Privacy Policy

Introduction

Stepyo is an automatic documentation tool that captures your interactions with websites to create visual step-by-step guides. We take your privacy seriously and want you to understand exactly what data we collect, how we use it, and your rights regarding that data.

This policy applies to the use of the Stepyo browser extension and the web platform at app.stepyo.com.br.

Applicability

This Privacy Policy applies to all users who access or use Stepyo services, including:

• Users of the Chrome browser extension
• Users of the web platform (app.stepyo.com.br)
• Visitors of the institutional website (stepyo.com.br)
• Members of workspaces and teams

Regardless of your geographic location, we process all data in accordance with Brazil's General Data Protection Law (LGPD - Law 13,709/2018) and, where applicable, the European Union's General Data Protection Regulation (GDPR).

Definitions

For the purposes of this Policy, the following terms have the meanings described below, in accordance with the LGPD (Art. 5):

Data Controller, Processor, and Data Protection Officer

1. What Data We Collect

1.1 During Recording

When you use the Stepyo extension to record a process, we collect:

• Automatic screenshots: We capture page images on each interaction (click, typing, scroll)
• Interaction metadata: Action type (click, input, navigation), element coordinates, element text
• Page information: URL, page title, favicon
• Viewport size: To correctly position highlights on the screenshots
• Audio recording (optional): When you enable voice narration, we capture audio from your microphone to add narration to guide steps. Recording only occurs when you explicitly enable this feature and can be stopped at any time. Audio is securely stored and associated with your guide.

1.2 Account Data

When you sign up for Stepyo, we collect:

• Email address
• Name (if provided)
• Password (encrypted with bcrypt hashing)
• Profile picture (if authenticated via Google OAuth)
• Account creation date

1.3 Automatically Collected Data

When you use our services, we automatically collect:

• IP address
• Browser type and version
• Operating system
• Pages accessed on the platform and time of access
• Error and performance logs

1.4 Usage Data

• Guides created and modified
• Access statistics for public guides
• Interface preferences

2. Legal Bases for Processing (LGPD Art. 7)

In accordance with Brazil's General Data Protection Law (Law 13,709/2018) and the EU General Data Protection Regulation (GDPR), we rely on the following legal bases for processing your data:

3. How We Use Your Data

3.1 AI Processing

We use artificial intelligence models to enhance your guides:

• OpenAI GPT-4o-mini Vision: Analyzes captured screenshots and generates automatic descriptions for each step. Screenshots are temporarily sent to the OpenAI API and are not stored by OpenAI servers after processing.
• Anthropic Claude: Used for context analysis and intelligent step recovery (AI Recovery). Data is processed temporarily and not retained by Anthropic after processing.

No data sent for AI processing is used to train third-party models. Our contracts with OpenAI and Anthropic ensure that data submitted via API is not used for training purposes.

3.2 Storage

Your data is securely stored on Supabase (infrastructure hosted on AWS). Screenshots and audio recordings are stored in an optimized format and associated with your account. All data is encrypted in transit (TLS/SSL) and at rest (AES-256).

3.3 Purposes

• Provide the automatic documentation service
• Generate intelligent descriptions with AI
• Enable sharing and collaboration
• Improve service quality
• Product communications (with your consent)

4. Automated Decision-Making (LGPD Art. 20 / GDPR Art. 22)

Stepyo uses automated processing with artificial intelligence to:

• Generate automatic descriptions of captured steps
• Classify and organize guide content
• Detect sensitive data in screenshots (passwords, credit cards)
• Intelligently recover lost steps

None of these automated decisions produce legal effects or significantly affect your interests. All AI-generated descriptions can be edited or removed by you at any time.

Under LGPD Art. 20 and GDPR Art. 22, you have the right to request a review of decisions made solely on the basis of automated processing. To do so, please contact our Data Protection Officer at [email protected].

5. International Data Transfers

Some of our service providers are located outside of Brazil. We ensure that these transfers occur with adequate protection, in compliance with the LGPD (Art. 33), ANPD Resolution CD/ANPD No. 19/2024, and GDPR Chapter V:

6. Sub-processors

As required by the LGPD (Art. 5, VII), we list below all processors (sub-processors) that process personal data on our behalf:

All sub-processors have contracts that ensure an adequate level of data protection. This list is updated whenever a new sub-processor is added. Last updated: February 21, 2026.

7. Data Sharing

We do NOT sell your data to third parties. We share data only in the following circumstances:

• With your permission: When you share a guide publicly or with members of your workspace
• Service providers: OpenAI (AI descriptions), Anthropic (context analysis), Supabase (data, screenshot, and audio storage), Google (OAuth authentication)
• Legal requirements: If required by law, court order, or to protect legal rights
• Protection of rights: To investigate or prevent fraud, security breaches, or illegal activities

The use of information received from Google APIs complies with the Chrome Web Store Limited Use Policy, including the limited use requirements.

8. Your Rights (LGPD Art. 18 / GDPR Art. 12-23)

Under Brazil's LGPD and the EU's GDPR, you have the following rights:

9. How to Delete Your Data

Delete Individual Guides

1. Go to the guides panel at app.stepyo.com.br/dashboard
2. Click on the guide you wish to delete
3. Click "Delete Guide" in the options menu

Delete Your Entire Account

1. Go to Account Settings
2. Scroll to the "Danger Zone"
3. Click "Delete My Account"
4. Confirm the action

Warning: Account deletion is permanent and irreversible. All your guides, screenshots, audio recordings, and personal data will be deleted from our servers according to the timelines described in the Data Retention section.

10. Cookies and Similar Technologies

We use cookies and similar technologies to improve your experience. Below we detail each category:

Local Storage (Extension)

The browser extension uses the Chrome Storage API to store locally:

• Recording state (active/paused/stopped)
• In-progress guide drafts
• User preferences
• Session authentication data

This data is stored only on your device and can be cleared at any time through the extension settings or by removing the extension from your browser.

Management: You can disable non-essential cookies in your browser settings. Note that this may affect some service features.

11. Security

We implement technical and organizational measures to protect your data:

• TLS/SSL encryption on all data transmissions
• AES-256 encryption for data at rest
• Passwords stored with bcrypt hashing
• Infrastructure hosted with SOC 2 and ISO 27001 certified providers
• Row Level Security (RLS) in the database for user data isolation
• Restricted data access by staff, following the principle of least privilege
• Regular and secure backups
• Continuous security monitoring and access logging

12. Security Incidents

In the event of a security incident that may pose a risk or relevant harm to data subjects, Stepyo commits to:

• Notify the National Data Protection Authority (ANPD) within a reasonable timeframe, in accordance with applicable regulations, and the relevant EU supervisory authority where required by GDPR Art. 33
• Notify affected data subjects by email and/or an in-platform notice
• Describe the nature of the affected data, the risks involved, and the measures taken to mitigate the effects of the incident
• Maintain internal records of all incidents, documenting causes, effects, and remedial actions taken

13. Data Retention

We retain your data while your account is active and for the period necessary to fulfill the purposes described in this policy.

14. Children and Minors

Stepyo is intended for users aged 18 and older. We do not intentionally collect data from minors. If you believe we have collected data from a minor, please contact us immediately at [email protected].

If we identify data belonging to individuals under 18 in our system, we will proceed with immediate deletion, as required by the LGPD (Art. 14).

15. Embeddable SDK (Widget for Customer Websites)

Stepyo offers an SDK (Software Development Kit) that allows our enterprise customers to embed interactive tutorials and an AI assistant into their own websites and applications. In this context, the data processing roles are as follows:

16. Chrome Web Store Compliance

The Stepyo extension is published on the Chrome Web Store and fully complies with Google's developer program policies:

17. Changes to This Policy

We may update this policy periodically. Significant changes will be notified by email or through an in-platform notice at least 30 days in advance.

Continued use of the service after changes constitutes acceptance of the new policy. We recommend reviewing this page periodically.

Version History

17. Contact

For questions about privacy, to exercise your rights, or to report concerns:

We will respond to your request within 15 days, as required by the LGPD (Art. 18, § 5).

18. User Responsibility