Privacy Policy

1. Who we are

stepIQ is a product of Ligerian Labs, a brand of Pupuce CORP (EURL), registered in France. We operate the websites stepiq.sh, app.stepiq.sh, and api.stepiq.sh.

Contact: bonjour@ligerianlabs.fr

2. Data we collect

Account data

When you create an account, we collect your email address and a hashed version of your password. We never store plaintext passwords.

Pipeline data

We store your pipeline definitions, execution logs, step outputs, and associated metadata. This data is necessary to provide the service.

Usage data

We collect anonymized analytics data including page views, feature usage, and performance metrics to improve the product. We use PostHog (EU-hosted) for this purpose.

Payment data

If you subscribe to a paid plan, payment processing is handled by our payment provider. We do not store your full credit card details.

3. How we use your data

• To provide and maintain the stepIQ service
• To execute your AI pipelines by sending prompts to third-party model providers (Anthropic, OpenAI, Meta via inference partners)
• To track credit usage and billing
• To send transactional emails (account confirmation, password reset, usage alerts)
• To improve the product based on aggregated, anonymized usage patterns

4. Third-party model providers

When you run a pipeline, your prompts and inputs are sent to the AI model provider you selected (e.g., Anthropic, OpenAI). Each provider has its own data processing terms:

• Anthropic — API inputs are not used for training. See Anthropic's privacy policy.
• OpenAI — API inputs are not used for training by default. See OpenAI's privacy policy.
• Meta Llama — Served via inference partners. Data handling depends on the partner.

We recommend not including sensitive personal data in pipeline prompts unless you understand the downstream provider's data handling practices.

5. Cookies

We use strictly necessary cookies for authentication (JWT session tokens). We use PostHog for analytics, which may set cookies for session tracking. No advertising cookies are used.

6. Data retention

Account data is retained for the lifetime of your account. Pipeline execution logs are retained for 90 days on the Free plan and 1 year on paid plans. You can request deletion of your data at any time.

7. Your rights (GDPR)

If you are in the European Economic Area, you have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate data
• Erasure — Request deletion of your data
• Portability — Export your pipeline definitions and data
• Object — Object to processing based on legitimate interests
• Restriction — Request limitation of processing

To exercise any of these rights, contact us at bonjour@ligerianlabs.fr. We will respond within 30 days.

8. Data security

We use industry-standard security measures including:

• TLS encryption for all data in transit
• AES-256-GCM encryption for stored secrets and API keys
• Bcrypt password hashing
• Infrastructure hosted in European data centers

9. Changes to this policy

We may update this privacy policy from time to time. We will notify you of material changes via email or in-app notification. Continued use of the service after changes constitutes acceptance.

10. Contact

For any questions about this privacy policy or your data, contact us at:

Ligerian Labs (Pupuce CORP EURL)
Email: bonjour@ligerianlabs.fr
Angers, France