Privacy Notice

This notice explains how Giovanni GASPARETTO, trading as Stepable ("Stepable", "we", "us"), collects and uses personal data when you visit stepable.app, create an account, build lessons, or subscribe to Stepable Pro. Giovanni GASPARETTO is the data controller for the personal data described here, which means he decides why and how it is processed. The business is registered under SIRET number 84255141800036 at 10 rue Tipolka, App 18, 97411 Saint-Paul, La Réunion, France.

1. Data we collect and why

• Account data (email address, first name or username, password hash, sign-in provider such as Google): to create and secure your account and sign you in. Legal basis: performance of our contract with you.
• Content data (YouTube links you paste, lesson titles, step titles and descriptions, publication status, learning progress): to provide the service and show your lessons back to you and, when you publish, to the people you share them with. Legal basis: contract performance.
• Support messages and feedback (including roadmap suggestions and votes): to answer you and improve the product. Legal basis: legitimate interests.
• Usage and telemetry (pages viewed, features used, AI generation counts, quota usage, error logs, device and browser information, IP address): to operate the service, enforce plan limits, prevent fraud and abuse, and improve reliability. Legal basis: legitimate interests and, for quota enforcement, contract performance.
• Subscription status (plan, status, renewal date, subscription identifiers received from Paddle): to give you access to paid features. Legal basis: contract performance. Card and billing details are collected and processed by Paddle, not by us.
• Marketing communications, only where you have opted in. Legal basis: consent, which you can withdraw at any time.

We also process data where we must, to comply with legal obligations such as accounting and responding to lawful requests.

2. AI processing

When you use automatic step generation, the video reference and derived text (such as transcript excerpts) are sent to our AI provider to produce suggested steps. We do not send your account credentials, and we do not use your content to train third-party models.

3. Who we share data with

• Service providers / subprocessors: hosting and database, email delivery, AI model providers, and error monitoring — acting on our instructions.
• Paddle.com, our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law or to protect our rights.

We do not sell your personal data.

4. International transfers

Some of our providers are located outside the UK/EEA. Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

5. Retention

We keep account and content data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep records longer for legal, tax or accounting reasons (typically up to 7 years for transaction records). Logs and telemetry are kept for a maximum of 12 months.

6. Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent where processing is based on consent. You can also complain to your local data protection supervisory authority (in the UK, the ICO). Email support@stepable.app to exercise any right; we respond within one month.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, encryption at rest with our hosting provider, hashed passwords, row-level access controls on our database, and least-privilege access for administrators.

8. Cookies and local storage

• Essential: session and authentication tokens, language and theme preference, and local drafts. These are required for the site to work.
• Analytics: aggregate usage measurement to improve the product.
• Third-party: embedded YouTube players and the Paddle checkout may set their own cookies under their own policies.

We do not use advertising cookies. You can clear or block cookies in your browser settings, though blocking essential cookies will prevent you from signing in.

9. Children

Stepable is not directed at children under 13 (or the minimum age in your country), and we do not knowingly collect their personal data.

10. Contact

Giovanni GASPARETTO, trading as Stepable — 10 rue Tipolka, App 18, 97411 Saint-Paul, La Réunion, France — SIRET 84255141800036 — support@stepable.app.