Privacy policy

Last updated: August 2026

Who we are

Stept ("we") provides an open-source customer-support platform, available self-hosted and as a hosted service at app.stepped.ai ("Stept Cloud"). Contact: [email protected].

Self-hosted installs

If you self-host Stept, we collect nothing. All data stays in your own infrastructure and your own database. The software makes no calls home — the only outbound requests are the ones you configure (your AI provider, your email transport, your integrations).

Stept Cloud — what we store

• Account data: your email address, name and password hash.
• Workspace content: conversations, contacts, knowledge documents, articles, tours and settings your team creates — processed solely to provide the service to you.
• Provider credentials: AI model keys and channel tokens you connect are encrypted at rest.
• Technical logs: IP addresses and request metadata, kept short-term for security and rate limiting.

Where it lives

Stept Cloud runs on EU infrastructure (Hetzner). Traffic is served through Cloudflare for TLS and DDoS protection.

AI processing

When your workspace uses an AI feature, the relevant conversation and knowledge excerpts are sent to the model provider you configured with your key. We do not train models on your data and we add no hidden providers.

Your rights

You can export or delete your workspace data at any time — email [email protected] for GDPR requests (access, rectification, erasure, portability).

Sub-processors

Hetzner Online GmbH (hosting, EU) · Cloudflare, Inc. (network/TLS) · the AI and email providers you explicitly connect.