First, we use your documented collaboration history—such as works, recordings, sessions, roles and credits, including the external-source information described in section 3.5—to rank possible matches and show relevant hunts. We rely on our legitimate interest in helping you identify and recover royalties, after balancing that interest against your rights and freedoms. You may object to this use at any time in the Sessio app under Settings → Privacy & Data, or by contacting us at the address in section 16; if you object, we will stop using your data for ranking entirely - both as a suggested candidate and as a signal for ranking others. (Signed agreements are still retained for their own contractual and legal-claim purposes.)

Second, if you actively opt in, we also use optional signals—including your follows, connections and selected profile details—to infer possible collaboration or rights links and improve the ranking of "Is this you?" suggestions. This optional use is based on your consent, is off by default and is not required to use Find My Money. You can withdraw your consent as easily as you gave it in the Sessio app under Settings → Privacy & Data, without affecting processing that lawfully took place before withdrawal.

Aggregated product-usage statistics

To decide what to improve next, we count how Sessio's features are used in aggregate: how many times a day a feature was used within an organisation's workspace - never who used it. These statistics are stored as daily counts per organisation and per feature; they contain no names, no message or search content, and no user-level identifier at all, so individual usage profiles cannot be built from them. Where an organisation's workspace is a single person, we treat its counts as personal data: they are deleted if the organisation is deleted, and daily counts are kept for at most 24 months before being reduced to monthly totals. We rely on our legitimate interest (Art. 6(1)(f)) in improving Sessio; these statistics are internal to Sessio, never sold, and never shared.

Email you send us

We use AI tools to sort the email that arrives in our own inboxes and to prepare draft replies - a person always reads and sends. These tools keep only neutral labels and short summaries (never sensitive content, which stays in the mailbox itself), deleted within 180 days, and nothing is ever used to train any model. We rely on our legitimate interest (Art. 6(1)(f)) in handling our correspondence - the same processing an assistant would do.

Fixing our own mistakes

We use AI tools to spot when our documentation or product copy is wrong or out of date - including by transiently reading conversations with our built-in assistant and email you send us. What we store is only a note of which page needs fixing, phrased neutrally - never your words, and never anything that identifies you. These notes are deleted once the fix is decided, or after 90 days at the latest.

We work with the following subprocessors, which process personal data on our behalf to provide their services to us. For each, we say what it does and, where it is established or processes data outside the EEA, the transfer safeguard we rely on.

• Servers and database (the Platform's application and the database behind it: accounts, profiles, sessions, messages, catalogues, findings and what we read from your uploads) - Hetzner Online GmbH (Germany; our servers run in Hetzner's data centre in Falkenstein, Germany, and the temporary servers we test backup restores on run in Hetzner's EU locations; no transfer outside the EEA).
• Network edge, file storage and backup storage - Cloudflare, Inc. (US company; EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as the fallback). Every request to sessio.io and to our API passes through Cloudflare's network, which decrypts and re-encrypts it at a location near you and protects the service from attacks. The files you upload (profile photos, session cover images, works lists, statements, agreements and other files) and our encrypted database backups are stored in Cloudflare's EU jurisdiction.
• Backup pipeline - GitHub, Inc. (US company; GitHub Data Protection Agreement with Standard Contractual Clauses). Our scheduled database backup runs on GitHub's servers: each backup streams through them without being stored there, and is encrypted before it is stored with Cloudflare.
• Website and web-app hosting (sessio.io, including the organisation workspace) - Vercel Inc. (US company; the website's servers run in the United States; Standard Contractual Clauses).
• Push notifications + mobile app build pipeline - Expo (650 Industries, Inc.) (US company; EU-U.S. Data Privacy Framework). Every notification carries the same generic text and a reference number, and the app fetches what happened once you open it, so no name or detail passes through Expo.
• Transactional email (account verification, password reset, magic-link invites, session reminders, in-app notifications) - Postmark, operated by AC PM LLC, part of ActiveCampaign (US company; EU-U.S. Data Privacy Framework, with Standard Contractual Clauses in the alternative).
• Waitlist signup + marketing newsletter delivery - EmailOctopus Ltd (UK / EEA; UK adequacy decision).
• Web analytics (cookieless) - Vercel Web Analytics (Vercel Inc.) (US company; Standard Contractual Clauses).
• Error tracking - Sentry (Functional Software, Inc.) (US company; error reports are stored in Sentry's EU region in Germany; EU-U.S. Data Privacy Framework). Receives technical reports when something in our systems fails, which can occasionally include an account identifier or a name that appears in the error.
• Ask Sessio, the assistant in the app and in the organisation workspace - Google (Gemini models on Google Cloud Vertex AI; US company; Google LLC is certified under the EU-U.S. Data Privacy Framework). Receives the conversation and the context needed to answer: what you type or say, any file you attach, and what the assistant looks up for you, such as your findings or your organisation's workspace data. When the assistant searches the web, Google Search runs the search. We call Vertex AI's global endpoint, so this processing is not limited to the EU. We are putting a data processing agreement in place with Google for this service.
• Other AI features (royalty and profile hunts, the assistant in Sessio Studio, working out which column is which in an uploaded works list, reading a publishing agreement you upload, and sorting email sent to us; and Ask Sessio when Google's service cannot answer) - Anthropic, PBC (US company; provider of the Claude models behind these features; Standard Contractual Clauses). Receives the prompt and the context needed to generate a response. Where our own rules cannot tell a works list's columns apart, it receives the list's header and up to three of its rows, with codes, rights identifiers, numbers, shares, dates and email and web addresses masked, but names and titles as written. For a publishing agreement, it receives the agreement's text, or the file itself when it is a scan or a photo. For a royalty or profile hunt that includes the professional name and identifiers being searched, and Anthropic's own web-search and page-fetch tools carry out the external lookups the hunt needs. Inputs and outputs sent through the API are not used to train Anthropic's models.
• Spoken questions and answers in Ask Sessio - ElevenLabs (Eleven Labs Inc.) (US company; Eleven Labs Inc. is certified under the EU-U.S. Data Privacy Framework). Turns a question you record into text, and reads an answer aloud, so it receives your recording and the text of the answer. We use its standard service, not an EU-only region, so it may process them in the United States, the EU or Singapore. ElevenLabs' terms let it use what it receives to improve its services and develop its AI models. We are putting a data processing agreement in place with ElevenLabs.
• Our own mailboxes (email you send us) - Microsoft (Microsoft 365; Microsoft Products and Services Data Protection Addendum; EU-U.S. Data Privacy Framework, under which Microsoft Corporation is certified).
• Identity checks (see Identity check in section 3.1) - Didit Identity Spain, S.L. (Spain). Receives the photos of your identity document and your face that you take on its page, checks them, and compares your face with the faces from earlier checks for Sessio. By default, Didit may also use anonymised or pseudonymised data from checks to train its own models, which it does as a separate controller. We are putting a data processing agreement in place with Didit.
• Google Calendar integration (optional workspace availability and session sync) - Google Ireland Limited / Google LLC (EU / US company; EU-U.S. Data Privacy Framework, under which Google LLC is certified). Google acts as the provider of your own connected calendar account rather than solely on Sessio's instructions; see the note on connected calendars below.
• Billing and subscription payments (publisher subscriptions) - Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (US company; Standard Contractual Clauses). Handles checkout, card processing, and recurring billing; Sessio does not store full card numbers.
• Electronic signature of mandates - DocuSign, Inc. (US company). Receives the mandate text and the details you confirm in it, records the signatures and returns the signed document; nothing else about you goes there. We are putting a data processing agreement in place with DocuSign before the first mandate is signed through it.
• Cookie consent banner (sessio.io) - implemented in-house; no third-party vendor.

Note on push notifications. When we send a push notification, the message is routed through Expo's push service, which then delivers it to Apple Push Notification service (APNs) for iOS devices or Firebase Cloud Messaging (FCM, a Google service) for Android devices. Apple and Google act as upstream subprocessors of Expo for this purpose; their own privacy practices apply to the delivery leg.

Note on connected calendars. Where you connect a Google account (Section 3.4), Sessio exchanges data with the Google Calendar API — provided by Google Ireland Limited / Google LLC — to read availability from and write your Sessio session events to the calendars you map. Google processes that data as the provider of your own calendar account, under Google's own terms and privacy policy, and is not a subprocessor acting solely on Sessio's instructions.

A current list of subprocessors is available on request at [email protected]. We update this list whenever processor relationships change and will notify users by email of material changes.

Other disclosures

• Legal obligation: we may disclose data if compelled by a court order, subpoena, or legal authority.
• Business transfer: if Sessio is acquired or merges with another company, your data may transfer to the new entity. We will notify you before any change of controller affects you.
• With your consent: if you ask us to share your data with a third party for a specific purpose.
• Organisations you have authorised: an organisation holding your approved representation grant receives only the hunt results and supporting information permitted by that grant. It is a separate controller for its own use of those results.
• External sources we search: when a hunt runs, the name and professional identifiers being searched are sent to the register or data provider being searched.
• Collecting societies and registers: where you have signed a mandate, we send the society it covers the signed mandate, the details you confirmed in it and the claim or registration you asked us to file, through that society's own route; the society is a separate controller for what it does with them. Without a mandate we disclose only the claim information you choose to submit outside Sessio. Your bank details go only on a society's own affiliation form where that form requires them, so the society can pay you directly; they are never part of a claim.

Where possible, we keep your data within the EEA at rest. Our servers and database run with Hetzner in Germany, the files you upload and our encrypted backups are stored in Cloudflare's EU jurisdiction, and error reports are stored in Sentry's EU region in Germany.

Some of our subprocessors are established outside the EEA, or process data outside it: Cloudflare's network edge serves each request from a location near the person making it, Vercel runs our website's servers in the United States, and Ask Sessio runs on Google's global Vertex AI endpoint. For each transfer we rely on a mechanism under GDPR Chapter V, named per provider in Section 6: an adequacy decision (the EU-U.S. Data Privacy Framework for certified US companies, and the UK adequacy decision for EmailOctopus) or the European Commission's Standard Contractual Clauses (SCCs), except where Section 6 says we are still putting a data processing agreement in place.

International hunt searches. When you ask us to run a hunt, the search may send terms such as your professional name or identifiers to a register or collecting society outside the EEA. If that specific transfer is not covered by an adequacy decision or another transfer safeguard, we make it only where necessary to perform the service you requested, take steps at your request, or conclude or perform a contract in your interests (Article 49(1)(b) or (c)). Sessio's own storage of your data sits with the providers, in the regions and under the transfer mechanisms listed in Section 6.

A complete and current list of subprocessors, the regions they use, and the applicable transfer mechanism is set out in Section 6 above and available on request at [email protected].

When you close your account we keep it for a 30-day grace period so you can change your mind, and then we hard-delete your active data. Encrypted backups are held with our infrastructure providers as recovery points and roll off within 190 days; if we ever restore from a backup, we re-apply every deletion made since that backup was taken.

If an operator at Sessio deactivates your account and you have not asked us to erase it, we keep it for three years from your last activity, the ordinary Danish limitation period, so you can come back and any open claim keeps its evidence. After those three years we erase your personal data. What your scans found about works, recordings and royalty pools stays, because those are facts about the work rather than about you, and they no longer carry your name.

The same holds for what we learned from your uploads about works, recordings and collecting societies (see Learning about works in section 5): an erasure deletes the record that a fact came from you, and the fact stays on the work. A figure worked out from your statement keeps the share and amount from your line beside it, without your name.

• Account credentials (email, password hash) — until account closure, then deleted at the end of the 30-day grace period.
• Profile information (photo, bio, professions, etc.) — until account closure, then deleted at the end of the 30-day grace period.
• Uploaded images (profile photos, session cover images) — until you delete them; otherwise deleted with your account at the end of the 30-day grace period.
• Works lists, royalty statements and rights exports you upload or paste - kept: the text and rows we read from them, and the file itself where we store it. No clock deletes them. They are deleted, with what we read from them into your account, when your account is erased (at the end of the 30-day grace period, or, if an operator deactivated your account, three years after your last activity). If you ask us to delete your works lists while keeping your account, we delete the lists, the files they came from and the text we read from them, and, if you ask for this too, the works they added to your catalogue; an earlier reading of a list that we replaced with a new one, and your choice of which column held what in that kind of file, stay until your account is erased. What we learned from your files about works stays on the work (section 5). If a person named in one of your files asks us to erase or correct their details, we take them out of what we read from it and delete the file, because a file cannot be edited; their listing on a work as a register publishes it stays on the work.
• Publishing agreements you upload - kept, with the terms read from them and what you confirmed or corrected, until your account is erased; then the file and everything read from it are deleted.
• Files attached to an Ask Sessio conversation - the file is deleted 7 days after you attach it. In the organisation workspace, the text the assistant read from the file is part of the conversation and is kept with it (next line). What you saved from a file stays where you saved it, for example a recording saved to a song as an audio version.
• Ask Sessio conversations - in the app, a conversation is kept on your device and our servers keep no copy of it. In the organisation workspace, each question the assistant answers on our servers is kept with the conversation before it and the text it read from any attached file, until the account of the person who asked is erased or the organisation's workspace is deleted.
• Personal data an organisation's workspace holds on the organisation's behalf - returned or deleted, at the organisation's choice, when its use of Sessio ends, typically within 30 days of the end of the wind-down period (Section 9 of our Data Processing Agreement).
• Sessions, messages, chat threads — until you delete your account, then deleted at the end of the 30-day grace period (subject to other collaborators' active participation).
• Hunt findings and claim drafts — for as long as your account is open, because claim windows can run for years and the finding is your own evidence record. You can delete any finding or draft at any time.
• Identity checks - the result of each check, and the matched writer name where there is one, for as long as your account is open; deleted when your account is erased. We do not keep the photos.
• Accounts an operator has deactivated, where you have not asked for erasure — three years from your last activity, then erased; what your scans found about works stays, without your name.
• Rejected suggestions — removed from your active results immediately. We keep only the source, the identifier and the fact that you rejected it, for as long as your account is open, so the same suggestion does not come back.
• Anonymous find-my-money scans on sessio.io (no account) — not stored: we do not save the name typed or the results returned.
• Accepted agreements and authorisations (splits, claim authorisations) — for the life of the agreement plus the applicable limitation period.
• Signed mandates (the power of attorney you sign so that Sessio can file with a collecting society for you) — the signed document and the details you confirmed in it, for the life of the mandate and three years after it ends, because a society may question a filing within that time and the document is the evidence (GDPR Art. 17(3)(e); forældelsesloven § 3). After that we erase the document and your details and keep only the mandate's reference number, the societies it covered, its dates and a fingerprint (hash) of the signed file, so a society holding its own copy can still verify it; none of that names you.
• External-invite emails — 30 days from invite if the recipient has not signed up; longer if the recipient signs up and joins the session.
• Connected Google Calendar tokens and calendar-mapping data — until you disconnect the calendar or delete your account, then revoked and deleted promptly.
• Server logs (IP, request data) — 30 days.
• Analytics in identifiable form — maximum 14 months.
• Analytics aggregated or anonymised — indefinitely.
• Support emails and tickets — 3 years (statute of limitations).
• Cookie consent records — 12 months.
• Marketing email subscribers — until you unsubscribe.
• Records of paid usage of the built-in assistant, counted per organisation for its invoice — with that organisation's financial records (next item), because the invoice must remain verifiable. After your account is erased they no longer carry your user identity; where the organisation is a one-person organisation, its record may still point to you until that period ends.
• Tax and financial records — 7 years (Danish tax law).

After the retention period, data is deleted or irreversibly anonymised.

You have the following rights regarding your personal data:

• Access — receive a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion, subject to retention obligations described in Section 8.
• Restriction — ask us to limit how we use your data while a dispute or correction is pending.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Object — object to processing based on legitimate interest, including direct marketing (see below).
• Withdraw consent — where we rely on consent, you can withdraw it at any time.
• Lodge a complaint about our use of your personal data with Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark (www.datatilsynet.dk), or with another EU supervisory authority.

Your right to object. You can object at any time to processing we base on legitimate interest, including direct marketing. Three of these have their own controls. Collaboration-signal ranking (section 5): if you object in the Sessio app under Settings → Privacy & Data, we stop using your data for ranking entirely. Hunts an organisation runs for you (section 3.5): if you object in the same place, we stop future organisation-run hunts about you and stop organisations receiving further results from them, and hunts you start yourself are unaffected. Discoverability and session suggestions (section 5): turn "Discoverable" off in the app or under Settings on the web and you stop appearing in Discover and in suggestions immediately; you can also object at the address in section 16 without turning discoverability off.

To exercise these rights, email [email protected] with "GDPR Request" in the subject line. We respond within 30 days. If your request is complex, we may extend by up to two further months and will explain why. For collaboration-signal ranking and for hunts an organisation runs for you, you can also use Settings → Privacy & Data in the app. Sessio answers these requests for everything held in Sessio, including hunts an organisation started for you; you do not need to go through the organisation.

Limits on erasure

We cannot fully delete information where:

• It is required by law (e.g. tax records for 7 years).
• It is needed to establish, exercise, or defend legal claims.
• A hold is in place because a legal claim, a dispute or an inquiry from an authority requires the data (GDPR Art. 17(3)(e)). A hold is placed only by a founder of Sessio, in writing, with its reason and a review date, and we tell you within one month of your request why we cannot erase yet and how to complain (GDPR Art. 12(4)).
• A signed mandate is still in force: an erasure request also revokes the mandate (we stop filing and notify the societies it covers), and the signed document is then kept as section 8 describes.
• Other users actively rely on it — for example, your participation history in a session you co-hosted. In such cases your name may be replaced by an anonymous identifier ("Former Collaborator") on shared records while the activity history remains.
• It is a record that you rejected a suggestion, kept only so the same suggestion does not return. You can ask us to delete it, but the suggestion may then reappear.
• It is a name inside a saved hunt finding, where removing it would destroy another person's record of the work or recording.

Supervisory authority

You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):

• Datatilsynet — Carl Jacobsens Vej 35, 2500 Valby, Denmark
• Email: [email protected]
• Phone: +45 33 19 32 00
• Website: www.datatilsynet.dk

On sessio.io, we use cookies in three categories: strictly necessary, analytics (optional), and marketing attribution (optional). The cookie banner controls non-essential categories. Preferences can be changed at any time via "Cookie settings" in the footer.

We do not use cookies for cross-site advertising, behavioural retargeting, or the sale of data to third parties.

The cookie banner on sessio.io is implemented in-house — there is no third-party consent management vendor.

Our chosen web analytics provider (Vercel Web Analytics) is cookieless: it does not set any cookies, does not use local storage, and does not assign persistent identifiers to visitors. It uses a daily-rotating salted hash of IP + user agent for de-duplication only, which cannot be linked back to an individual visitor across days. We therefore do not place analytics cookies on your device.

The mobile app does not use browser cookies. It uses platform-standard SDK identifiers (e.g. Apple's IDFA, Google's Advertising ID) only if you grant permission via the iOS/Android consent prompt, and only for the purposes disclosed in this Privacy Policy.

Sessio accounts are for people 18 or older, and we do not knowingly accept sign-ups from anyone under 18. External music-industry records we process for a hunt can name people of any age; we use those names only as described in section 3.5. If you believe we hold a child's data, contact [email protected] and we will remove it.

We apply reasonable technical and organisational measures to protect your personal data from loss, misuse, unauthorised access, alteration, and disclosure, including:

• In transit: HTTPS / TLS encryption for all connections to the Platform.
• At rest: industry-standard encryption applied by our hosting providers to data stored on their infrastructure.
• Authentication: passwords are stored as salted hashes only — never in plaintext.
• Access controls: access to production systems and user data is limited to authorised staff who need it to perform their roles.
• Patching: we apply security updates and patches to our systems as they become available.

No security system is completely perfect. If you believe your account or our security has been compromised, contact [email protected] immediately.

The Platform contains links and embeds from third-party services — including Spotify, SoundCloud, App Store, Google Play, partner organisations, and links to the external sources behind hunt results (section 3.5). Their privacy practices are governed by their own policies:

• Spotify: https://www.spotify.com/legal/privacy-policy/
• SoundCloud: https://soundcloud.com/pages/privacy
• Apple (App Store, APNs): https://www.apple.com/legal/privacy/
• Google (Play, Firebase): https://policies.google.com/privacy

Embedding a Spotify or SoundCloud track on your profile causes those services to load content directly when other users view your profile. They may set their own cookies or process IP addresses according to their policies.

We send marketing emails only to people who have opted in, for example via the waitlist signup on sessio.io or an in-app preference. You can unsubscribe at any time using the link in any marketing email or by emailing [email protected].

The find-my-money deep-scan waitlist is separate and single-purpose. If you join it, we use your email address only to send one availability notice and then delete it, unless you explicitly opt in to further waitlist communications. Our marketing newsletter is separate and requires its own consent.

We will continue to send transactional emails — account verification, password reset, session invitations, session reminders, request approvals — regardless of marketing-email status, because they are necessary for the Platform to function. Finer-grained notification controls will be added to in-app settings in a later release.

We may update this Privacy Policy as our practices evolve or as required by law. If we make a material change to this policy, we will notify you in the product or by email before the change takes effect. Routine or non-material changes take effect when the updated policy is posted, with the effective date shown above.

Where the law requires us to tell you individually about a new use of your information, including the royalty and profile hunts described in section 3.5, we notify you individually before that processing starts. That notice is not subject to the qualification above.

For privacy questions or to exercise GDPR rights:

• [email protected]
• Sessio ApS, Burmeistersgade 2, 1. th, 1429 København K, Denmark

For general support: [email protected].