Changes
to our
legal docs.

What we log

We aim to log every change to the live versions of the three documents linked above, whether material or minor. The line between "material" and "minor" can be subjective; if you spot a change you think should have been called out and wasn't, email privacy@seshman.com and we'll backfill the entry.

For material changes — new processing purposes, new categories of personal data, new sub-processors, changes to retention, changes to legal basis, or any change that affects your obligations or rights — we also notify trainers via in-app banner and (where we have your email address) by email at least 30 days before the change takes effect.

Change log

1. 1 October 2026

   Material (announced, 30-day notice): Sentry added as a sub-processor for crash and error reports

   Seshman is adding error monitoring. When the app, the website or our servers hit an error, a report will go to Sentry (Functional Software, Inc.), hosted in the EU, so we can find and fix it. A report carries the technical details of the error, the device type, operating system and app version, and the account's internal identifier — never a name, email address or IP address, and never the contents of sessions, notes or forms. Reports are kept for 30 days.

   This is a new sub-processor and a new category of data, so it is a material change: trainers are notified in-app and by email, and production reports begin only after that notice has been out for 30 days. Until then Sentry receives data from our test environment only. The Privacy Policy ("About your use of the service", the retention table and the sub-processors section) and the sub-processor list describe the change now, marked as announced; the Privacy Policy's effective date is bumped when the change takes effect.

2. 22 September 2026

   Minor: website contact form relay disclosed; "packs" become "packages"

   The sub-processor list gains FormSubmit (formsubmit.co), the service that relays the seshman.com contact form to our inbox, and the Privacy Policy's "Contact us" section says so. Wording only: "session packs" reads "session packages" throughout, matching the app. No change to what is collected or why; the Privacy Policy's effective date is unchanged.

3. 16 September 2026

   Launch update: subscriptions and card payments are live; Terms, Privacy Policy and sub-processor list brought up to date

   Seshman went public on the App Store and Google Play in September 2026 with trainer subscriptions and in-app card payments switched on. All three documents now describe the live service. The effective dates on the Terms of Service and Privacy Policy move to 16 September 2026.

   Material changes:

   • Terms: the "Service status (beta)" clause is replaced by a plain service-warranty clause. The Subscriptions section describes the live model — a 30-day free trial, plans differentiated by active-client and weekly-class caps, billing through Apple In-App Purchase and Google Play Billing, RevenueCat as subscription-management partner — and no longer says billing is inactive.
   • Terms: new "Payments between trainers and clients" section covering Stripe Connect — the trainer's own Stripe account, no Seshman fee, card details never reaching Seshman, refunds and disputes, and off-platform cash and bank-transfer records.
   • Terms: acceptable use cross-references the community standards for messaging; the session-tracking clause notes that session plans and the activity catalogue are trainer-authored tools, not advice from Seshman.
   • Privacy Policy: new "Payments and subscriptions" section naming Stripe (card payments and trainer onboarding), Apple and Google (subscription billing) and RevenueCat (subscription status), each with its legal basis. "Information we hold" gains payment records, subscription status, session plans and logged values, locations, signed documents and app-update checks; the retention table covers payment and subscription records alongside invoices.
   • Sub-processor list: Stripe, RevenueCat, Apple In-App Purchase and Google Play Billing move from "future" to current; Amazon ECS on Fargate replaces App Runner as the API host; Amazon S3 (generated documents), AWS KMS (consultation-answer encryption keys), Expo's update service and optional Sign in with Apple / Google Sign-In are listed. The "Future sub-processors" section is removed.

   Minor changes:

   • Both documents describe Seshman as the app for independent coaches, trainers and instructors rather than "a session-tracking app for independent fitness providers".
   • "Coach messages" becomes "Messages and announcements" — 1:1 threads, messages to several clients, class announcements, reports and blocks.
   • The Privacy Policy lists the self-service tools now in the app (account deletion, statements, transactions export, consultation export) instead of saying they are being built, and notes that the Stripe and RevenueCat SDKs are present for payments, not analytics.
   • Deleting-your-account page: trainers are told to cancel a store subscription before deleting, because deletion does not stop store billing.

4. 30 July 2026

   Vocabulary: "invoices" become "payment requests" across the Privacy Policy, Terms and sub-processor list

   Seshman sends a payment request by default and attaches a numbered PDF invoice only for trainers who have switched invoicing on. The three documents were reworded to match — the email categories, the sub-processor purpose for SES, and the Terms' email clause. Minor change; effective dates unchanged.

5. 2 July 2026

   Privacy Policy: account deletion confirmation email added to the transactional email categories

   A ninth category was added to the "Categories of email we send" list: when you delete your own account, Seshman sends a single email confirming the deletion has been carried out. This is a minor change — it documents a service email about your own account and introduces no new processing purpose or data category — so the effective date is unchanged.

6. 5 June 2026

   Initial publication of the Privacy Policy and Terms of Service, including the catalogue-driven intake feature

   Both documents were rewritten to reflect Seshman's current product surface, including offline clients, transactional email handling, push notifications, our sub-processor footprint, and the operator identity of Inca Labs Limited. The sub-processor list was published as a new standalone page, and this change log was created.

   Material changes:

   • New "Roles" section in the Privacy Policy explaining that trainers are data controllers for their clients' data and Seshman is the processor, plus the cases where Seshman is also a separate controller (email delivery infrastructure, suppression list, audit logging, abuse handling, anonymised retention).
   • New "Training-related personal information" section setting out the explicit-consent basis (UK GDPR Article 9(2)(a)) for goals, injuries, and health-related notes. Existing users will be asked to confirm consent in-app when paid-feature rollout reaches them.
   • New "Offline clients" section setting out the Article 14 disclosure split — Seshman handles disclosure by email footer where the offline client has an email on file; the trainer carries the disclosure burden where they don't.
   • New "Push notifications" section disclosing the use of Apple Push Notification Service, Google Firebase Cloud Messaging, and Expo Push (650 Industries, Inc.).
   • New "Sub-processors and international transfers" section pointing to /sub-processors and naming the UK Extension to the EU-U.S. Data Privacy Framework + UK IDTA / EU SCCs as the transfer mechanisms.
   • New retention table replacing the generic "as long as your account is active" line, including the 6-year HMRC-driven anonymised retention for invoices.
   • New "Your obligations as a trainer" section in the Terms of Service codifying the warranties around existing service relationships, lawful basis, explicit consent for health-related fields, emergency contacts, minors, and Article 14 disclosure.
   • New Data Processing Agreement embedded as Schedule 1 of the Terms of Service.
   • New "Intake forms" coverage in the Privacy Policy: trainers build onboarding forms from a defined catalogue, sensitive questions are grouped into separately-consented sections, sensitive answers are individually encrypted, access to them is logged and available to the data subject, and withdrawing consent deletes the answers within seven days. Restates that Seshman sells none of this data, shares none for advertising, and uses no AI. A new intake controller-obligations explainer sits alongside the policy.
   • Extended the §8d trainer warranties to the intake catalogue — a designated sensitive-field path (no using general or free-text fields to bypass consent), data minimisation, and prompt handling of client access / correction / deletion requests.
   • Client age floor raised to 18: trainers may not add or record anyone under 18, and Seshman does not support under-18 clients. This supersedes the previous under-13 (UK GDPR Article 8) threshold and is reflected in both documents.
   • New "Service status (beta)" clause acknowledging Seshman is in beta and is provided "as is".
   • Subscriptions section pre-states the future billing model (Apple In-App Purchase, Google Play Billing, RevenueCat, Stripe) marked as not yet active.
   • Operator identity (Inca Labs Limited, company number 14731709, VAT GB438261686, registered office at 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF) named in both documents.

   Minor changes:

   • Email categories list updated to enumerate the eight current transactional emails: invoices, payment receipts, payment reminders, session schedule confirmations, session cancellations, session summaries, welcome messages, and security or account alerts.
   • Payment reminder wording corrected to reflect that reminders go by email to all clients with an email address on file (in addition to a push notification for app clients), rather than only to clients without the app.
   • Sub-processor list corrected: replaced "Vercel" with "AWS Amplify" (marketing site has always been on Amplify), confirmed Plausible as the analytics provider, and added the previously-omitted entries (SES, SNS, RDS, App Runner, CloudWatch, APNs, FCM, Expo Push, App Store, Google Play).
   • Open-tracking pixels and click-tracking link rewrites disabled at the email-delivery configuration level — and the absence of tracking is stated explicitly in the Privacy Policy.
   • Privacy contact moved from info@seshman.com to privacy@seshman.com.
   • Plain-English summary boxes, tables of contents, and per-section anchors added to both legal documents for navigability.

   The changes do not require existing users to re-accept the Terms — continued use of the service after the effective date constitutes acceptance of the rewrite, per the "Changes to these Terms" clause.

Earlier versions

We keep prior published versions of our legal documents in our internal records and can produce them on request. Email privacy@seshman.com if you need a copy of an earlier version for any reason.

Contact

Questions about a change, or about anything else legal: privacy@seshman.com.

Seshman is operated by Inca Labs Limited, 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom.