Last updated: 31 May 2026 · Iclick Holdings Limited, Cyprus
Step2Step is operated by Iclick Holdings Limited, a company registered in Cyprus. We are the data controller for personal information collected through this service. Contact: step2stepai@gmail.com.
Account data: when you register we collect your email address and a hashed password (managed by Clerk). We never store plain-text passwords.
Usage data: homework problems you submit, AI responses, credit balance and transaction history. This data is used to provide and improve the service.
Payment data: when you purchase credits, Stripe processes your payment information directly. We receive only a transaction confirmation and your Stripe customer ID. We do not store or process full card numbers, CVV codes or bank account details.
Technical data: browser type, device, IP address and general location (country level), collected automatically via server logs. We do not use tracking pixels or third-party advertising networks.
We use your data to: deliver AI-powered solutions to your homework questions; manage your credit balance; process payments and issue receipts; improve the accuracy and safety of the service; send transactional emails (password reset, credit confirmations); comply with legal obligations.
We do not sell your personal data. We do not use your homework content to train external AI models.
We share data with the following processors, each bound by their own privacy obligations:
Clerk: authentication and user management. Clerk Privacy Policy.
Anthropic: AI processing of homework questions. Anthropic may retain prompts for up to 30 days for safety monitoring. Data may be processed in the United States. Please do not include sensitive personal information in homework questions. Anthropic Privacy Policy.
Stripe, Inc.: payment processing. Stripe is certified to PCI-DSS Level 1. Data may be processed in the United States and EU. Stripe Privacy Policy.
As a Cyprus-based company operating within the EU/EEA, we ensure that any transfer of personal data outside the EEA is subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) where applicable. By using Step2Step you acknowledge that your data may be processed in countries outside the EEA, including the United States.
Account and usage data is retained while your account is active. Transaction and billing records are retained for 7 years for accounting and tax compliance. You may request deletion of your account at any time by emailing step2stepai@gmail.com. Deleted accounts are purged within 30 days, subject to retention obligations under applicable law.
Step2Step is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected such data, we will promptly delete it. Parents or guardians who believe their child has provided personal information should contact us at step2stepai@gmail.com.
If you are in the EU/EEA/UK you have the right to: access your personal data; rectify inaccurate data; request erasure; restrict or object to processing; data portability; withdraw consent at any time; lodge a complaint with your national supervisory authority. Contact us at step2stepai@gmail.com. We will respond within 30 days.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Article 33–34.
We use a single session cookie (HttpOnly, Secure) for authentication. We do not use analytics or advertising cookies.
We may update this policy periodically. Material changes will be communicated via email or in-app notice at least 14 days before taking effect.