Privacy notice

The data controller is Stepe Digital SIA, a company registered in Latvia.

For anything in this notice, including any request about your data, contact adrians@stepedigital.com. We have not appointed a Data Protection Officer; data protection questions go to the same address.

The demo on this website. The demo currently runs entirely in your browser. The conversation is not sent to a server, is not recorded, and is not visible to us. Anything you type, including any name or email entered at the demo’s contact step, stays on your device and is discarded when you close or refresh the page.

If you email us. Your name, email address and whatever you write. We use it to reply and to keep a record of what was discussed and agreed. Legal basis: legitimate interests (Art. 6(1)(f)), responding to someone who has contacted us, or, where you become a customer, performance of a contract (Art. 6(1)(b)).

If you buy. Your billing name, email and payment details are collected by Stripe on its own checkout page. We never see or handle your card number. Stripe passes back the fact of payment, your billing name and email. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with our accounting obligations (Art. 6(1)(c)).

Setup details. After purchase we ask for your company name, website, a contact name, email and phone number, the areas you cover and the services you offer. At present the setup form does not submit anywhere automatically: it prepares your answers for you to send us by email, and you choose whether to send them. Legal basis: performance of a contract.

Enquiries from your customers, if you are a customer of ours. When the assistant runs on your website, it processes what the person enquiring types in order to produce a structured lead for you. For that data you are the controller and we act as your processor. See section 7.

This website sets no cookies and uses no analytics, advertising or tracking service. There is no consent banner because there is nothing to consent to.

Our internal admin tool stores data in the browser’s local storage, but that is not accessible to site visitors and holds no visitor data.

We use the following providers. No one else receives your data.

• Vercel Inc.: hosting. Processes request data (including IP address) to serve and protect the site.
• Stripe: payment processing. Stripe acts as an independent controller for payment data under its own privacy policy.
• Our email provider: correspondence sent to adrians@stepedigital.com.

We do not sell personal data, and we do not share it with third parties for their own marketing.

We are established in Latvia, in the EU. Some of our providers process data outside the European Economic Area: Vercel in the United States, and, where the AI assistant is enabled, DeepSeek in China.

Transfers to countries without an adequacy decision require appropriate safeguards under Chapter V of the GDPR, such as Standard Contractual Clauses together with an assessment of the destination country.

Being straight with you: our transfer safeguards for AI processing are not yet finalised. Until they are, do not type personal data about identifiable people into the assistant. If this affects a decision you are making about using us, email adrians@stepedigital.com and ask. We will tell you exactly where things stand rather than give you a reassuring non-answer.

Email correspondence is kept for as long as it is useful for the relationship, and afterwards only where we need it for accounting or to defend a legal claim. Records relating to payments are kept for the period our accounting obligations require.

Demo conversations are not retained. We do not currently operate a customer database: there is no account, no login and no stored profile for visitors.

We have not yet set fixed retention periods in days, because there is not yet an automated store to enforce them against. When that changes, this section will state the periods.

If you buy the assistant, the enquiries it collects on your website are your data. You decide why and how they are processed; we process them on your instructions in order to provide the service. That makes you the controller and us your processor under Art. 28.

Art. 28 requires a written data processing agreement between us before that processing starts. Ask for ours at adrians@stepedigital.com, and if you are buying, ask before you go live rather than after.

The assistant processes enquiries automatically to sort answers into structured fields. It does not make decisions producing legal or similarly significant effects about anyone, and it does not carry out profiling in that sense. A person always decides whether to quote and at what price.

Under the GDPR you have the right to:

• ask what personal data we hold about you, and get a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased in certain circumstances (Art. 17);
• restrict how we use it (Art. 18);
• receive it in a portable format (Art. 20);
• object to processing based on legitimate interests (Art. 21), including any direct marketing, at any time;
• withdraw consent where processing relies on it (Art. 7(3)).

Email adrians@stepedigital.com. Because the personal data we hold is correspondence and setup details you have sent us, requests are handled by hand. We will respond within one month.

If you are unhappy with our response you can complain to a supervisory authority. Ours is the Latvian Datu valsts inspekcija (State Data Inspectorate). You may also complain to the authority where you live or work: in the United Kingdom, the Information Commissioner’s Office.

This notice will be updated as the service develops, particularly when data begins to be stored rather than emailed, and when the transfer safeguards in section 5 are settled. The date at the top shows when it was last reviewed.

Related: Terms