Legal

Privacy Policy

Effective October 31, 2026 · Version 2026-10-31

SESI is built to keep your work on your own computer. This policy explains what the SESI website and our online services collect, why, who helps us run them, how long we keep it, and the choices and rights you have.

1. Who we are

SESI is made by SESI.AI LLC, a Florida limited liability company, 5049 NE 48th Court, High Springs, Florida 32643, United States (“SESI”, “we”, “us”). We are the controller of the personal information described here. This policy covers www.sessi.ai, SESI accounts and billing, and the online services the SESI desktop app uses. Section 3 explains what the desktop app keeps on your computer and what leaves it.

Accounts and purchases are currently offered only to people in the United States. We have not appointed a data protection officer or an EU or UK representative; we will name representatives before offering accounts or purchases in the EU or UK, or sooner if the law requires.

2. What we collect

We aim to collect only what each feature needs.

Early access and the waitlist

Your email address, where you signed up (for example the website or a download), the date, your email topic choices, and whether our welcome email was delivered.

Contact form

Your name, email address, optional company and your message, plus a hashed form of your IP address that we use to limit abuse of the form. The hashed IP address is still treated as personal information.

Your SESI account (when accounts are available)

Your email address; the one-time sign-in codes we email you, stored only as secure hashes; the IP address of each sign-in request, used to limit repeated attempts; and your signed-in sessions, with a device name and when each was last used. Session tokens are stored only as secure hashes. If you sign in with another provider, Section 7 lists what we receive.

Linking the SESI desktop app

The device name you give it, the app version, your operating system, a public device key that proves the app is yours (the private key never leaves your computer), and when the app last checked in.

Credits and payments (when purchases are available)

Payments are processed by Stripe on its own secure page; we never see or store your card number. We send Stripe your email address and SESI account ID, and we keep the payment and subscription references Stripe returns, what you bought, your credit balance, and records of which features used credits, how many and when, including technical details the app reports about each task.

Bug reports you send

The title, description, severity and any attachments you choose to include, with your app version and operating system.

Email you send us

If you write to an @sessi.ai address, we keep your message so we can reply.

Service and security logs

Our servers record technical information such as the time and type of each request, your IP address and browser type, error details, and security events such as sign-ins, sign-outs, device links and changes to sign-in methods. These records can include your account identifier or device name. Our servers automatically remove email addresses from application logs before they are written; if any personal detail is recorded by mistake, it is deleted with the logs.

This website uses no advertising trackers, analytics scripts, tracking pixels or third-party fonts as of the date above.

3. The SESI desktop app

The app keeps your workspaces, files, conversations and settings on your own computer. We do not receive this content unless you send it to us, for example in a bug report.

AI model providers and tools you choose. When you ask SESI to plan, write or act, the app sends your instructions and the workspace content a task needs (which can include text, files, screenshots or transcribed speech) from your computer to the AI model provider or tool you have configured, under your own account with that provider. That provider handles the content under its own terms and privacy policy, including whether it keeps it or uses it for training. We are not a party to that exchange and do not receive a copy.

Camera, microphone and screen. These features are off until you turn them on. With your permission the app can use your camera to notice whether you are present, your microphone for voice, and screen capture so agents can see what you are working on. A separate User recognition setting, also off by default, lets the app recognize you on camera. This processing happens on your computer, or with the AI provider you choose when a task you start needs it. SESI’s servers do not receive camera images, voice recordings, screen captures or recognition data from these features, and we do not receive, store, sell or share biometric information. The only way such content reaches us is if you choose to attach it to a bug report. Camera images, voice and screen content leave your computer only when a task you start sends them to your chosen AI provider. You can turn each of these off at any time in the app and in your operating system’s privacy settings.

Updates and linking. When the app checks for or downloads updates, our servers see your IP address, app version and operating system. If you link the app to your account, we receive the details listed under “Linking the SESI desktop app”, and the app reports usage records for billing as described under “Credits and payments”.

4. How we use it, and why

We do not sell your personal information, use it for targeted advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic limits on repeated sign-in attempts or form submissions are temporary security measures. Where the law asks for a legal basis, these are ours:

You do not have to give us information, but some features need it: we cannot create an account or send early-access email without your email address, or complete a purchase without the details Stripe needs.

5. Cookies and browser storage

This website uses no advertising or analytics cookies. It stores only what it needs to work, all of it strictly necessary or requested by you:

• your language choice (sesi-locale) in your browser’s local storage, until you clear it;
• when you sign in, your session token and account email (sesi_web_token, sesi_web_email) in local storage, until you sign out or the session ends, and the page to return to after sign-in (sesi_sso_next) in session storage, until you close the tab;
• during a sign-in with another provider, one secure cookie (sesi_oauth_bind) for 15 minutes, which ties the sign-in to your browser;
• if a page saves your progress for you, one secure cookie (__Host-sesi_sid) that identifies that saved state, for up to 30 days.

Signing out ends your session on our servers and removes it from your browser, and the Security page lets you end any of your sessions. You can also clear this storage in your browser settings at any time.

Do Not Track and Global Privacy Control. We do not track you across other websites or let others do so, so this website works the same whether or not your browser sends a Do Not Track signal. We do not sell personal information or share it for cross-context behavioral advertising. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of any sale or sharing, which we already do not do.

6. Who we share it with

We share personal information only with providers who help us run SESI, under their own privacy and security commitments, and only as needed:

• Amazon Web Services: hosting, databases, file storage and email delivery.
• Stripe: payment processing, when purchases are available. Stripe also uses payment information under its own privacy policy, including to prevent fraud.
• Google: email sent to our @sessi.ai addresses is stored on Amazon Web Services, and a copy of each message, and of our replies, is forwarded to a team mailbox in a standard Google account. Google holds that copy under its own terms and privacy policy, not under a data processing agreement with us, and it may be stored in the United States or other countries.
• Sign-in providers you choose: only to complete the sign-in you start (see Section 7).
• GitHub: when you send a bug report, we open a tracking issue in our private GitHub repository. It contains a category and a reference number that does not identify you, and may contain your description with email addresses and phone numbers automatically removed. Anything else you type into the description, such as a name, may appear in it, so please leave out personal details you do not want shared. Your account details, email address and attachments are not sent to GitHub. GitHub stores the issue under its own terms and privacy statement.
• Professional advisers, such as lawyers and accountants, where needed.

We may also disclose information when the law requires it or to protect people’s safety. If SESI is involved in a merger, acquisition or sale of assets, information may be transferred as part of it; the recipient must continue to protect it as described here, and we will tell you before it becomes subject to a different policy.

7. Sign-in and social platforms

Google. If you sign in with Google, we request only basic profile access (openid, email and profile) and receive your Google account ID, email address, whether it is verified, and your name. We use it only to create your SESI account and sign you in; we do not request access to your Gmail, Drive, Calendar or contacts. We keep it with your account and delete it when you unlink Google or delete your account. SESI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models, and no one at SESI reads it except as needed for security, to comply with the law, or with your permission.

Apple. If you sign in with Apple, we receive an Apple user ID and either your email address or a private relay address that Apple forwards to you, plus your name if you choose to share it. If you use a relay address, we send email to it and do not try to discover your real address.

Facebook. If you sign in with Facebook, we receive your app-specific Facebook user ID, name and email address, if you allow it. We use them only to create your account and sign you in; we never post to Facebook for you or access your friends, photos or pages. You can remove SESI in your Facebook settings under Apps and Websites, and delete the information we received as described in Section 10.

Microsoft, GitHub and X. If you sign in with one of them, we receive your account ID with that provider, email address, whether it is verified, and your display name or username, and use them only to sign you in.

Our own social accounts. We use the official tools of Instagram, Facebook, X and LinkedIn to publish SESI’s own blog posts to SESI’s own accounts and pages. These connections use access only to SESI’s accounts. We do not use them to collect or store information about you or other people on those platforms, and we do not offer sign-in with LinkedIn or access LinkedIn member data. If you comment on or message our pages, that happens on the platform under its privacy policy.

8. How long we keep it

• Waitlist and email preferences: until you ask us to delete them or we end the early-access program. After you unsubscribe, we keep your record marked as unsubscribed so we never email you again.
• Contact messages and email to @sessi.ai addresses: as long as needed to handle the conversation and any follow-up, and no more than 24 months after it ends unless we need it for a legal claim. The hashed IP address from the contact form is kept with the message.
• Sign-in codes and the IP address of a sign-in request: set to expire 24 hours after the code is created, and removed automatically by our database shortly afterward, typically within a few days.
• Sessions: they end after 30 days without use, and at most after 180 days.
• Linked devices and sign-in provider connections: until you remove them or delete your account.
• Bug reports: attachments are deleted automatically about 30 days after upload, and backup copies within a further 7 days; the report text is kept until the issue is resolved and no more than 24 months.
• Account, purchase, credit and usage records: while your account is open. After it closes, purchase records are kept as long as tax and accounting law requires, usually 7 years; other account records are deleted or de-identified.
• Service logs: deleted automatically after 30 days. Security event records: kept while your account is open, and deleted or de-identified when you delete your account.
• Backups: deleted information can remain in encrypted backups for a limited time until they are overwritten.

9. Your choices and rights

• Email: every marketing and early-access email has a one-click unsubscribe link and a link to choose your topics or pause email. Unsubscribing stops those emails, normally right away and always within 10 business days. We still send messages you need, such as sign-in codes, receipts and security alerts.
• Account: on your Security page you can sign out of devices and unlink sign-in providers.
• Your rights: you can ask for a copy of your personal information, ask us to correct or delete it, and ask us to send it to you or another service in a portable format.

Depending on where you live, including the European Union, the United Kingdom and US states such as California, you may have further rights, such as to restrict processing or to opt out of sale, sharing, targeted advertising or profiling (which we do not do). We respond to requests from any user, wherever you live. We may decline a request where the law allows, for example if we must keep information for legal reasons, cannot verify your identity, or the request is manifestly unfounded or excessive, and we will tell you why. We will not deny you service, charge you a different price or give you a lower quality of service because you used a privacy right, unless using it makes the service impossible; for example, deleting your account ends your access.

Right to object. Where we rely on legitimate interests, you can object at any time on grounds relating to your situation, and we will stop unless we have compelling legitimate grounds or need the information for legal claims. You can always object to marketing email, and we will stop sending it.

How to make a request. Email sess@sessi.ai or use the contact form. To protect you, we confirm the request comes from you, usually by replying to your account email or asking you to confirm a sign-in code; we never ask for a password. You can use an authorized agent: we will ask for your signed permission and may ask you to confirm your identity with us directly. We respond within one month, or 45 days where US state law applies, and may extend this as the law allows if a request is complex; if we do, we will tell you why.

Appeals and complaints. If we decline your request, you can appeal by replying to our decision with “Appeal” in the subject; we answer appeals within 45 days, extended by up to 60 more days where the law allows. If you are still not satisfied, you can contact your state Attorney General, or, in the EU, EEA or UK, the data protection authority where you live or work, or the UK Information Commissioner’s Office. We would appreciate the chance to fix things first.

10. Deleting your data

To delete your data, including anything we received when you signed in with Google, Apple, Microsoft, GitHub, Facebook or X, email sess@sessi.ai with the subject “Delete my data” from the address you used with SESI. If you cannot email from that address, for example because you used Apple’s Hide My Email, tell us which sign-in you used and we will verify you another way, such as with a sign-in code. If you signed in with Facebook, you can also start by removing SESI in your Facebook settings under Apps and Websites.

We confirm the request is yours, then delete or de-identify your account, sign-in connections, waitlist entry, messages and bug reports, including the matching GitHub tracking issue and copies in our mailboxes, and reply within one month. We keep only what the law requires, such as purchase records, and deleted information leaves our backups as they are overwritten. Stripe keeps its own records of payments under its privacy policy and the law. Information the SESI app stores on your own computer stays there until you delete it or uninstall the app.

11. California and other US states

California residents. In the last 12 months we collected these categories of personal information, from you, from your browser or device, and from sign-in providers you choose:

• Identifiers: name, email address, account and device IDs, sign-in provider IDs, IP address.
• Customer records: name, email address, company, payment references (card details are held by Stripe, not by us).
• Commercial information: purchases, subscriptions, credit balance and usage.
• Internet or network activity: sessions, device and app version, service and security logs.
• Audio, visual or similar information: only screenshots or files you attach to a bug report.
• Professional information: your company name, if you give it.
• Sensitive personal information: account sign-in credentials (your email with a sign-in code, or your sign-in provider account).

We use these categories for the purposes in Section 4, disclose them to the providers in Section 6, and keep them as described in Section 8. We do not sell or share personal information, as those terms are defined in California law, and have not done so in the last 12 months; we do not knowingly sell or share the information of anyone under 16. We use sensitive personal information only to provide and secure your account, so a right to limit its use does not apply. You have the right to know, access, correct and delete your personal information, to opt out of sale or sharing, and not to be discriminated against for using these rights; make requests as described in Section 9. We do not disclose personal information to third parties for their own direct marketing.

Other US states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws may have similar rights to access, correct, delete and get a copy of their information, to opt out of targeted advertising, sale and profiling, and to appeal a decision. We honor these requests for everyone as described in Section 9.

12. Security

We use reasonable administrative, technical and physical safeguards, including encryption in transit, encryption at rest for our cloud databases and file storage, sign-in codes and session tokens stored only as secure hashes, and access limited to people who need it. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires, including within 30 days for Florida residents.

13. Children

SESI is meant for adults: accounts and the SESI app are for people 18 and older, and none of SESI is directed to children under 16. We do not knowingly collect personal information from anyone under 16 (or under 13 in the United States, as defined by the Children’s Online Privacy Protection Act). If we learn we have, we delete it. If you believe a child has given us information, email sess@sessi.ai.

14. Where data is stored

SESI.AI LLC is based in the United States, and we store data primarily on Amazon Web Services in the US East (Virginia) region. Our providers, such as Stripe, Google and GitHub, may process information in the United States and other countries. If you use SESI from outside the United States, your information is processed in the United States, where privacy laws may differ from yours. Where the law requires, we rely on the data processing terms of Amazon Web Services and Stripe, which include the European Commission’s Standard Contractual Clauses. The copies of email in our Google mailbox and the issues in our GitHub repository are not covered by such terms. You can ask us for more information about these safeguards.

15. Changes to this policy

If we change this policy, we will update the date and version at the top. If a change is significant, we will tell you by email or on the website before it takes effect, and where the law requires your consent to a change, we will ask for it. Earlier versions are available on request.

16. Contact us

Questions or requests about your privacy: sess@sessi.ai, or the contact form. SESI.AI LLC, 5049 NE 48th Court, High Springs, Florida 32643, United States.