Privacy notice

The data controller is Stepe Digital SIA, a company registered in Latvia.

Registration number 40203711274. Registered address: Līča iela 12, Lejasciems, Lejasciema pag., Gulbenes nov., Latvia.

For anything in this notice, including any request about your data, contact adrians@stepedigital.com. We have not appointed a Data Protection Officer; data protection questions go to the same address.

The demo on this website. The demo currently runs entirely in your browser. The conversation is not sent to a server, is not recorded, and is not visible to us. Anything you type, including any name or email entered at the demo’s contact step, stays on your device and is discarded when you close or refresh the page.

If you email us. Your name, email address and whatever you write. We use it to reply and to keep a record of what was discussed and agreed. Legal basis: legitimate interests (Art. 6(1)(f)), responding to someone who has contacted us, or, where you become a customer, performance of a contract (Art. 6(1)(b)).

If you ask us to set one up on your website. The form on our homepage and demo page collects your website address and an email address, and optionally your name and company name, so that we can configure an example on your business and send you the link. That is the only use: it is not added to a mailing list and not passed to anyone else. Legal basis: legitimate interests (Art. 6(1)(f)) — answering someone who has asked us for something — or, at your request, steps prior to entering a contract (Art. 6(1)(b)). Retention is in section 6.

If you buy. Your billing name, email and payment details are collected by Stripe on its own checkout page. We never see or handle your card number. Stripe passes back the fact of payment, your billing name and email. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with our accounting obligations (Art. 6(1)(c)).

Setup details. After purchase we ask for your company name, website, a contact name, email and phone number, the areas you cover and the services you offer. Submitting the form stores those answers so we can configure your assistant; until a person has checked them against your subscription they are inactive, and nothing runs on your behalf. Legal basis: performance of a contract.

Enquiries from your customers, if you are a customer of ours. When Linwick runs on your hosted enquiry page, it processes what the person enquiring types in order to produce a structured enquiry for you. The completed enquiry is stored only so it can be delivered to you reliably, and is deleted on the schedule in section 6. For that data you are the controller and we act as your processor. See section 7.

This website sets no cookies, reads no cookies, and stores nothing on your device. It runs no advertising, no remarketing and no cross-site tracking of any kind. There is no consent banner because there is nothing stored on your device to consent to.

This site currently uses no analytics service at all. Nothing counts your visit.

Our internal admin tool stores data in the browser’s local storage, but that is not accessible to site visitors and holds no visitor data.

We use the following providers. No one else receives your data.

• Vercel Inc.: hosting. Processes request data (including IP address) to serve and protect the site.
• Stripe: payment processing. Stripe acts as an independent controller for payment data under its own privacy policy.
• Neon: our EU-region database. Stores customer setup details and completed enquiries on behalf of our customers, until they are delivered and deleted (section 6).
• Resend: transactional delivery of completed enquiries to our customers, sent from linwick.co.uk with replies addressed straight back to the customer concerned.
• Our email provider: correspondence sent to adrians@stepedigital.com.

We do not sell personal data, and we do not share it with third parties for their own marketing.

We are established in Latvia, in the EU. Some of our providers process data outside the European Economic Area:

• Vercel (hosting): its primary processing facilities are in the United States, and its edge network serves this site worldwide.
• Resend (enquiry email delivery): email content and delivery records are stored in the United States, whatever region the message is sent from.
• Neon (the database holding setup details and completed enquiries): the database itself is pinned to an EU region, but the provider is now a Databricks company, and its supporting systems — control plane, backups, logs and vendor support access — are not confirmed to be limited to that region.
• DeepSeek, where the optional AI model behind Linwick is enabled (see below): China.

The database holding customer setup details and completed enquiries is created in an EU region on purpose, and pinned there, so that enquiry data is stored and primarily processed inside the EEA. What that pinning does not cover is the provider’s own supporting systems, so any processing outside the EEA relies on the safeguards below exactly as Vercel’s and Resend’s do. Where an enquiry email then lands in a mailbox outside the EEA — for instance a customer whose own inbox is hosted in the US — that onward step is our customer’s arrangement as controller.

Where personal data leaves the UK or the EEA, the transfer relies on the safeguards in each provider’s published data processing agreement: EU Standard Contractual Clauses, adapted for transfers subject to UK law by the UK Addendum or the UK IDTA, together with certification under the EU–US Data Privacy Framework (including its UK extension) where the provider holds one — Vercel, Resend and our database provider’s parent, Databricks, Inc., all state that they do. Which mechanism applies to which provider is set out per vendor in schedule 2 of our data processing agreement; a copy of a provider’s own agreement is available on request at adrians@stepedigital.com.

Being straight with you: our transfer safeguards for AI processing are not yet finalised. Until they are, do not type personal data about identifiable people into Linwick. If this affects a decision you are making about using us, email adrians@stepedigital.com and ask. We will tell you exactly where things stand rather than give you a reassuring non-answer.

Email correspondence is kept for as long as it is useful for the relationship, and afterwards only where we need it for accounting or to defend a legal claim. Records relating to payments are kept for the period our accounting obligations require.

Demo conversations are not retained. There is no account, no login and no stored profile for visitors to this website.

Completed enquiries from customers’ enquiry pages are stored only until they are delivered, and are deleted 30 days after successful delivery. No enquiry is kept longer than 90 days after it was received, whatever its status. Both limits are enforced by a scheduled deletion job in our code, not by good intentions.

A request to set one up on your website is deleted 180 days after we receive it, by the same scheduled job that enforces the enquiry limits above. Ask sooner and it goes sooner.

Setup details for an active customer are kept while the subscription lasts, and afterwards only where we need them for accounting or to defend a legal claim.

If you buy Linwick, the enquiries it collects on your hosted enquiry page are your data. You decide why and how they are processed; we process them on your instructions in order to provide the service. That makes you the controller and us your processor under Art. 28.

Art. 28 requires a written data processing agreement between us before that processing starts. Ours is published in full at /processor-agreement (version 1.1). It states what we process, the retention schedule in section 6, the sub-processors listed in section 4, how we help with data subject requests, and the transfer safeguards in section 5. You accept it on the setup form after checkout, and the version and the time you accepted are recorded against your account — so you can read it before you buy rather than asking for it afterwards. You will be told in advance before new sub-processors are added, and may object. If a personal data breach ever affects enquiries we hold for you, we tell you without undue delay — the agreement commits us to telling you within 24 hours of becoming aware — together with what happened and what we have done, so you can meet your own notification duties.

The security measures we apply while holding that data — EU-region storage, TLS, environment-held secrets, no third-party scripts on enquiry pages — are described on our security page.

The assistant processes enquiries automatically to sort answers into structured fields. It does not make decisions producing legal or similarly significant effects about anyone, and it does not carry out profiling in that sense. A person always decides whether to quote and at what price.

Under the GDPR you have the right to:

• ask what personal data we hold about you, and get a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased in certain circumstances (Art. 17);
• restrict how we use it (Art. 18);
• receive it in a portable format (Art. 20);
• object to processing based on legitimate interests (Art. 21), including any direct marketing, at any time;
• withdraw consent where processing relies on it (Art. 7(3)).

Email adrians@stepedigital.com. What we hold is correspondence, setup details, and — for active customers — enquiries still inside their retention window. All of it sits in one queryable store and one mailbox, so a request is answered by direct search rather than by guesswork. Requests are handled by hand and we will respond within one month.

You can complain to us directly about how we handle your personal data. Email adrians@stepedigital.com and we will acknowledge your complaint within 30 days and tell you the outcome without undue delay.

If you are unhappy with our response you can complain to a supervisory authority. Ours is the Latvian Datu valsts inspekcija (State Data Inspectorate). You may also complain to the authority where you live or work: in the United Kingdom, the Information Commissioner’s Office.

This notice is updated as the service develops. The last substantive change added the pre-sale form described in section 2 and its retention period in section 6; the outstanding one is the transfer safeguard in section 5, which stays unresolved and stays flagged there rather than being quietly dropped. The date at the top shows when it was last reviewed.

Related: Terms