Who we are
Session™ Vault is a product of Capiscana, Inc., an Illinois corporation. We build a private home for unreleased music, released music, and the catalog work around both.
This policy covers vault.session.am, the iOS app, the Mac and Chrome companions, and the services they connect to. It does not cover third-party tools you choose to plug in, such as DAWs, distributors, or mailing services. Those are governed by their own policies.
What we collect
Four buckets. They are not treated the same.
Your content, protected where encryption is enabled
- Audio: masters, stems, Atmos renders, binaural derivatives
- Text: lyrics, session notes, private credits, draft titles
- Structure: folders, playlists, tags, cover art
- Share recipients and the policies you attach to each share
When you turn on encryption, protected uploads lock on your device before storage. Support cannot unlock those protected files without your key or recovery path.
Account metadata we can see
- Email, display name, tier, billing source
- Login events, 2FA enrollments
- Storage totals, file counts, last-active timestamps
- Audit log entries for shares, key rotations, and encryption events
Operational telemetry
- Crash reports, latency distributions, performance counters
- Feature-usage counters, scoped to active workspace rather than individual users
Recipient signals about people you share with
When you send a track to someone, the share landing logs opens, plays, listen-time, hashed IP, and a city/country lookup per recipient. This is data about your recipients, not you. We collect it on your behalf, and you read it under Recipients and Hot Leads. Your NDA discloses it to them. We do not repurpose or resell it.
We do not collect: behavioral ad signals, third-party advertising trackers, location beyond city level, or any audio fingerprint used to track content outside your own catalog.
How we use it, and what we never do
Everything above exists for one reason: running the service you signed up for. Storing your catalog, playing it back, analyzing it when you ask, delivering your shares, billing your plan, and keeping your account secure.
- We never sell your data. Not your account info, not your content, not your usage. There is no version of Session™ Vault where your data is something we sell.
- We never use your data for advertising, and we never track you across other companies' apps or websites.
- We never use your music to train models.
How encryption works
Protected uploads are locked in your browser before storage. Your password or recovery path unlocks them later, and support cannot reset that recovery path for you.
The safe path is simple: keep your password, recovery code, and trusted devices in places you control. If you lose all of them, protected files may not be recoverable.
AI & analysis
Your audio gets analyzed in two places, depending on a switch you control.
Encryption on.
Some analysis and AI features may be unavailable for protected files unless you explicitly unlock the track for that feature.
Encryption off or feature explicitly enabled.
Workers read the track only long enough to run the pipeline you requested, write outputs back to your vault, and clear temporary working data after the job finishes. Human support access is limited to specific support or restore requests and is logged.
What the workers do:
- Tempo, key, mood, energy
- Genre classification (32 SV genres, every upload)
- Lyric transcription, synced to playback
- Stem separation, four-stem
- Cover art generation (no-retention contract with our compute vendor)
- AI Atmos, AI Mix Stereo, AI Mix Multi-Stem
- AI Cleans: mute, reverse, or bleep explicit words at marked timestamps
- Semantic search across your library
- Bulk-edit intent parsing (no-retention contract)
We do not use your music to train models. Any outside model call we use is governed by no-retention and no-training terms for your inputs.
Third parties
A short list of provider categories powers the service. The formal Privacy Policy lists current subprocessors.
The full provider list, with legal links and location notes, lives at vault.session.am/legal/subprocessors. We email and post in-app before adding a material new provider.
Retention & deletion
Two paths.
Track-level.
Delete a track. It moves to Trash. Trash holds for 30 days, restorable with one click. After 30 days, scheduled purge removes the active file and related library records. Older backups age out under the retention schedule.
Account-level.
Close your account at Settings → Account → Delete. We open a 30-day grace window. Cancel during the window if you change your mind. After it closes, scheduled purge removes active account data, library records, share records, and active files. Some billing and abuse-prevention records may remain where required by law or legitimate security needs.
Legal requests
We follow law where we operate. We review requests and push back where they are overbroad or defective.
- What we require. A valid subpoena, warrant, or equivalent legal process for any account data.
- What we tell you. When legally permitted, we notify affected users about requests for their account data.
- What we can produce. Email, billing details, login IPs from the last 90 days, signed audit-log hashes.
- What may be unavailable to us. The contents of files you protected with encryption, where we do not hold the key.
Transparency.
When we receive our first formal legal request, we plan to publish a transparency report for that year. The number is currently zero.
Warrant canary.
As of the effective date above, we have received zero National Security Letters. If this paragraph is missing from a future revision of this page, draw your own conclusion.
Your rights
GDPR, CCPA/CPRA, and the dozen state laws that have followed give you four moves: see what we hold, fix what's wrong, take a copy, ask us to delete it. Most of this is already a button.
Self-serve at Settings → Privacy → Data: export, correction, deletion. Export includes your account record, catalog metadata, playlists, share records, and watermark mappings. For data not covered there, email privacy support.
Anything not covered there: [email protected]. We respond inside the statutory window, 30 days for most requests or 45 days if we need an extension and tell you why.
You can also lodge a complaint with your local data-protection authority. We won't take it personally.
Children
Session™ Vault is a professional tool for the music industry. It is not directed at children. You must be at least 13 to hold an account, and at least 18 to take a paid plan. We do not knowingly collect information from anyone under 13. If you believe a child under 13 has given us their information, email [email protected] and we will delete it.
Contact
Privacy & data requests: [email protected]
Security disclosures: [email protected]
Mailing address: Capiscana, Inc. · 2222 Chestnut Avenue, Suite 201 · Glenview, IL 60026 · USA
When this policy materially changes, you get an in-app banner and an email at least 30 days before it takes effect. The previous version stays archived at vault.session.am/legal/privacy/history.