Privacy Policy

1. Introduction

Stepform ("we", "us", "our") operates the website www.stepform.ai and the Stepform platform (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website or use our Service.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the ePrivacy Directive, and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

Stepform
Email: privacy@stepform.ai

3. Personal Data We Collect

3.1 Data you provide directly

• Account information: name, email address, and profile picture when you create an account (including via Google Sign-In).
• Organization data: workspace name and team member email addresses when you create or join an organization.
• Form content: the forms, funnels, pages, and associated content you create using our Service.
• Communications: any information you provide when contacting our support team.
• Integration data: when you connect third-party services (e.g., Slack, Google Workspace, or Microsoft 365), we store the OAuth credentials, account identifiers, permissions, and connection metadata required to provide and secure the connection.

3.2 Data collected automatically

• Usage data: pages visited, features used, clicks, session duration, and other interaction data.
• Device and browser data: IP address, browser type and version, operating system, device type, and screen resolution.
• Cookies and similar technologies: we use strictly necessary cookies for authentication and session management. See Section 8 for details.

3.3 Data from form respondents

When end users ("respondents") fill out forms created with Stepform, the form creator (our customer) is the data controller for that submission data. We act as a data processor on behalf of our customers. Submission data may include any information the form creator chooses to collect (e.g., names, emails, addresses, phone numbers, or other responses).

3.4 Connected Google and Microsoft mailbox data

If you choose to connect a Google or Microsoft mailbox, Stepform requests access only after you initiate the connection and approve the provider's authorization screen. We access and process the following data to provide the connected-mailbox feature:

• Mailbox account and authorization data: your Google account identifier, mailbox email address, granted scopes, encrypted OAuth access and refresh tokens, token expiry, and connection status.
• Messages sent through Stepform: sender and recipient addresses, subject, message body, message and thread identifiers, timestamps, and delivery status for emails that your Stepform automations or sequences send using the connected mailbox.
• Correlated incoming messages: sender and recipient addresses, subject, relevant headers, message body, message and thread identifiers, timestamps, reply classification, and delivery-status information for replies, out-of-office responses, and bounces that relate to an email previously sent through Stepform.
• Synchronization data: Gmail history cursors or Microsoft Graph subscription and delta identifiers, notification identifiers, and processing timestamps used to identify mailbox changes and keep reply and delivery status current.

Stepform is not a general email client and does not import or store your inbox. When Gmail or Microsoft Graph reports a mailbox change, Stepform may temporarily inspect limited message metadata and headers to determine whether the message belongs to a Stepform-originated conversation. Unrelated messages are discarded and their bodies are not collected or retained. Stepform does not download or retain mailbox attachments.

Google and Microsoft provide this data to Stepform as raw account, authorization, message, and synchronization data; neither provider supplies Stepform with an aggregated or anonymized mailbox dataset. Stepform does not create aggregated or anonymized datasets from mailbox message content. We may calculate limited operational counts, such as numbers of Stepform-sent messages, replies, or delivery outcomes, from the customer's automation and sequence records to display and operate the Service. Those counts are not used for advertising, profiling, credit, lending, data brokerage, or AI or machine-learning model training.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): to provide and maintain our Service, process your registration, and manage your account.
• Legitimate interests (Art. 6(1)(f)): to improve our Service, prevent fraud, ensure security, and send non-marketing service communications.
• Consent (Art. 6(1)(a)): where you have given explicit consent, such as for marketing communications or when authorizing access to a connected Google mailbox. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to comply with applicable laws and regulations.

5. How We Use Your Data

• Provide, operate, and maintain the Service
• Create and manage your account
• Process and store forms and submissions on behalf of our customers
• Send transactional emails (e.g., magic link sign-in, team invitations)
• Send customer-configured automation emails from a connected mailbox after form events, send customer-configured sequence emails, and show the resulting send, reply, out-of-office, or bounce status in Stepform
• Match incoming Google or Microsoft mailbox messages only to conversations initiated by Stepform and discard unrelated mailbox messages
• Monitor and analyze usage trends to improve the Service
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

6. Data Sharing and Transfers

We do not sell your personal data. We may share data with:

• Service providers (sub-processors): trusted third-party providers that help us operate our Service. These providers are contractually obligated to process data only on our behalf and in compliance with GDPR. See Section 6.1 for the full list.
• Customer-configured integrations: when you connect third-party services (e.g., Slack) or enable tracking pixels (e.g., Meta Pixel, Google Ads), data is shared with those services as directed by you. You are the data controller for these transfers.
• Legal requirements: if required by law, regulation, or legal process, or to protect our rights, safety, or property.

We do not sell Google Workspace or Microsoft mailbox user data, use it for advertising, transfer it to data brokers or information resellers, or use it to determine creditworthiness or for lending. We do not send connected-mailbox message subjects, bodies, headers, recipients, reply content, delivery-status content, or attachments to third-party AI or machine-learning providers. If a user expressly invokes Stepform's AI automation editor, it may receive limited connection metadata, such as the connected sender email address, solely to help the user select that sender in the automation they are editing. Connected-mailbox data is not used to train, develop, or improve generalized AI or machine-learning models.

Raw connected-mailbox data and the limited operational counts described in Section 3.4 are processed only by Stepform and the infrastructure providers needed to run the feature, principally Vercel for application processing and Supabase for encrypted credential and connected-mailbox record storage. Hetzner hosts the automation editor service that can process the limited sender connection metadata described above, and Vercel's AI Gateway routes user-invoked AI editor requests. Google processes API requests and sends the user-directed emails. We do not disclose this data to Postmark, advertising integrations, or data brokers. Connected-mailbox message data is not disclosed to AI model providers; only the limited sender connection metadata described above may be included in a user-invoked AI editor request.

6.1 Sub-processors

The following third-party sub-processors are used to operate the Service. We ensure appropriate safeguards are in place for each, including Standard Contractual Clauses (SCCs) where data is transferred outside the European Economic Area (EEA).

6.2 International transfers

Some of our sub-processors are located outside the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions.

6.3 Google Workspace API data and Limited Use

Stepform's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google Workspace data only to provide or improve the prominent, user-facing connected-mailbox features described in this policy. We transfer that data only to service providers when necessary to provide those features with the user's consent, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining any explicit prior consent required by Google's policies. Our employees and contractors may not read Gmail message data unless the user gives documented consent for support involving specific messages, access is necessary for security or abuse investigation, or access is required by law. We require our personnel and service providers to comply with these restrictions and apply equivalent use, transfer, and human-access restrictions to Microsoft mailbox data.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Account data: retained while your account is active. Upon account deletion, your data is permanently removed within 30 days.
• Form submission data: retained as long as the form creator's account is active, or until the form creator deletes the data.
• Connected-mailbox authorization data: encrypted OAuth tokens and connection metadata are retained while needed to keep the mailbox connected. Removing a mailbox from a workspace disables it for that workspace; if it is the mailbox's last active workspace connection, Stepform also stops mailbox synchronization. A user can revoke Stepform in their Google or Microsoft account and can request complete deletion of stored mailbox authorization data by contacting privacy@stepform.ai.
• Connected-mailbox message data: records for Stepform-sent emails and their correlated replies or delivery events are retained while needed to show the customer's automation history. Removing a mailbox from a workspace does not by itself remove that existing history. The workspace owner or affected mailbox user may request deletion of Gmail- or Microsoft-derived message data by contacting privacy@stepform.ai.
• Deletion requests: connected-mailbox authorization data and mailbox-derived message data covered by a verified deletion request are permanently deleted from our active systems within 30 days, unless retention is required by law or is necessary to investigate fraud, abuse, or a security incident. Residual backup copies are isolated from normal use and expire according to our backup schedule.
• Usage and analytics data: retained in anonymized or aggregated form for up to 24 months.

8. Cookies

We use only strictly necessary, first-party cookies required for the functioning of our Service. No cookie consent banner is required for these cookies under the ePrivacy Directive, as they are essential for the service you have requested.

8.1 Platform cookies (logged-in users)

• Session cookies: to authenticate your identity and maintain your login session.
• Security cookies: to prevent cross-site request forgery and other security threats.

8.2 Published form cookies (form respondents)

When a respondent interacts with a form created with Stepform, the following first-party cookies may be set. These are strictly functional and contain no personal data:

• Submission cookie: links a respondent's browser to their in-progress form submission so they can resume where they left off if they return. Contains only a random identifier. Expires after 30 days.
• Start page cookie: remembers which start page variant was shown to a respondent for consistent A/B testing. Contains only a page identifier. Expires after 30 days.
• Analytics visitor cookie: an anonymous, randomly generated visitor identifier used for privacy-friendly, aggregate analytics (e.g., unique visitor counts). It contains no personal data and cannot be used to identify an individual. Expires after 30 days.

8.3 Third-party tracking

We do not use tracking or advertising cookies ourselves. Third-party integrations configured by form creators (e.g., Meta Pixel, Google Ads, Google Tag Manager) on published forms are the responsibility of the form creator as the data controller.

9. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): request restriction of processing in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at privacy@stepform.ai. We will respond within 30 days as required by GDPR.

You also have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest
• Additional authenticated encryption for stored OAuth access and refresh tokens using AES-256-GCM
• Access controls and authentication mechanisms
• Organization-level access controls for connected-mailbox records
• Restricted human access to connected-mailbox data, limited to documented user-approved support, security or abuse investigation, or legal requirements
• Regular security assessments

While we strive to protect your personal data, no method of transmission or storage is 100% secure. If you become aware of a security vulnerability, please contact us immediately.

11. Data Processing Agreement

Where Stepform acts as a data processor on behalf of customers (form creators), we enter into a Data Processing Agreement (DPA) in accordance with Article 28 GDPR. If you require a signed DPA, please contact us at privacy@stepform.ai.

12. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such data promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Stepform
Email: privacy@stepform.ai