Privacy Policy

Stepify ("we", "our", "us") is a product of Landing Pad Digital Co., Ltd., a company registered in Thailand. This Privacy Policy explains how we collect, use, store and protect your personal data when you use the Stepify platform at stepify.it and the Stepify Chrome extension.

By using Stepify, you agree to the data practices described in this policy. If you do not agree, please do not use the service.

1. Data Controller

The data controller responsible for your personal data is:

Landing Pad Digital Co., Ltd.
Chiang Mai, Thailand
Email: hello@stepify.it
Website: https://stepify.it

2. Data We Collect

2.1 Account Information

When you create a Stepify account, we collect:

• Your name and email address
• Password (stored as a one-way hash; we cannot read your password)
• Account preferences and settings

2.2 Payment Information

Payment processing is handled by Stripe, Inc. We do not store your credit card number, CVV or full card details on our servers. Stripe acts as the data processor for payment information. Please refer to Stripe's Privacy Policy for details.

2.3 Usage Data

To understand which pages are read and which features are used, we use Umami, a privacy-friendly analytics tool. It is self-hosted on our own infrastructure at analytics.landingpad.digital, meaning these figures are not handed to an outside analytics company and are not shared with any third party.

Umami is cookieless. It sets no cookies, it does not follow you across other websites, and it does not build a profile of you. It records page-level information: which page was viewed, which site you arrived from, general details of your browser, operating system, device and screen size, your language, and an approximate location worked out from your IP address at the moment of your request. Your IP address itself is not stored.

Alongside page views, we count a small number of named actions so we can see which parts of the site work: for example a sign-up click, a plan selection, or a browser extension install click. These are recorded as counts of the action itself. They carry no name, email, account identifier or tutorial content.

We set no analytics or advertising cookies. The cookies Stepify does set are the ones needed to keep you signed in and to run the product, and the encrypted platform session cookies described in Sections 3 and 4.

2.4 Platform Connection Data

When you connect a third-party platform to Stepify through our remote browser, we store encrypted session cookies from that platform. This is described in detail in Sections 3 and 4.

2.5 Data from the Stepify Chrome Extension

When you create a tutorial with the Stepify Chrome extension, the extension works inside your own browser, on the tab you choose to capture, using the account you are already signed in to. While a capture is running, it collects and sends to our servers:

• Screenshots of the tab being captured
• A list of the page's interactive elements (such as buttons, links and form fields) and their visible labels
• The web address of the page
• The actions taken during the capture, including any values you type into fields. These reach our servers as typed. Email addresses, phone numbers and card numbers in them are masked before they are sent to an AI model to write step descriptions, but they may still be visible in the screenshots sent during capture (see Section 5b).
• The tutorial goal you enter

Because these come from your own signed-in account, they may include personal data belonging to you or to others, such as names or email addresses visible on screen. Section 5 explains how this data is used and what is redacted.

The extension only collects data while a capture you have started is running, and only from the tab being captured.

3. Platform Connection and Remote Browser

This section describes how Stepify's "Connect a Platform" feature works. Please read it carefully, as it involves the processing of your login credentials on our server.

3.1 How It Works

When you connect a third-party platform (such as HubSpot, Asana, or any web application), Stepify launches a secure, isolated browser session on our server. This browser is streamed to your screen in real time, allowing you to log in to the platform as you normally would.

During this process:

• A browser runs on Stepify's server (not on your device)
• The browser display is streamed to your screen as a series of images over an encrypted WebSocket connection (WSS)
• Your mouse clicks and keyboard input are relayed from your device to the server browser
• You log in to the third-party platform through this remote browser
• Once login is detected, Stepify captures the resulting session cookies

3.2 What We Do Not Store

• Your passwords or login credentials: your keystrokes are relayed to the remote browser in real time and are not logged, recorded or stored at any point. Once the browser session ends, keystroke data is permanently gone.
• Screen recordings: the visual frames streamed to your screen are transient. They exist only in memory during the session and are not saved, recorded or archived.
• Keystroke logs: we do not log or store any record of the keys you press during a remote browser session.

3.3 What We Do Store

• Session cookies only: after you successfully log in, we capture and store the session cookies issued by the third-party platform. These cookies allow Stepify to access the platform on your behalf for tutorial generation. Cookies are encrypted before storage (see Section 4).
• Connection metadata: the platform URL, a display name, connection type, and timestamps (when connected, last used, expiry date).

3.4 Session Isolation and Destruction

Each remote browser session runs in a completely isolated environment. When the session ends (either after successful login or after the timeout), the entire browser context is destroyed. No browsing history, cache, local storage or temporary files persist beyond the session.

3.5 Concurrent Session Limits

Our server supports a limited number of concurrent remote browser sessions. If all sessions are in use, you may be asked to wait briefly. This is a capacity constraint, not a data concern.

4. Session Cookie Storage and Encryption

4.1 Encryption Method

All session cookies captured during platform connection are encrypted using AES-256-GCM (Advanced Encryption Standard, 256-bit key, Galois/Counter Mode) before being stored in our database.

4.2 Key Derivation

Each user-platform pair has a unique encryption key derived from a server-side master key. The master key is stored only as an environment variable on the server and never appears in code, databases or logs. If the database were compromised, encrypted cookies would be unreadable without the master key.

4.3 Expiry

Encrypted session cookies expire automatically after 30 days from the date of connection. After expiry, you will need to reconnect the platform. You can also revoke a connection at any time from the Platforms page.

4.4 What Happens on Deletion

When you remove a platform connection or delete your account, the encrypted cookie data is permanently deleted from our database. There is no recovery period or soft delete for encrypted authentication data.

5. Tutorial Generation and Your Data

5.1 Content Generated on Your Platform

When Stepify generates a tutorial, it navigates the platform either through your session cookies (remote browser) or through your own signed-in browser (Chrome extension). Either way, the tutorial reflects your instance of the platform, including your data, your settings and your interface.

5.2 PII Redaction

Stepify automatically blurs email addresses, phone numbers, card numbers and similar identifiers found in screenshots before they are stored or published (see Section 5b). The system is not guaranteed to catch all sensitive information, and it does not currently apply to screenshots used during capture to decide the next step. You are responsible for reviewing generated tutorials before sharing them publicly.

5.3 Tutorial Visibility

By default, tutorials you generate are private to your account. You control whether to publish, share or keep them private. Tutorials made public via a share link or published to the Stepify showcase are accessible to anyone with the link or who visits the showcase.

5.4 Tutorial Storage

Tutorial assets (screenshots, videos, metadata) are stored on our servers and with Amazon Web Services. You can delete your tutorials at any time. When deleted, all associated files (screenshots, video, captions) are permanently removed within 24 hours.

5.5 How the Chrome Extension Captures

When you start a capture with the extension, Stepify works through the task step by step in the tab you chose. At each step, the extension sends a screenshot and the list of interactive page elements to our servers. An AI model uses them to decide the next action, and the extension carries that action out in your browser. The capture stops when the goal is reached, when it cannot make progress, or when you stop it.

The extension does not read your passwords, does not access other tabs, and only acts while a capture you started is running.

5b. Screenshot Processing and Automatic PII Redaction

When you generate a tutorial, Stepify takes screenshots of the platform you are documenting. These screenshots may incidentally capture personally identifiable information (PII) belonging to third parties visible on screen, for example customer names, email addresses or phone numbers in a contact list or CRM record.

Screenshots used during capture

While a capture is running, a screenshot of each step is sent to our AI provider, DeepInfra, so its model can decide the next action (see Section 6). These screenshots are not redacted. DeepInfra states that it holds them in memory only while processing the request, does not store them, and does not use them to train models.

Screenshots stored in your tutorials

Before any screenshot is stored or published in a tutorial, Stepify redacts it:

1. We run optical character recognition (OCR) on our own servers to find text in the image that matches email addresses, phone numbers, card numbers and national identification numbers.
2. Detected regions are blurred using image processing software before the screenshot is saved.

If redaction cannot run, the screenshot is not stored or published. Redacted screenshots may then be sent to Anthropic for step analysis (see Section 6).

What This Means for You

• Screenshots stored in your tutorials have detected personal data of third parties automatically blurred.
• Your own account information (your name, your username) visible on screen is not redacted; this is expected content in tutorials you generate for your own use.

Limitations

Automatic redaction is not perfect. It detects the patterns listed above, and may miss names or other information that does not match them. If you notice personal data that has not been redacted in a tutorial you have generated, please contact hello@stepify.it immediately. We will manually redact the affected screenshots and update the tutorial within 24 hours.

Do not publish or share tutorials that you believe may contain unredacted personal data of third parties until you have verified the screenshots.

5c. Tutorial Generation Pipeline

When you submit a tutorial generation request, it is processed in these stages:

1. Job queuing: your request (goal text, platform URL, your user ID) is added to a job queue on our server. The queue keeps the most recent 100 completed and 500 failed jobs; older entries are removed automatically as new jobs arrive.
2. Platform authentication (remote browser only): your stored platform session cookies are decrypted temporarily in working memory to open your platform. Decrypted cookies are never logged or written to disk.
3. Planning: your goal text, the platform name and the page address are sent to DeepInfra to plan the steps needed to complete the goal.
4. Navigation: at each step, a screenshot, the list of interactive page elements and their labels, the goal and the steps taken so far are sent to DeepInfra to decide the next action. These screenshots are not redacted (see Section 5b).
5. Redaction: screenshots kept for your tutorial are redacted on our own servers, as described in Section 5b.
6. Step analysis: redacted screenshots are sent to Anthropic for analysis of the interface elements and actions captured.
7. Content generation: step descriptions and titles are written by a DeepInfra-hosted model. Email addresses, phone numbers and card numbers in the text sent at this stage are masked first.
8. Quality review: the completed tutorial text is scored by a DeepInfra-hosted model before being made available to you.
9. Storage: redacted screenshots are stored in Amazon Web Services S3 in the United States (us-east-1). Tutorial content and metadata are stored in our PostgreSQL database on our server in Jakarta, Indonesia.

Real-Time Progress Updates

While your tutorial is generating, progress events are streamed to your browser via Server-Sent Events (SSE). These events contain only status messages (for example "Capturing step 3 of 8") and percentage progress. No personal data or screenshot content is included in SSE events.

If you navigate away from the page while generation is in progress, your tutorial will continue generating. You will receive an email notification when it is complete.

6. AI Processing (Third-Party)

6.1 Our AI Providers

Stepify uses two AI providers:

DeepInfra handles all navigation. Anthropic is kept only as a manual fallback that we would have to switch on ourselves; it is never used automatically.

6.2 What Is Sent to DeepInfra

• Your tutorial goal text, the platform name and page addresses
• Screenshots taken during capture, which are not redacted
• The list of interactive page elements and their visible labels, which may include names or email addresses shown on screen
• The steps taken so far during the capture
• Step text for descriptions and quality scoring, with email addresses, phone numbers and card numbers masked

6.3 What Is Sent to Anthropic

• Redacted screenshots, with detected personal data blurred before transmission
• Step information derived from the capture

6.4 What Is Not Sent to Our AI Providers

• Your Stepify account name, email address or account details
• Your platform passwords, login credentials or session cookies
• Your payment information

Your goal text is sent exactly as you write it. Please do not include personal data about other people in it.

6.5 How Our Providers Handle This Data

The following reflects each provider's published terms as of 28 September 2026:

• DeepInfra states that data sent to its API is held only in memory while it is processed and is not stored to disk, and that it does not use this data to train models. See DeepInfra's data privacy page and privacy policy.
• Anthropic states that API inputs and outputs are automatically deleted within 30 days, except where longer retention is needed to enforce its Usage Policy (up to 2 years for flagged content) or required by law, and that it does not train models on customer content from its commercial services. See Anthropic's data retention article and privacy policy.

We are working to reduce the personal data sent to our AI providers during capture, and will update this policy when that changes.

7. How We Use Your Data

8. Data Sharing and Third Parties

We do not sell your personal data. We share data only with the following third parties, solely for the purposes described:

Analytics is not on that list. Our analytics run on Umami, self-hosted on our own infrastructure, so no outside analytics, advertising or social-media company receives any data from Stepify. We run no advertising trackers, no tag manager and no cross-site ad targeting.

9. Data Retention

Data held by our AI providers is governed by their own retention terms, summarised in Section 6.5.

10. Data Security

We implement the following security measures to protect your data:

• Encryption at rest: session cookies encrypted with AES-256-GCM. Passwords hashed with bcrypt.
• Encryption in transit: all connections use TLS/SSL (HTTPS). Remote browser streams and extension connections use secure WebSockets (WSS).
• Masking before AI processing: email addresses, phone numbers and card numbers in step text are masked before being sent for description writing and quality scoring.
• Infrastructure isolation: remote browser sessions run in isolated containers that are destroyed after use.
• Access control: server access is restricted. Database credentials are managed through environment variables.
• No credential storage: we do not store your platform passwords.

While we take all reasonable measures to protect your data, no system is 100% secure. If we become aware of a security breach affecting your personal data, we will notify you in accordance with applicable law.

11. Your Rights

Under the Thai Personal Data Protection Act (PDPA) and the EU General Data Protection Regulation (GDPR) (where applicable), you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Deletion: request deletion of your data. You can delete your account, tutorials and platform connections at any time through the Stepify dashboard.
• Portability: request your data in a machine-readable format.
• Withdrawal of consent: you can revoke platform connections at any time. You can withdraw consent for data processing, though this may mean we can no longer provide the service.
• Objection: object to processing based on legitimate interest.
• Restriction: request that we limit how we use your data.

To exercise any of these rights, please contact us at hello@stepify.it. We will respond within 30 days.

12. International Data Transfers

Stepify's application and database run on our server in Jakarta, Indonesia, and tutorial screenshots are stored with Amazon Web Services in the United States (us-east-1). Some data is processed by third parties in the United States (DeepInfra, Anthropic, Stripe, Resend). Where data is transferred outside Thailand, we rely on contractual obligations with our service providers to protect your data in accordance with applicable law.

12b. Thai PDPA Compliance

Stepify is operated by Landing Pad Digital Co., Ltd., a company registered in Thailand. We process personal data in accordance with the Personal Data Protection Act B.E. 2562 (PDPA).

With respect to tutorial generation specifically:

• We apply automatic PII redaction to screenshots before they are stored or published. Screenshots used during capture to decide the next step are sent to our AI provider without redaction, as described in Sections 5b and 6.
• Platform session cookies (which may be considered personal data) are stored encrypted and accessed only when required for tutorial generation.
• You retain the right to request deletion of your tutorials and associated screenshot data at any time via your account settings or by contacting hello@stepify.it.
• We do not sell, share or transfer tutorial content or screenshots to third parties except as described in this policy (AI processing and cloud storage).

13. Children's Privacy

Stepify is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@stepify.it and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice on stepify.it. The "Last updated" date at the top of this page indicates when the policy was last revised.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your data:

Landing Pad Digital Co., Ltd.
Email: hello@stepify.it
Website: https://stepify.it