Privacy policy and processing of personal data

1. Who processes the data

The personal data operator is the developer of Sessia (full details: https://cloudsessia.ru/en/offer.html), the “Operator”. This policy follows Russian Federal Law No. 152-FZ “On Personal Data” of 27.07.2006 and describes the data processed by the Sessia extension and its server side (the “Service”). Questions and requests: support@cloudsessia.ru.

2. In short

• Without an account your sessions are kept only in your browser and are not sent to the Operator. Only anonymous usage numbers are sent (section 3), and you can turn them off in the extension settings.
• With an account on a paid plan your sessions (including cookies and site logins) are kept on the server so they can sync between your devices. Only your account, and people you chose to share a session with, can reach them.
• We don’t sell data or pass it on for advertising, don’t read the contents of your sessions and use them for nothing but running the Service.
• Bank card data is processed by YooKassa; the Operator never receives it.

3. What data, and why

• Email address, password (stored only as a hash) — purpose: Sign-up and sign-in, account recovery, receipts and payment notices; basis: Performance of the agreement, consent.
• Session data: names, groups, settings, cookies and site storage, saved browser identities, proxy settings — purpose: Sync between devices, sharing that you choose; basis: Performance of the agreement.
• Names of your devices, time of the last sync — purpose: Counting devices against the plan’s limit, showing you the list; basis: Performance of the agreement.
• Payment details: plan, amount, date, status, masked card number (e.g. “*4444”) — purpose: Payments and auto-renewal, refunds, accounting; basis: Performance of the agreement, legal requirements.
• For the Team plan: members’ email addresses, their roles, team and space names; the journal of opened shared sessions (member’s address, session, time) — purpose: Running the team: invitations, access rights, the journal for the owner and admins; basis: Performance of the agreement.
• Anonymous usage numbers: a random id of the extension copy (not linked to the account or email), an event (install, update, a plan limit reached, going to payment), plan, version, browser, a rough number of sessions (as a range) — purpose: Improving the Service and the plans; basis: The Operator’s legitimate interest; can be turned off in the extension settings.
• Server technical logs (request time, error code) — purpose: Security and troubleshooting; basis: The Operator’s legitimate interest.

Cookies and site data that reach the server during sync may contain information about your accounts on those sites. The Operator handles them only as content to be delivered to your devices and does not analyse them.

4. What we don’t do

The Service doesn’t collect browsing history, page contents, data you enter on sites or site passwords (other than what sites themselves keep in session cookies), and doesn’t use third-party analytics or advertising in the extension. Anonymous usage numbers (section 3) are sent only to the Operator’s server; turn them off in Settings → General → Help improve Sessia (in Firefox they are sent only if you allowed the browser to share technical data). The website https://cloudsessia.ru sets no advertising or analytics cookies.

5. Where and how long data is kept

5.1. Service data is stored in a database at the Supabase provider (the Supabase cloud platform, a data centre in Ireland (AWS region eu-west-1), outside the Russian Federation). Emails are sent through Resend. Payments are processed by NBCO YooMoney LLC (YooKassa).

5.2. By using sync you agree to the transfer of the data listed above to these servers.

5.3. Data is kept while the account exists. After a paid period ends, the data on the server is kept for at least 90 days and is unavailable until the plan is renewed, so that after payment every login comes back as it was. Payment details are kept for the periods set by accounting law. Deleting the account at your request removes all session data within 30 days.

6. Protection

Data travels only over encrypted connections (HTTPS). Access in the database is limited by database-level rules: each account sees only its own data and the sessions shared with it. Secret keys are kept only on the server. Use a strong, unique password for your Sessia account: it protects your synced logins.

7. Transfer to third parties

Data goes only to providers without which the Service cannot work (Supabase — storage and sign-in, Resend — email, YooKassa — payments), to the extent their functions need, and to other users of the Service — only the sessions you shared yourself. Otherwise only when required by law.

8. Your rights

You may obtain information about the processing of your data, request its correction, blocking or deletion, withdraw consent and complain about the Operator to Roskomnadzor or a court. You can delete most data yourself in the extension (sessions, identities, groups, devices) or sign out. Send requests to support@cloudsessia.ru — we reply within 10 working days. Withdrawing consent means deleting the account and stopping sync.

9. Changes

The Operator may update this policy by publishing a new version on this page. Users with an account are told about significant changes by email.

10. Operator’s contacts

The developer of Sessia
Email: support@cloudsessia.ru