Privacy policy

This policy explains what personal data we handle when you use stepista.com and the Stepista plugin, why, and what you can do about it. We keep it to what the product needs to work.

Who is responsible

The data controller is Jeffry Viveros Angola, trading as Stepista, Calle Barraca 241, 46011 Valencia, Spain (NIF 23834255E). Contact: support@stepista.com. See the legal notice.

What we collect and why

When you buy a licence. On this website, Stepista is sold through Link, a Stripe service, which handles the checkout and payment as merchant of record under its own privacy policy. From that purchase we receive and keep: the email address you used at checkout, the Stripe checkout and payment identifiers, and the status of your licence (active, or disabled after a refund or dispute) and of any dispute of that payment. We use them to send you your licence key, to validate it, to disable it if the payment is refunded or disputed, to enable it again if a dispute is closed in your favour, and to help you if you lose it. We never see your card details. We don't store your licence key itself: only a one-way hash of it and its last four characters, so we can find it when you write to us. Legal basis: performing the contract you entered into when you bought Stepista.

When you buy from a store. If you buy your key from a store, the store handles the sale and your data under its own privacy policy. It doesn't send us your name or email, and our licence record for that key has no email address. We keep a one-way hash of the key, its last four characters, which store and batch it came from, and its status (active, or disabled after a refund or dispute). The store tells us which keys were refunded or disputed, by key only. We use this to validate the key and to disable it if needed. Legal basis: performing the licence contract with you.

Where your purchase came from. When you click Buy, the website adds a short label to the checkout link: the website that sent you to stepista.com, if any (only its domain, like bedroomproducersblog.com, or the campaign name in the link you followed), which Buy button you clicked, and whether your browser reports macOS, Windows or another system. The label is worked out when you click, and nothing is stored on your device for it. It's saved with your order, at Link / Stripe and in our licence record. With your licence record we also keep which checkout link you used (the regular one or the upgrade offer), the amount paid and its currency, and when the order confirmation page first showed your licence key. We use this to count which websites and buttons lead to purchases, and to check that buyers receive their key. Legal basis: our legitimate interest in knowing what brings in sales and in making sure your key reaches you.

When you activate the plugin. To activate, and when it re-checks the licence (when you open it with an internet connection), the plugin sends our server your licence key, a machine identifier and an activation ID. The machine identifier is a one-way hash derived from your computer's own identifier: it tells us whether two activations come from the same computer, but not what that computer is. We keep, per activation, that hash, the dates it was activated and deactivated, and whether the deactivation came from the plugin or from our support, to enforce the limit of three computers per licence and a limit on how often a licence can move between computers. The plugin also stores your key and our last signed answer in a file on your computer, so it keeps working offline for up to 14 days. Legal basis: performing the contract.

Update check. Once per session the plugin asks our website which version is the latest. That request carries no personal data beyond what any web request does (such as your IP address, which our hosting provider sees in its logs).

Complimentary licences. If we give you a licence instead of you buying one, we keep your email address and the licence record in the same way, and email you the key.

When you write to us. If you email support@stepista.com (or any other @stepista.com address) or use the feedback form, we store the conversation in our database: your email address, your name if your email includes it, the subject and the message, the other addresses the email was sent to, the names and sizes of any attachments, and our replies. The attachments themselves stay with our email provider (see below). We use all of this to reply to you and to improve Stepista. Legal basis: our legitimate interest in answering you and improving the product (and, for support, the contract).

Launch list (closed). Before sales opened, you could leave your email to get one message when Stepista was ready to buy. The list is closed and we no longer collect addresses for it. We keep the ones we already have in our database only to send that one message. Legal basis: your consent, which you can withdraw at any time by writing to us.

Website statistics. We use Vercel Web Analytics to count page views. It doesn't use cookies: visitors are counted with a hash of the request that is discarded after 24 hours, and we only see aggregated figures (pages, referrers, country, browser and device type). Legal basis: our legitimate interest in knowing how the website is used.

Download counts. When you click a button to download Stepista, the website sends us a count with: the page you were on, which installer you chose (macOS or Windows, version 2 or the older 1.0.5), the website that sent you to stepista.com, if any (only its domain, like bedroomproducersblog.com, or the campaign name in the link you followed), whether your browser reports macOS, Windows or another system, and the time. These counts go to a separate database. They don't include your IP address (our hosting provider sees it in its request logs, as with any web request) or your browser's details: we use those details only to work out your system (macOS, Windows or other) and to leave out automated visits, and we don't keep them. Nothing is stored on your device for this, and no cookies are used. We look at these counts only as totals, to see which websites bring downloads and how downloads split between macOS and Windows. Legal basis: our legitimate interest in knowing how the website is used.

Cookies. The public website doesn't set cookies.

Who processes it for us

• Link / Stripe sells Stepista to you as merchant of record on this website: checkout, payment, taxes, receipts, invoices, refunds and disputes. For that data Link and Stripe act under their own privacy policies.
• Neon hosts our database: licence and activation records, support conversations (emails sent to @stepista.com and feedback-form messages), the launch list and, in a separate database, the download counts.
• Resend sends our emails (your licence key, our replies) and receives email sent to @stepista.com addresses, keeping its own copy of each received email, attachments included.
• Vercel hosts the website and its servers, including request logs and Web Analytics.
• Clerk handles sign-in to our own admin area, and nothing else. It processes our account data, not yours.

A store you buy from isn't one of our processors: it decides how it handles your data, under its own policy.

Some of these providers are based in, or use infrastructure in, the United States. Where data leaves the European Economic Area, they rely on the safeguards the GDPR provides, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We don't sell your data or share it for advertising.

How long we keep it

• Licence and activation records: for as long as your licence exists, because the licence is perpetual and the plugin checks it against them. If you ask us to delete your email, the licence keeps working; if you ask us to delete the licence record, the licence stops working.
• Support and feedback conversations: up to two years after the last message in the conversation, in case you write again about the same thing, unless you ask us to delete them sooner. Resend keeps its own copy of emails it receives for us under its retention policy; when you ask us to delete your data, we delete those copies too.
• Launch list: until we send the launch email, or until you withdraw your consent; then we take you off the list.
• Download counts: up to two years, to compare one period with another; then we delete them.
• Statistics and logs: Web Analytics data is aggregated; request logs are kept for the short period our hosting provider retains them.

Your rights

Under the GDPR you can ask us for access to your data, and to correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to support@stepista.com from the email address your data is linked to (for a purchase, the one you used at checkout), so we can confirm it's you. If you bought from a store, we have no email address for your licence, so include your licence key and we'll find your record that way. We reply within one month.

Deleting your data at Link / Stripe. You can also ask Link to delete your data for purchases made through it. Stripe then deletes it from its own systems and notifies us, but that request doesn't delete the records we keep. When we receive that notification, within one month we remove your email address from our licence records (your licence keeps working) and delete any conversations and launch-list entry linked to it. If you want us to delete your licence record as well, tell us at support@stepista.com.

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the data protection authority where you live.

Children

Stepista is not intended for children under 14, and we don't knowingly collect their data.

Changes

If we change this policy, we'll publish the new version here with a new date.