Stepers Privacy Policy

Stepers is an email marketing platform for SaaS companies, built to work with AI agents: it sends transactional emails, runs campaigns and lifecycle automations, and shows which emails drive revenue. The product is not yet available; this website presents it and runs its waitlist. This policy covers the stepers.io website, its waitlist, its free resources and the emails that come with them. It is published by Stepers (“we”), which is the data controller. The Stepers product will have its own policy when it launches.

Joining the waitlist

The waitlist form asks for your email address only. When you submit it, the address is sent from our server to a private Google Sheet through a Google Apps Script endpoint, tagged with where it came from (“waitlist”). We do not ask for your name, company or password.

To show you the confirmation page, we set two cookies limited to that page: one records that you just signed up, the other holds your email address so your optional answers can be attached to it. Both are HTTP-only, cannot be read by scripts, and expire after one hour.

Follow-up questions. The confirmation page asks two optional questions: what SaaS you are building and which email tools you use today. Each answer is free text, cut to 200 characters, and stored in the same sheet next to your email address. Skipping them changes nothing to your place on the waitlist.

Free resources

Some pages offer a free resource in exchange for your email address: a Claude Skill (email only) and an email guide (first name and email). The details you enter are stored in the same Google Sheet, tagged with the resource you asked for, and we send you one email with the download or access link. That email is delivered by Resend.

Emails we send you

We use your email address to deliver the resources you request, to tell you when you get access to Stepers, and to send occasional updates about the product. We do not share your address with other companies for their own marketing and we never sell it. You can stop these emails at any time with the unsubscribe link or by writing to contact@stepers.io.

Analytics

We use PostHog to understand how the website is used. When it is active, it records the pages you view (the full address, including any campaign parameters), when you leave a page, clicks and similar interactions, your browser and device type, and an approximate location derived from your IP address. PostHog links these events to a random identifier stored in your browser, so it can tell repeat visits apart; if you join the waitlist, this identifier is not linked to your email address by us.

We use these statistics to improve the website and measure which pages work. They are not used for advertising and not shared with ad networks.

Cookies and browser storage

• Waitlist confirmation: two HTTP-only cookies, scoped to the confirmation page, expiring after one hour (see above).
• Analytics: PostHog stores its random identifier and session state in a cookie and in your browser’s local storage.

The website’s fonts are served from our own domain, so loading a page sends no request to Google Fonts. You can delete or block cookies and local storage in your browser settings at any time; the website keeps working without them, except the post-sign-up questions.

Server logs

Our hosting provider receives your IP address and ordinary request information (browser, requested page, time) when it serves the website. If saving a sign-up fails, our server logs the email address with the error so we can fix it. Logs are kept only as long as our hosting provider’s normal rotation.

Providers and purposes

• Google (Apps Script and Google Sheets) stores waitlist sign-ups, survey answers and resource requests.
• Resend delivers the emails we send you.
• PostHog processes website analytics.
• Vercel hosts the website and runs its server code.

These providers act on our behalf and only for these purposes. Some of them may process data outside the European Economic Area; such transfers rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

Legal basis

We rely on your consent for the waitlist, the optional questions, the resources you request and the updates we email you; you can withdraw it at any time. We rely on our legitimate interest to keep the website secure, fix errors and understand how it is used, or on your consent where the law requires it for analytics.

Storage and retention

Waitlist sign-ups, survey answers and resource requests are kept until you ask us to delete them or unsubscribe, and at most three years after our last contact with you. The confirmation cookies expire after one hour. Analytics data is kept for 12 months. Emails you send us are kept as long as needed to handle your request.

Your controls

You can ask us to access, correct or delete the information associated with your email address, to object to or restrict its use, or to receive a copy of it. Write to contact@stepers.io from the address concerned, or tell us which address it is; never send passwords. We answer within one month.

If you think your rights are not respected, you can complain to your data protection authority; in France, the CNIL (www.cnil.fr).

The website is not directed at children under fifteen. Changes to this policy are reflected in the effective date at the top of this page. Questions: contact@stepers.io.