Data processing agreement

1. When this applies

This agreement is between you, the customer named on the workspace, and Ideonate Ltd (“we”), a company registered in England and Wales (company number 11763313). It applies whenever a recording, or anything made from one, contains personal data that data protection law covers: the UK GDPR and the Data Protection Act 2018, the EU GDPR, and any similar law that applies to you. For that data you are the controller, or a processor acting for your own customer, and we are your processor.

It does not cover information about you as a user of Stepthrough, such as your account and your payments. We are the controller of that, and our privacy notice describes it.

Where this agreement and the terms say different things about personal data, this agreement applies.

2. What we process, and why

Purpose: to provide Stepthrough to you: recording your app in a browser, writing scripts and narration, producing videos, checking them again when your app changes, keeping the service secure and fixing faults.
What we do with it: capture, store, analyse with AI models, turn text into speech, render into video, deliver to you, and delete.
The data: whatever is on screen or in the page in the app you point Stepthrough at, and what is made from it: video, screenshots, copies of pages, scripts, narration and captions. Also the logins you give a recording to sign in with.
Whose data: whoever appears in that app. You decide this. Our terms ask you to use test accounts and sample data, so in normal use this is nobody real.
Sensitive data: Stepthrough is not designed for special category data, criminal records data, payment card numbers or health records. Do not record an app showing real data of those kinds.
How long: for as long as your workspace exists, then as section 9 says.

3. Your instructions

We process this personal data only on your documented instructions. Your instructions are the terms, this agreement, and what you and your users ask the product to do. If the law requires us to process it in another way we will tell you first, unless the law forbids that. If we think an instruction breaks data protection law we will tell you.

We do not sell this data, use it for advertising, or use it to train AI models.

4. Your responsibilities

You are responsible for having a lawful basis to show us what a recording captures, for telling the people concerned where the law requires it, and for the instructions you give us. You choose the app, the accounts and what is recorded.

5. People and security

Everyone we authorise to handle this data is bound to keep it confidential. We keep in place the security measures described at the end of this agreement, and may change them as long as the protection does not get weaker.

6. Other processors

You agree that we may use the providers listed below. Each handles only what its job needs, under a contract that protects the data to the standard this agreement sets, and we remain responsible to you for what they do with it.

Fly.io: runs the application and the browsers that record walkthroughs. United States.
Neon: the database: accounts, guides, scripts, billing records. United States.
Cloudflare: stores and delivers recordings and videos; network security; hosts this website. United States and its global network.
Anthropic: the AI models that drive the browser and write scripts and narration. United States.
Deepgram: turns narration text into speech. United States.
ElevenLabs, OpenAI: premium narration voices, only where a Business workspace chooses one. United States.
Pydantic Logfire: diagnostic traces of the AI calls a recording makes. United States.
Resend: sends account and notification email. United States.
Stripe: takes card payments for credits. United States.
PostHog: counts how this website and the product are used. United States.

Before we add or replace a provider that handles this data we will update this page and tell your workspace's owners in advance. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using Stepthrough and ask us to delete your workspace.

7. Transfers outside the UK and EEA

Our systems and providers are mainly in the United States, so this data is transferred to and stored there. Where the law restricts such a transfer, we make it only under a safeguard the law recognises: an adequacy decision that covers the recipient, or the standard contractual clauses approved for the purpose (with the UK addendum where UK law applies). Where a transfer from you to us needs such clauses, they are incorporated into this agreement, with you as the exporter and us as the importer.

8. Helping you meet your obligations

Requests from individuals: if someone asks us about their data in one of your recordings we will pass the request to you and not answer it ourselves, unless the law requires us to. You can find and delete recordings yourself in the product, and we will help with anything you cannot do there.
Breaches: if we become aware of a personal data breach affecting your data we will tell your workspace's owners without undue delay, with what we know about what happened, what was affected and what we are doing about it. We will keep you informed as we learn more.
Assessments: we will give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator about your use of Stepthrough.

9. Deletion and return

You can download your videos and delete guides and recordings at any time. Deleting a guide deletes its recordings.
We may delete recordings, scripts and videos as section 8 of the terms sets out.
When you ask us to delete your workspace, or the agreement ends, we delete its recordings, videos, scripts, stored logins and users within 30 days. Tell us before then if you want time to download anything.
Deleted data may remain in our backups, which are kept apart from the live service, for up to 90 days before it is erased there too. Copies in our providers' own backups expire on the providers' schedules.
We keep the record of purchases and of administrative actions on the account, for accounting and to handle disputes, and anything the law requires us to keep.

10. Showing that we comply

We will give you the information you reasonably need to check that we are meeting this agreement.

11. Liability and duration

The limits on liability in the terms apply to this agreement. Nothing in it limits either party's liability to an individual, or to a regulator, under data protection law. This agreement lasts for as long as we hold personal data on your behalf.

Security measures

Separation: each workspace's records are kept apart from every other's, enforced by the database on every query, and its files are stored under its own prefix.
Encryption: connections are encrypted in transit. Stored logins and saved sessions are encrypted by us with a key the database does not hold. Our storage and database providers encrypt data at rest.
Isolated recordings: each recording runs in its own short-lived virtual machine, destroyed when it finishes. It holds no database or storage credentials and no provider keys, and can reach our systems only through an interface limited to its own job.
A contained browser: the recording browser runs inside its own sandbox with no network access except through a filtering proxy, which refuses private addresses and keeps pages to the domains you have listed. It cannot read the rest of the machine.
Logins kept from the AI: the credentials a recording signs in with are not shown to the AI models and cannot be read back in the product.
Access: passwords are stored hashed, sign-in attempts are rate-limited, and sessions can be reviewed and ended by the user. Access to production by our own staff is limited to those who need it to run the service, and administrative actions on a workspace are logged with who took them and why.
Logs: secrets, tokens and passwords are removed from logs before they are written.

Contact

For anything in this agreement, or for a signed copy, write to hello@stepthrough.ai.