Privacy Policy
Effective and last updated July 29, 2026
What Stepwise collects, why it is needed, which providers process it, and the choices available to you.
Merchant identity and contact
Stepwise is not accepting payments until its verified legal business name, registration, tax number, Pakistan addresses, and support phone are published here and match the payment-provider application.
1. Data we collect
We collect account data (name, email, verification and session status), learner data (answers, timing, confidence, notes, cards, plans, settings, and progress), support correspondence, security and audit records, device/browser diagnostics, and purchase records such as order, plan, amount, currency, status, and access expiry. Stepwise does not receive or store your full card number.
2. Why we use it
We use data to authenticate you, deliver and synchronize the learning service, compute your own analytics and adaptive recommendations, provide support, verify entitlements, prevent abuse, reconcile payments, meet legal obligations, and improve reliability. We do not sell personal data or use learner answers for third-party advertising.
3. Providers and disclosure
Necessary data may be processed by Appwrite (authentication and application data), Vercel (hosting), Resend (transactional email), Safepay and its payment partners (payment processing), and Sentry only when monitoring is configured. We also disclose data when legally required, to protect users and the service, or as part of a properly safeguarded business transfer.
4. Storage, transfers, and security
Data may be processed outside your country where our providers operate. We use access controls, encrypted transport, secure session cookies, row-level permissions, signed payment webhooks, and audit records. No system is risk-free; report suspected security issues to admin@stepwise.page.
5. Retention
Account and learner data are retained while your account is active. Verified deletion requests are completed within 30 days unless records must be retained for security, dispute, tax, accounting, or other legal obligations. Support records are normally retained for 24 months; payment and accounting records may be retained for up to seven years. Encrypted backups age out on their normal rotation, generally within 90 days.
6. Your choices and rights
You can export learner data from Settings. You may request access, correction, deletion, restriction, or a copy of personal data by emailing privacy@stepwise.page. We verify identity before acting and normally respond within 30 days. You may also complain to an applicable data-protection or consumer authority.
7. Children and policy changes
Stepwise is not directed to children under 18 and does not knowingly create their accounts. We will investigate and delete an underage account when appropriately verified. Material policy changes will be dated and communicated where required.