Privacy Policy

Publisher: Joolweb EI — Sole proprietorship.

Address: Peyrins, France.

Contact: contact@joolweb.fr or support@sessionspro-app.com for product support.

This policy covers the website sessionspro-app.com and processing carried out by Joolweb EI as publisher of the Sessions Pro plugin.

It does not replace the privacy policy that each coach must publish on their own WordPress website for their clients' data.

This page describes:

— data processed via the sessionspro-app.com website (contact, browsing);

— optional product telemetry sent from the WordPress plugin, only if the site administrator explicitly opts in;

— the Google Calendar OAuth hub used by the Premium add-on when a coach connects their Google account from WordPress.

Business data managed within the plugin (clients, sessions, notes, etc.) falls under the responsibility of the coach or professional operating the WordPress site: they are the data controller with respect to their clients.

Sessions Pro may offer strictly optional product telemetry to improve the plugin. It is disabled by default.

No data is sent without an explicit opt-in checkbox in the setup wizard or plugin settings. Refusing or withdrawing consent does not block any plugin functionality.

Data that may be transmitted (aggregated, without end-client data): pseudonymous installation identifier (UUID), plugin, WordPress and PHP versions, site language, free or pro edition, usage tiers (number of clients, sessions, packages by tier), indicators of enabled features (e.g. wizard completed, reminders active).

Never transmitted: names, emails or phone numbers of clients or coaches, session or note content, exact amounts, full site URL in plain text.

Legal basis: consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time in the plugin settings; an unsubscribe signal is then sent and associated reports are deleted on the server side.

Purpose: measure versions in production, estimate active installations and prioritise product improvements.

Retention period: telemetry reports retained for a maximum of twenty-four months, then deleted or anonymised.

Recipients / hosting: API and database hosted on the publisher's VPS (Hostinger). Transmissions use HTTPS.

Messages sent via the contact form (name, email, subject, message) are used to respond to your request.

They are transmitted by email via our sending provider (Resend) to the Sessions Pro support address.

Legal basis: legitimate interest or performance of pre-contractual measures, depending on the context of the request.

Retention: for as long as necessary to handle the request, then reasonable archiving if commercial or support follow-up is required.

Premium purchases are processed by Lemon Squeezy (Merchant of Record). Billing and payment data is subject to their privacy policy.

Joolweb EI receives the information necessary to provide the licence and support (e.g. purchase email), in accordance with the Terms and Conditions of Sale.

When the coach clicks Connect in WordPress (Settings → Calendar), sessionspro-app.com acts only as an OAuth pipe: it exchanges the Google code, stores an encrypted refresh token at rest, and once creates a secondary calendar named “Sessions Pro”.

We do not read the coach’s personal calendar. We do not store session titles, client names or times: the WordPress plugin then talks to Google directly with a short-lived access token (about one hour).

Data that may be kept on the hub: WordPress site URL, WordPress user ID, encrypted refresh token, ID of the app-created calendar, and optionally the email of the Google account used.

Legal basis: performance of the contract (providing the Premium feature requested by the coach).

Retention: until the coach disconnects in the plugin, or deletion upon request to the publisher.

Recipients: Google Ireland Limited / Google LLC (OAuth and Calendar API). Token hosting: the publisher’s VPS (Hostinger), HTTPS in transit, encryption at rest with a key distinct from the plugin HMAC secret.

The Google app is currently in Testing mode: Google may limit token lifetime to seven days, which is expected until the app is published in production.

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability where applicable.

For telemetry: withdrawing consent in the plugin is the simplest way to stop any further transmission and request deletion on the publisher's side.

For Google Calendar: the Disconnect button in the plugin revokes the token with Google and deletes the row on the hub.

For any request: contact@joolweb.fr or support@sessionspro-app.com, specifying the subject matter (website, purchase, telemetry or Google Calendar).

You may lodge a complaint with the CNIL (www.cnil.fr) if you believe your rights are not being respected.

The website displays a consent banner for non-essential cookies.

Essential cookie: storage of your preferences (sp_cookie_consent, maximum retention six months).

With your consent, Google Analytics 4 (ID G-QVMMXK2E1K) may place audience measurement cookies (pages viewed, traffic source, aggregated statistics). Legal basis: consent. Provider: Google Ireland Limited.

With your consent, Lemon Squeezy may place cookies when you use checkout. See their privacy policy.

Refusing non-essential cookies does not prevent you from browsing the site. See also the Cookies section of the legal notice.

This policy may be amended to reflect changes to the service or applicable regulations.

The last updated date appears at the top of the page. The version published online shall prevail.