Privacy Policy
Last updated: 9 August 2026
This Privacy Policy explains how Superwhale Ltd. ("Steply," "we," "us") collects, uses, and shares information when you use the Steply app and website (the "Service"). It is written to match what the Service actually does — if a future feature changes what we collect, we will update this policy and notify you before the change takes effect.
1. Who This Applies To
Steply is intended for users aged 16 and older. We do not knowingly collect personal data from anyone younger. See Section 9.
2. Information We Collect
Account information
Email address, password (stored as a salted cryptographic hash — we never store or can see your plain-text password), and any display name you provide.
Learning profile
Information you give us during onboarding: your name as entered, education level (e.g., high school, college), subjects you’re interested in, your stated goals and challenges, and how much time you plan to study. This is used to personalize explanations — it is not used to identify or track you outside the app.
Homework content
The text and photos of problems you submit, your typed attempts and answers, and the resulting tutoring conversation. Photos are resized and compressed on your device before being processed.
Usage and diagnostic data
Which subjects and problem types you engage with, hint usage, time spent, and similar in-app activity, used to track your learning progress and detect patterns (e.g., recurring mistakes).
Payment information
If you subscribe, our payment processor (Stripe) collects your card details directly — we never see or store your full card number. We retain only your subscription status, plan, and billing dates.
Technical data
Device type, app version, and crash/error logs, used to keep the Service working and to diagnose bugs.
We do not collect precise location, contacts, or browsing history outside the app, and we do not use advertising trackers.
3. How We Use Your Information
- —To provide the core Service: generating tutoring responses, saving your history, and applying your subscription entitlement.
- —To personalize explanations to your stated level and goals.
- —To process payments and manage your subscription.
- —To maintain security, prevent abuse, and enforce our Terms of Service.
- —To communicate with you about your account, service changes, or (only if you opt in) product updates.
- —To improve the Service, using aggregated or de-identified usage patterns wherever possible.
We do not sell your personal data, and we do not use your homework content or conversations to build advertising profiles or to train our own AI models. If that ever changes, we will update this Privacy Policy in advance and, where required by law, ask for your consent first — not bury it in a routine revision.
Legal basis for processing (EU/EEA and UK users)
Purpose
Legal basis
Providing tutoring responses, saving your history, managing your account
Necessary to perform our contract with you
Processing payments and preventing fraud
Necessary to perform our contract with you / legitimate interest
Security, abuse prevention, and enforcing our Terms
Legitimate interest
Personalization based on your onboarding answers
Necessary to perform our contract with you
Optional product update emails
Consent (you can withdraw it any time)
Automated processing
Pattern detection (e.g., flagging a recurring mistake) informs what the tutor shows you next, but it does not produce any decision with a legal or similarly significant effect on you — no automated process determines your grades, admission, or access to the Service. Account suspension for Terms violations always involves human review before it’s final.
4. Who We Share Information With
We share information only as needed to run the Service:
Recipient
What they receive
Why
[AI PROVIDER, e.g. OpenAI]
The text/photo of the problem you submit and the resulting conversation
To generate the tutoring response. Submitted under a data processing agreement. Our provider’s API does not use this data to train its models by default, and we have not opted in to any setting that would change that.
Stripe
Billing details, email, subscription status
Payment processing
[HOSTING PROVIDER, e.g. Hetzner]
All data described above, at rest
Infrastructure hosting (EU-based)
[EMAIL PROVIDER, e.g. Resend]
Your email address
Sending verification codes and account emails
We do not share data with data brokers or advertising networks. We may disclose information if required by law, to protect our legal rights, or in connection with a merger or acquisition (with notice to you).
5. International Transfers
Our infrastructure is located in [REGION, e.g. the EU]. If any provider listed above processes data outside your country, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) where required by law.
6. Cookies and Similar Technologies
Our website (steply.app) uses only strictly necessary cookies/local storage required to keep you signed in and to remember your session — these don’t require consent under EU cookie law because the Service can’t function without them. We do not currently use analytics or advertising cookies or trackers. If that changes, we will present a cookie banner before any non-essential cookie is set, and update this section accordingly.
7. Data Retention
- —Account and learning data: retained for as long as your account is active.
- —Homework photos: processed in memory to generate a response and are not permanently stored on our servers; on-device copies are removed when you delete the conversation or your account.
- —Billing records: retained for the period required by tax and accounting law after account closure.
- —Deleted accounts: when you delete your account, we delete your personal data and content within 30 days, except data we are legally required to retain (e.g., billing records) or that exists only in encrypted backups, which age out on our standard backup rotation.
8. Your Rights
Depending on where you live, you may have the right to:
- —Access a copy of the personal data we hold about you.
- —Correct inaccurate data (most fields are editable directly in the app).
- —Delete your account and associated data (available directly in Settings, or by contacting us).
- —Export your data in a portable format.
- —Object to or restrict certain processing, and (where processing is based on consent) withdraw consent at any time.
- —Lodge a complaint with your local data protection authority.
To exercise any right not available directly in-app, contact us at support@steplyai.com. We will respond within the time required by applicable law (typically 30 days). We may need to verify your identity (e.g., confirm you control the account’s email) before acting on a request, to prevent someone else from accessing or deleting your data.
9. Children’s Privacy
Steply is not directed at, and does not knowingly collect data from, anyone under 16. If we learn that we have collected personal data from someone under 16, we will delete it and terminate the associated account.
If you are a parent or guardian and believe your child has provided us with personal data, contact us at support@steplyai.com. To protect against fraudulent deletion requests, we will ask you to confirm the account’s email address and your relationship to the child before deleting the account.
10. Security
We use industry-standard measures to protect your data, including encryption in transit (TLS), salted password hashing, and access controls limiting who can view stored data. No system is perfectly secure, and we cannot guarantee absolute security.
If a breach occurs that is likely to result in a risk to your rights or freedoms, we will notify the relevant supervisory authority within the timeframe required by law (72 hours under GDPR, where applicable) and notify you directly without undue delay where the risk to you is high.
11. Your Rights if You Live in the US
If you live in a US state with a comprehensive privacy law (e.g., California, Colorado, Virginia), you have rights broadly similar to those in Section 8, including the right to know, delete, and correct your personal information. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no opt-out to exercise for those activities. To exercise any other right, contact us at support@steplyai.com; we will not discriminate against you for exercising these rights.
12. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you in-app or by email at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.
13. Contact
Questions or requests regarding this Privacy Policy or your data:
support@steplyai.com
Superwhale Ltd., Barking Abbey Road, London, United Kingdom
If you are in the EU/EEA and we are required to designate a representative or data protection officer, their contact details will be listed here: No EU representative is appointed. Superwhale Ltd. is established in the United Kingdom; EU/EEA users may contact support@steplyai.com for any data-protection request..