Privacy Policy

Last updated: 5 October 2026

Who we are

This policy explains how Sessioned Ltd ("Sessioned", "we", "us") collects and uses your personal data. Sessioned Ltd is the data controller for the personal data described here. We are a company registered in England & Wales (company no. 17253480), with our registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the UK Information Commissioner's Office (ICO), registration reference ZC172644. Our data protection contact is Archie Perkins — hello@sessioned.co.uk.

1. Information We Collect

Account information: When you sign up, we collect your name, email address, and password. Tutors also provide qualifications, subjects, and profile photos.

Enquiries, without an account: You can ask us to find you a tutor without signing up. When you do, we collect your first name (optional), your email address, and whatever you tell us about the subject, level and what you are looking for — which usually concerns a child's education. We use it to produce your tutor matches and to reply to you. The same applies to the contact form and to the free revision planner, where we collect only an email address.

Payment information: Payment card details are collected and processed securely by Stripe. Sessioned does not store your full card number or bank details.

Usage information: We collect data about how you use the platform, including pages visited, searches made, sessions booked, and messages sent.

2. How We Use Your Information

We use your information to: provide and improve the Sessioned platform; process bookings and payments; match students with relevant tutors; send booking confirmations and reminders; respond to support requests; prevent fraud and ensure platform safety.

Our lawful bases (UK GDPR Article 6): performance of our contract with you (creating your account, processing bookings and running sessions); our legitimate interests (operating, securing, improving and promoting the platform, and preventing fraud); your consent (for non-essential cookies and any optional marketing — which you can withdraw at any time); and compliance with a legal obligation (for example, keeping financial records). Where we process a child's data, we rely on the consent of their parent or guardian.

3. Information Sharing

We do not sell your personal information. We share limited information with the following processors and parties: Stripe (payment processing), Supabase (database, authentication and file hosting), Resend (transactional email delivery), MailerLite (sending the free revision planner and our newsletter, if you ask for them), Netlify (website hosting), and 8x8 / Jitsi (running your live video sessions); and with tutors (your name and session details when you book). Tutor profiles, including name, photo, qualifications, and reviews, are publicly visible on the platform.

International transfers: some providers (for example Stripe for payments, and our email and hosting providers) may process data on servers outside the UK, including in the United States. Where data is transferred outside the UK, we rely on appropriate safeguards — such as the UK's adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses — to keep your data protected.

4. Data Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS), secure password storage, and regular security reviews. Payment processing is handled entirely by Stripe, which is PCI-DSS Level 1 certified.

5. Your Rights (GDPR)

If you are in the UK or EEA, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; object to or restrict processing; receive your data in a portable format. To exercise any of these rights, contact us at hello@sessioned.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113 — though we'd appreciate the chance to resolve your concern first.

6. Children's and Young People's Data

Sessioned is used by children and young people under 18, and protecting their data is something we take particularly seriously. Under UK GDPR, children's personal data is given special protection, and the following applies.

Accounts for under-18s must be created and managed by a parent or guardian. When you sign up on behalf of a child, you do so as their parent or guardian and you provide consent for us to process their data for the purpose of arranging and delivering tutoring sessions.

For a child using Sessioned, we may process: the child's first name, year group or academic level, the subjects they are studying, their bookings and session history, messages they exchange with tutors through the platform, and any session notes a tutor records. We collect only what we need to connect the child with a tutor and run their sessions. We do not use children's data for advertising or profiling, and we never sell it.

A child's session activity takes place on the Sessioned platform, with messaging kept on-platform. Where a parent or guardian holds the account, they can see every message their child exchanges with a tutor. Where a young person has their own account, a parent can ask us to link it to theirs so they have the same visibility — email us and we will arrange it. Accounts are not linked automatically.

As the parent or guardian, you have the right to access the personal data we hold about your child, ask us to correct it, request its deletion, or withdraw your consent at any time. To do any of these, contact us at hello@sessioned.co.uk and we will respond promptly.

If you believe a child's data has been provided to us without appropriate parental consent, please contact hello@sessioned.co.uk and we will remove it.

7. Cookies and similar technologies

Essential cookies keep you logged in, remember your preferences and keep the platform secure. They are necessary for Sessioned to work, so they are always on and do not require your consent.

Nothing else loads unless you choose “Accept All” on our cookie banner. If you choose “Essential Only”, no analytics or advertising technology is loaded at all — no scripts, no cookies, and no data sent to anyone.

Plausible Analytics. With your consent, we use Plausible to understand which pages are visited and how people move through the site.

The Meta Pixel. With your consent, we load the Meta Pixel (Meta Platforms Ireland Ltd) so we can tell whether our Facebook and Instagram advertising actually leads to tutoring enquiries rather than just clicks. It sets cookies on this site — _fbp, and _fbc if you arrived from a Meta advert — and tells Meta your IP address, which page you are on, and when you have submitted an enquiry. We do not send Meta your name, your email address, your phone number, any details about your child, the subject or level you asked about, or anything you typed into a form. We do not use Meta's optional “advanced matching” feature, which would involve sending your email address or phone number. No information about a child is sent to Meta or to any other advertising platform.

Changing your mind. Select Cookie settings in the footer of any page on this site, at any time. Choosing “Essential Only” there deletes the Meta cookies we have set and reloads the page so that nothing further is loaded or sent — withdrawing consent is as easy as giving it. You can also review Meta's own tracking in your Facebook ad preferences, and block or delete cookies in your browser settings.

8. Data Retention

We retain your account data for as long as your account is active. You can delete your account at any time from your account settings, or by emailing us.

What we remove when you delete your account. Your profile, your login and password, the messages you have written, any enquiries you submitted and any contact-form messages you sent us from that email address, and the sign-in rate-limit counters we hold against that address. Our tutor-matching records, and any entry in our security log that recorded your email address, are stripped of the address so that what is left cannot be traced back to you.

What we keep, and why. Deleting an account does not erase every trace of it, and we would rather set out the exceptions here than imply otherwise.

Bookings and payments. We do not delete these. UK tax and accounting law requires us to keep records of money taken in and paid out, so the date, the amount, the fee, any note you added at the time and the Stripe reference are kept — for as long as the law requires us to keep financial records, and for nothing else. Because those records exist, an account that has had a session cannot be deleted automatically; see the last paragraph. Stripe, which processes our payments, keeps its own records of those payments under its own obligations: deleting your Sessioned account does not delete them, and we cannot delete them on your behalf. If you are a tutor, the payout account you set up with Stripe is a separate thing, and that one we do close for you when you delete your account. If Stripe will not close it, most often because it still holds money owed to you, we stop and tell you rather than report it as done: your login keeps working, and we finish it by hand once the balance has been paid out to you.

Messages other people sent you. These remain part of that person's own record of the conversation, but are no longer linked to your identity. If a message has been preserved as part of a safeguarding or abuse report, it is kept as evidence of that incident; we will tell you if that applies to you.

The record of the deletion itself. We keep a note that the request was made and honoured, and what was removed. It holds your former account's internal reference and the counts — never your name and never your email address — and it cannot be edited or deleted by anyone, which is the only thing that makes it worth keeping.

Anonymous statistics and anti-abuse records. Page-visit records carry no account identifier, so once your account is gone they cannot be tied back to it; if you accepted analytics cookies they include a random visitor ID stored in your own browser, which you can clear whenever you like. Rate-limit records kept against internet addresses are shared by everyone using that address and are not linked to you.

A photo you uploaded. Deleting your account removes the profile that displayed it, so it is no longer shown anywhere on Sessioned — but the image file itself stays in our file storage, where anyone who already has its direct link can still reach it, until we delete it. Email us and we will remove it.

If we cannot finish it automatically. Some accounts cannot be deleted by the automatic process, most often because a past session is attached to them: the booking, the payment and any review, feedback or session note recorded against it cannot be unpicked on their own. When that happens we stop rather than report a deletion that did not happen. You will see a message with a reference, your login deliberately keeps working so that you can chase us, and we finish the rest by hand and confirm exactly what was removed and what had to stay. Your request is recorded either way.

If you would like a copy of the personal data we hold about you, or want it corrected, contact hello@sessioned.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or a notice on the platform.

10. California Residents (CCPA/CPRA)

Sessioned is operated from the United Kingdom and is intended for users in the UK. If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to or deletion of that information, and not to be discriminated against for exercising your rights. We do not sell your personal information as that term is defined under the California Consumer Privacy Act (as amended by the CPRA). If, and only if, you consent to advertising cookies, our use of the Meta Pixel (section 7) discloses online identifiers to Meta for advertising measurement — which the CPRA may treat as “sharing” for cross-context behavioural advertising. You can stop it at any time by selecting Cookie settings in our footer and choosing “Essential Only”. To exercise any of these rights, contact us at hello@sessioned.co.uk.