Privacy Policy

Introduction

StepBase ("we," "us," or "our") is a workflow automation platform operated by [Company Name Placeholder]. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including the website at stepbase.ai and all related services, applications, and tools (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use the Service.

This policy applies to all users of StepBase, including workspace administrators, team members, and anyone who interacts with forms or workflow instances shared through the platform.

Information We Collect

We collect several categories of information depending on how you interact with the Service. Below is a detailed breakdown of each category.

Account Information

When you register for an account, we collect your name, email address, workspace name, and role within the workspace. This information is necessary to create and manage your account.

Workflow Data

As you use the Service, we store the workflow data you create and manage, including flow definitions, form submissions, flow instance data, and shared context between stages. This data is stored within your workspace and is essential to providing the Service.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, session duration, and actions taken within the platform. This helps us understand usage patterns and improve the product.

Device & Technical Data

We collect technical information from your device and browser, including your IP address, browser type and version, operating system, and device identifiers. This data is used for security, troubleshooting, and analytics purposes.

Payment Information

Payment processing is handled by Stripe. We do not store full credit card numbers on our servers. We retain only the last four digits of your card number and your billing address for record-keeping and support purposes. All payment transactions are processed securely by Stripe in accordance with their privacy policy and PCI DSS standards.

AI Interaction Data

When you use our AI-powered features, such as the flow generator, we collect the prompts you submit and the AI-generated suggestions produced in response. This data is used solely to provide the Service and is not used to train third-party AI models. AI interaction data is treated with the same level of protection as all other workflow data in your workspace.

How We Use Your Information

We use the information we collect for the following purposes:

Provide, operate, and maintain the Service, including processing workflows, assignments, and form submissions
Process billing transactions and manage subscription plans
Respond to your support requests, questions, and feedback
Analyze usage patterns and improve the product, performance, and user experience
Detect, investigate, and prevent fraud, abuse, and unauthorized access
Send service-related communications, including account notifications, security alerts, and system updates
Comply with legal obligations, including tax reporting and responding to lawful requests

Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases for processing your personal data:

Contract performance: Processing is necessary to provide the Service you have requested, including account management, workflow execution, and support.
Legitimate interests: We process data for security purposes, fraud prevention, product improvement, and analytics, where these interests are not overridden by your data protection rights.
Consent: Where you have opted in to receive optional communications, marketing materials, or participate in feedback programs. You may withdraw consent at any time.
Legal obligation: We process certain data to comply with tax laws, financial regulations, and lawful requests from law enforcement or regulatory authorities.

Data Sharing & Third Parties

We share your information only in the limited circumstances described below. We do not sell your personal data. We do not share your data for advertising purposes.

Stripe (Payment Processing)

We share billing information with Stripe to process subscription payments and manage your account. Stripe operates as an independent data controller for payment data. Please refer to Stripe's privacy policy for details on their data practices.

Authentication Provider

We use Auth0 or another configured authentication provider to manage user sign-in and identity verification. Your authentication credentials are handled by the provider in accordance with their privacy and security policies.

AI Service Providers

When you use AI-powered features such as the flow generator, prompts and workflow context may be sent to third-party AI service providers for processing. These providers do not retain your data after processing, and your information is not used to train their models.

Customer-Configured HTTP Connectors

StepBase allows you to configure HTTP connectors that send data to external services as part of your workflows. These integrations are directed entirely by you, the customer. StepBase is not responsible for the data practices of third-party services you choose to connect. We recommend reviewing the privacy policies of any services you integrate.

Law Enforcement

We may disclose your information to law enforcement or government authorities only when legally compelled to do so, such as in response to a valid subpoena, court order, or legal process. Where permitted by law, we will notify you of such requests before disclosure.

Data Retention

We retain your data in accordance with the following guidelines:

Active accounts: Your data is retained for as long as your account remains active and you continue to use the Service.
Post-termination: After account termination or deletion, we retain your data for 30 days to allow for recovery. After this period, all data is permanently deleted from our systems.
Audit logs: Retained in accordance with your plan limits and applicable regulatory requirements.
Billing records: Retained as required by applicable tax and financial reporting laws, which may extend beyond account termination.

International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from the laws of your jurisdiction.

When we transfer personal data outside the European Economic Area, the United Kingdom, or Switzerland, we ensure appropriate safeguards are in place. These include the use of Standard Contractual Clauses (SCCs) approved by the European Commission, as well as other legally recognized transfer mechanisms.

We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

Your Rights

Depending on your location, you may have specific rights regarding your personal data. We are committed to honoring these rights in accordance with applicable law.

GDPR Rights (EEA, UK, Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete personal data.
Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
Right to data portability: Request your data in a structured, commonly used, machine-readable format.
Right to restriction of processing: Request that we limit how we process your data in certain circumstances.
Right to object: Object to processing based on legitimate interests, including profiling.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

CCPA Rights (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to delete: Request deletion of personal information we have collected from you.
Right to opt-out: Opt out of the sale of personal information. Note: StepBase does not sell personal data.
Right to non-discrimination: You will not receive discriminatory treatment for exercising your privacy rights.

How to Exercise Your Rights

To exercise any of the rights described above, please contact us at [email protected]. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request to protect your account security.

Cookies & Tracking

We use cookies and similar tracking technologies to operate the Service, maintain your session, remember your preferences, and analyze usage patterns. Some cookies are strictly necessary for the Service to function, while others help us improve your experience.

For a comprehensive overview of the cookies we use, their purposes, and how to manage your cookie preferences, please see our Cookie Policy.

Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take prompt steps to delete that information from our systems.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected] so that we can take appropriate action.

Security Measures

We take the security of your data seriously and implement a range of technical and organizational measures to protect it, including:

Encryption in transit using TLS 1.2 or higher for all data transmitted between your browser and our servers.
Encryption at rest for stored data, with AES-256-GCM encryption specifically applied to connector credentials.
Workspace isolation through a multi-tenant architecture with strict data boundaries, ensuring that each workspace's data is logically separated.
Role-based access controls and comprehensive audit logging to track data access and modifications.
Regular security assessments and reviews of our infrastructure, code, and operational practices.

While we strive to protect your personal data, no method of electronic transmission or storage is completely secure. We encourage you to use strong passwords and to keep your account credentials confidential.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email or through an in-app notification prior to the changes taking effect.

The "Last updated" date at the top of this page indicates when the policy was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to reach out.

If you have questions about this policy, please contact us at [email protected]

Table of Contents