What we collect, what we deliberately don't, and where the boundaries sit.
The platform is a toolkit and a delivery mechanism — not a clinical service. That framing shapes the privacy posture: we hold almost nothing about you, and we hold nothing at all about the teens in your group.
Plain summary
Tessera operates TherapySessionKit. This page describes the data we collect, the data we explicitly do not collect, the third parties involved, and the controls you have over the small amount we do store.
This summary is descriptive, not legal advice. The binding text is the rest of this page; the summary exists so an evaluator can read the top of the page and know whether to keep going.
Section 1
Data we collect.
We collect only what the platform needs to deliver a printable mental-health kit and to bill for it. Nothing else.
Account email
If you create an account, we hold the email address you used to sign up and a bcrypt-hashed password (handled by the platform's auth module, never stored in plaintext). The email is used to log you in, deliver receipts, and notify you about changes relevant to your subscriptions.
Stripe receipt metadata
When you check out, Stripe-hosted checkout processes the card. We receive a Stripe customer id, the last four of the card on file, the purchase amount, and the product line. Card numbers never touch our servers — they go directly from your browser to Stripe.
Session cookies
A first-party session cookie keeps you signed in across pages and routes the request to your account server-side. It is required for the platform to function and is not used for cross-site tracking.
Server logs
Standard access logs (timestamp, route, response code, your IP) are retained for a rolling 30 days for abuse detection. Logs are not joined to your account profile or used for marketing.
Section 2
Data we don't collect.
This list is load-bearing. The platform is a printable-kit catalog, and the artifacts stay on your device.
No client notes.Anything you type into a session worksheet in the room stays on the printed page. We have no in-app notepad, no "save my draft" endpoint, no server-side editor state to retain.
No teen identifiers. Names, pronouns, age markers, group rosters, intake forms, parental consent records — none of these are collected or stored. There is no field on the platform where a teen identifier is asked for and no dropdown where one would land.
No group rosters. Group pass subscriptions are per-clinician, not per-group. We do not hold a list of groups you run, the seat numbers, or the rotation schedule.
No PHI. No diagnostic codes, treatment plans, progress notes, session recordings, or any other data covered by HIPAA as Protected Health Information. The platform is not a covered entity and is not built around the HIPAA data model.
Nothing typed into a PDF. The printable is generated client-side from a static artifact — text edits you make in the source file stay on your device. We have no telemetry on which dials you turned.
No analytics on the content. We do not run heatmaps, session replays, or third-party analytics on the kit-reader or the tailoring form. Page-level analytics are limited to aggregate counts used to decide which new topics to commission.
Section 3
Third parties & data flow.
Three processors handle data on our behalf. Each is on a contract that bounds secondary use.
Stripe (payments). Stripe runs the hosted checkout and the recurring-billing engine for the group-pass subscription. Stripe has the cardholder data; we only see Stripe customer ids, receipt metadata, and event notifications. Cancel-anytime is operated through the Stripe receipt link.
Polsia platform (hosting & email). Polsia hosts the application, runs the database, and forwards the contact-channel email. Stripe webhooks fire through Polsia-managed endpoints. Whatever Polsia stores is bound by the platform's data-processing terms.
Open Graph image host. The link-preview card on a shared URL is generated and hosted by a managed image service configured to cache for 30 days. The URL slug (e.g. /pricing) is the only input.
Section 4
Cookies & sessions.
The cookie surface is small and functional.
Session cookie.A HttpOnly + Secure + SameSite=Lax cookie holds your sign-in state. It is set by the platform's auth module, scoped to the TherapySessionKit domain, and is the only cross-page state the application depends on.
Theme preference. A small client cookie tracks light/dark mode. It is not joined to anything else and is not transmitted server-side.
No third-party cookies.No advertising pixel, no analytics SDK, no cross-site identifier. The default "do not track" browser setting is honored.
Section 5
Retention & deletion.
Small data set, short retention.
Account deletion. The account lifecycle is operated through the dashboard. A delete-account action removes the account row, the access rows for protected routes, and the session-cookie-signing secret references for that user; Stripe transaction history is retained by Stripe per their own retention policy and is governed by the Stripe privacy notice.
Server logs. Rolling 30-day retention, then purged. Logs are kept tamper-evident (write-only) for the same window.
Email backlog. Transactional emails (receipts, cancellation confirmations) are retained by our processor per their standard retention policy — typically 24 months for billing-related records.
Section 6
Contact the privacy channel.
The same channel used on the pricing surface. We reply within a school day.
Privacy questions, deletion requests, or notes about a specific data record: tessera-ojgia1@polsia.app. Include the relevant Stripe receipt id when asking about a charge.
We do not have a formal DPO; for a pre-launch operator of this size, the founder is the privacy point of contact and answers with the same signature as the rest of the team.
Subject to founder review for legal enforceability — not legal advice.