Version date: 26 October 2026
This Policy explains, in plain words, what data AI STEP collects, why, who else sees it, how long we keep it and what you can demand from us at any moment.
We are a Ukrainian service. This Policy is governed by the law of Ukraine — in particular the Law of Ukraine "On Personal Data Protection", the Law of Ukraine "On Electronic Commerce", the Law of Ukraine "On Protection of Consumer Rights" and the Law of Ukraine "On Copyright and Related Rights". If you are in the European Economic Area or the United Kingdom, the GDPR applies to you in addition, and we describe your GDPR rights below.
This English text is provided for the convenience of international users. In case of any discrepancy, the Ukrainian version of this Policy prevails legally.
1.1. The data controller is individual entrepreneur (FOP) Riasna Sofiia Volodymyrivna (taxpayer ID 3872001402, Ukraine), who operates AI STEP — below, "we", "us", "AI STEP".
1.2. Contacts for any data question, request or complaint: support@aistep.app. Write to the e-mail address for anything related to your data — it is the fastest channel and it is the one we monitor. We have not appointed a separate data protection officer (DPO): requests are handled directly by the service owner.
1.3. What the service is, so you can see why we need each piece of data. AI STEP is an online product — a web service and a mobile app for iOS and Android — for learning to work with AI tools in your job, your own business and side jobs, available by subscription. It includes: a certificate learning program made of courses on AI tools (as of 13 October 2026: 28 courses and 828 lessons; each lesson is a short practical task inside a chat window with an explanation and a check); completion certificates; an AI Mentor (chat); AI tools (ready-made prompts for a post, an e-mail, a content plan and similar); and progress and streak tracking. All of it opens only with an active subscription, including during a trial.
1.4. We are an educational product and we do not guarantee income. We teach skills. We do not promise, guarantee or forecast any earnings, profit, clients or employment. Your result depends on your own effort, your skill and the market. Any figures you see in lessons or marketing are illustrations, not a promise.
1.5. A completion certificate in AI STEP is an internal badge of the service confirming that you finished a course inside AI STEP. It is not an accredited diploma and not a state-recognised educational document. We store the fact of completion in our database and nothing more. Each certificate has a number and a QR code that leads to a public verification page; that page shows only whether the number is valid, the course and the issue date — not your name.
1.6. The service is for adults, 18+. It is a paid product about work, running your own business and side jobs, and we do not target or knowingly onboard minors.
1.7. Payments on the website by customers in Ukraine are taken directly through WayForPay (Ukrainian acquiring, Visa / Mastercard cards), and we handle billing questions and refunds for such payments ourselves. For customers outside Ukraine, orders on the website are processed by our online reseller Paddle.com, the Merchant of Record for such orders: Paddle takes the payment, issues the receipt and handles customer service and refunds for them. Paddle processes the payment data as a separate seller of record under its own Privacy Notice (paddle.com/legal/privacy). Depending on your country, the seller of record is Paddle.com Inc. (United States), Paddle.com (Canada) Ltd. (Canada) or Paddle.com Market Limited (rest of the world). To show the price in your currency and calculate the taxes, Paddle receives your IP address at checkout. What Paddle receives from us and what we receive from Paddle is listed in the table in clause 5.1.
1.8. When you buy in the app for iOS or Android, the purchase is made through the in-app purchase system of the App Store (Apple) or Google Play (Google). The payment is processed by Apple or Google, we never receive your card details, and our server verifies the purchase receipt with the store to open your access. A subscription bought this way is managed and cancelled in the subscription settings of your Apple ID or Google account, and refunds for it follow the rules of the respective store. What data we receive about such a purchase, and why, is described in clause 5.8.
2.1. We collect only what the product actually needs. Below is the full list.
| Data | When it is collected | Why we need it | Legal basis |
|---|---|---|---|
| Quiz answers — gender, age group, name, goal, AI tools you know, experience, time per day, income orientation and other answers about your work and learning | When you go through the onboarding quiz, before or after registration | To build your plan and set your daily learning pace. All answers are kept on your device. When you leave your e-mail, the app sends our server a request that may include other quiz answers, but we store from it only your name, the technical goal key and the technical segment: we use the goal to choose which e-mails to send if you agreed to receive them. The server does not store the other answers (including those about income) | Steps taken at your request before entering into a contract (before an account exists) / performance of the contract (after you have an account) — Art. 6(1)(b) GDPR |
| In the lead form and at registration | Account login and identification, service messages (access, payment, subscription, password reset); if you leave your e-mail without ticking the marketing box, one service message with your plan; with separate consent — marketing e-mails. The consent is a tick-box that is not pre-ticked, and marketing e-mails start only after you confirm your address with the button in our confirmation e-mail | Performance of the contract; consent for marketing — Art. 6(1)(b), 6(1)(a) GDPR | |
| Proof of marketing consent — the time you ticked the box, the version of the text shown next to it, the country of the request (taken from the network connection, not from what you enter) and the time you confirmed your address | When you tick the box and when you press the confirmation button | To show that and when you consented, to send marketing e-mails only to confirmed addresses, and to show that an unsubscribe was honoured | Legal obligation to demonstrate consent; legitimate interest in defending against claims — Art. 7(1), 6(1)(c), 6(1)(f) GDPR |
| Name | In the quiz (a required field) or when you edit your profile | To address you inside the service and on the certificate badge | Performance of the contract — Art. 6(1)(b) GDPR |
| Account data, including the password as a hash | At registration and at each login | Authentication and account security. The password is stored only as a hash and is managed by Supabase Auth — we never see or store your plaintext password | Performance of the contract; legitimate interest in security — Art. 6(1)(b), 6(1)(f) GDPR |
| Learning progress and streak — lessons opened and completed, quiz results, courses finished, streak days | While you use the service | To continue learning from where you stopped, to keep progress and streak, to issue the completion badge | Performance of the contract — Art. 6(1)(b) GDPR |
| Subscription status and payment history — date, amount, plan, transaction status, card type, the last 4 digits of the card number, the issuing bank's country; for a purchase in the app for iOS/Android — the purchase data we receive from the store: identifiers, product, dates, status, price and currency (clause 5.8). Never the full card number, expiry date or CVV | At each payment, renewal, cancellation or refund | To open and keep your access, to run and stop auto-renewal, to process refunds, to comply with accounting and tax duties | Performance of the contract; legal obligation — Art. 6(1)(b), 6(1)(c) GDPR |
| Credit balance and movements ✦ — the number of monthly and purchased credits, the date until which monthly credits are valid, a ledger of credits added and spent (date, amount, reason: added with the plan, a pack purchased, an AI feature used, a refund; a technical reference, without the text of your requests) | When you use the AI features, receive credits with your plan or buy a credit pack | To show the balance, to spend credits for the AI features in the right order, to refund the value of unused credits, to resolve disputes | Performance of the contract — Art. 6(1)(b) GDPR |
| Purchase log — what exactly was bought (a credit pack, a course, a certificate), the transaction identifier, the amount and currency, the date, the status (granted or refunded), how many credits were granted | When you buy a credit pack, a course or a certificate (on the website — through the payment service, in the app — through the App Store or Google Play) | To grant what you bought and not grant it twice, to revoke it on a refund, to keep accounts and taxes, to handle refunds and disputes | Performance of the contract; legal obligation — Art. 6(1)(b), 6(1)(c) GDPR |
| Record of your consent at payment on the website — the time, the version of the Terms, the amount of the first charge, the amount and period of renewal, the date of the first renewal, the text describing the product on the payment page, the order number, the IP address, the browser type, the browser languages, the device time zone, the country derived from the IP address (and, when the app sends them, also the text of the sentence next to the button and the button label). No card details | When you set up a payment on the website (a subscription or a one-off purchase) | To show your bank or the payment system what you were shown and what you agreed to if a payment is disputed; to defend against claims | Legitimate interest in defending against claims and demonstrating consent — Art. 6(1)(f), 7(1) GDPR |
| Friend invitations (if the "Invite a friend" programme is on) — your invitation code, the link between the accounts of the person who invited and the person invited, the reward granted | When you share your code or enter a friend's code | To grant the trial and rewards under section 24 of the Terms. The person who invited sees only the number of people invited and the number who started paying — no names, e-mails or payments | Performance of the contract — Art. 6(1)(b) GDPR |
| Texts of your AI requests — what you type to the AI Mentor and into AI tools | At the moment you send a request | To generate the answer: the text of the current conversation is passed to the model provider (clause 5.1). Your chat history is stored only on your device. On our server, the text of a request is processed to pass it to the model provider and is not stored. The exception is a complaint about an answer: the question and the answer, together with the reason and your comment (if you wrote one), are saved with the complaint and deleted together with your account | Performance of the contract — Art. 6(1)(b) GDPR |
| Images the AI Mentor creates at your request | When you ask the AI Mentor to generate an image | To show you the image in the chat. Images are kept in our storage (Supabase, EU) while your account exists and are deleted with it. An image carries a machine-readable label saying it was created by AI if the model provider added one | Performance of the contract — Art. 6(1)(b) GDPR |
| Telegram data (only if you linked our bot yourself) — chat identifier, username, link date, your messages to the bot | When you link the bot via a link from the service or an e-mail, and when you write to it | To send you messages in Telegram about your plan, price and offers, and to reply to your messages. To unlink the bot, send it "stop" or block it | Consent — Art. 6(1)(a) GDPR |
| Interface language | When you choose a language or on first load | To show the service in your language and to pass the language code to the AI provider so the answer comes back in that language | Performance of the contract — Art. 6(1)(b) GDPR |
| Notification settings — which notifications you want (lesson reminders, progress, offers) and the reminder time; on the website, if you allowed notifications in your browser — the push subscription (the delivery address issued by your browser's push service and its encryption keys), time zone, language and browser type | When you turn notifications on or change them | To send only the notifications you allowed, at your local time, and not to send the kinds you turned off. In the iOS and Android apps, reminders are scheduled on your device by its operating system: we receive no push token, and the reminder time stays on the device (clause 5.9) | Consent — Art. 6(1)(a) GDPR: you turn notifications on yourself and can turn them off at any time |
| Product usage events — for example opening a lesson, finishing a quiz, reaching the payment screen, cancelling a subscription | While you use the service | To see where the product breaks or confuses people and to fix it; to detect abuse. Our analytics is our own, stored in our own database | Legitimate interest — Art. 6(1)(f) GDPR |
| Technical logs — IP address, browser type | Automatically, with every request to the service, on the side of Supabase / the hosting provider. In addition, when you leave your e-mail in a form, the IP address of that request is recorded in our database together with the event | Service delivery, protection against attacks and abuse (including mass sign-ups from one address), incident investigation | Legitimate interest — Art. 6(1)(f) GDPR |
| Crash and error reports — type of error, stack trace, app version, operating system / browser version, a random installation identifier (the same one as in our analytics events). No IP address, no request headers, no e-mail | Automatically, when the application crashes or an error occurs | To find and fix failures. Reports contain no name, e-mail or IP address | Legitimate interest — Art. 6(1)(f) GDPR |
2.2. We do not build hidden profiles beyond what is listed above, and we do not enrich your record with data bought from third parties.
2.3. Subscription, auto-renewal and refunds — what we disclose and when. These are contractual terms rather than privacy terms, but they explain the payment data above, so we state them here too.
2.3.1. The price of the plan, the billing period and the fact that the subscription renews automatically are disclosed to you before you pay, on the payment screen. On the website, trial access costs ₴149 for 3 days and then renews automatically at the price of the selected plan; in the app for iOS/Android, the price and the terms of any trial are those shown by the store before purchase. The current plan prices (weekly, monthly, annual, with and without the promo) are always shown before payment.
2.3.2. You can cancel at any time, yourself: Profile → "Subscription" → "Cancel subscription" (for a subscription bought in the app for iOS/Android — in the subscription settings of your Apple ID or Google account). No calls, no letters, no explanations required. After cancellation your access remains until the end of the period you have already paid for.
2.3.3. Discounts on the website are real (the apps for iOS and Android have no discount wheel and no final offer): the promotional price currently applies to all new subscribers, the discount wheel always lands on the highest discount in the 5–30% range and that discount is genuinely applied, and the final offer at exit is a real offer.
2.3.4. Refunds for payments on the website: within 14 days of the payment we refund on your request, without asking for reasons, provided you have not consumed a substantial part of the content. A purchase in the app for iOS/Android is refunded by the store under its rules (see the Refund Policy). After that period, refunds follow the applicable law. The refund goes back by the same method you paid with, no later than 14 days from the day we receive your request — usually faster. We say this openly: writing to support@aistep.app is faster and simpler than opening a chargeback dispute with your bank, and we would rather solve it with you directly.
3.1. Performance of the contract (Art. 6(1)(b) GDPR; the Law of Ukraine "On Personal Data Protection" and the Law of Ukraine "On Electronic Commerce") — creating and running your account, giving access to programs, courses and lessons, saving progress and streak, running the AI Mentor and AI tools, managing the subscription, processing payments and refunds, sending service messages about your access and billing. The same basis covers steps taken at your request before a contract is concluded: we process the quiz answers you give before registering in order to show you a plan and an offer.
3.2. Legitimate interest (Art. 6(1)(f) GDPR) — keeping the service secure, preventing fraud and abuse of trial access, checking that an in-app purchase belongs to your account and is not used by another one, investigating incidents, and improving the product using aggregated usage events. Where we rely on legitimate interest, you may object — see clause 9.
3.3. Consent (Art. 6(1)(a) GDPR) — the marketing newsletter, notifications (clause 5.9), messages from our Telegram bot if you linked it, and — if we connect them — the advertising and analytics partners that load only after you accept them in the consent banner (clause 5.6). For the marketing newsletter the consent is a separate tick-box that is not pre-ticked, and the newsletter starts only after you confirm your address with the button in our confirmation e-mail; we keep the proof of this (clause 2.1). Consent is voluntary, refusing it does not block your access to the paid product, and you may withdraw it at any time: for the newsletter — with the unsubscribe link in every marketing e-mail or a message to support@aistep.app; for the bot — by sending it "stop"; for the partners — with the «Cookie settings» link in the site footer. Withdrawal does not affect processing already carried out.
3.4. Legal obligation (Art. 6(1)(c) GDPR) — keeping payment and accounting records for the periods required by Ukrainian accounting and tax legislation, and replying to lawful requests from authorities.
4.1. We never receive or store your card number, expiry date or CVV. Card data is entered on the WayForPay side (website, customers in Ukraine), on the Paddle checkout (website, customers outside Ukraine) or on the App Store / Google Play side (purchase in the app for iOS/Android) and is processed by that payment provider. From WayForPay we receive and keep: the transaction number and status, amount, date, card type, the last 4 digits of the card number, the issuing bank's country, the decline reason (if any) and the recurring-payment ID. We need this for accounting, refunds, card disputes and fraud prevention, and keep it as long as accounting records (clause 6.2). We never receive the full card number, expiry date or CVV. For an in-app purchase we receive the store's purchase receipt. From Paddle we receive the transaction and subscription identifiers, the status, amount and currency, the country, the date of the next charge, the type of payment method and the last 4 digits of the card number.
4.2. We do not ask for and do not intentionally collect "special category" data — health, racial or ethnic origin, religious or political views, trade-union membership, sexual life, biometrics or genetic data. We have no product feature that needs them.
4.3. Please do not put into the AI chat: medical or diagnostic information, your banking or financial details, passwords, documents' numbers, or personal data of other people (clients, colleagues, family). The AI Mentor is a learning tool, not a secure vault, and text you send becomes part of a request to an external AI provider (see clause 5).
4.4. AI disclaimer — read this before relying on any AI answer. Answers of the AI Mentor and outputs of the AI tools are generated automatically. They can be inaccurate, outdated or entirely invented, including confident-sounding facts, figures, names and links. Always verify anything important before you act on it. The AI does not give medical, legal or financial advice, and it must not be treated as such. Do not rely on AI output when making decisions that affect other people.
4.5. Access to your device. The app does not access the camera, the microphone, files, contacts or your precise location, and does not read your photos. Lesson steps such as "tap the camera" or "share your screen" are simulations inside the lesson that show how the real tool works. The system permissions the app may ask for are: permission to show notifications — not at first launch, but after your first lesson and only if you choose to turn notifications on after our own explanation screen; and, if you choose, permission to add the certificate image to Photos (add-only — the app cannot read your photos), which iOS asks for when you yourself choose "save" in the share menu.
5.1. Below is the complete list of recipients. Each recipient processes data only for the purpose stated in the table and is bound to protect it at a level no lower than described in this Policy: processors — by their data processing terms with us (including the European Commission's Standard Contractual Clauses where data leaves the EEA); independent controllers (Apple, Google, Telegram, and advertising and analytics systems if they are connected — clause 5.6) and Paddle, which processes payment data as the seller of record for customers outside Ukraine — by their own privacy policies.
| Recipient | What it receives | Why | Where the processing happens |
|---|---|---|---|
| Supabase (Postgres, Auth, Edge Functions) | Accounts and password hashes, subscription status and payment history, learning progress and streak, leads, analytics events, complaints about AI answers (with the question and the answer), images created by the AI Mentor, technical logs (IP, browser) | Our database, authentication and server functions — the core storage of the service | Hosting in the EU (Frankfurt) |
| WayForPay — when you pay on the website as a customer in Ukraine | Card data you enter on their page (we do not see it), transaction amount, currency, plan and status | Payment processing, recurring charges, refunds, acquiring obligations | Ukraine |
| Paddle (Paddle.com Inc., Paddle.com (Canada) Ltd., Paddle.com Market Limited) — when you pay on the website as a customer outside Ukraine | Payment and card data you enter on the Paddle checkout (we do not see it), your e-mail, country and IP address (to show the price in your currency and calculate the taxes), the plan, amount and currency. From us — an internal identifier of your AI STEP account and the plan you chose. What we receive from Paddle — clause 4.1 | Merchant of Record for orders outside Ukraine: payment processing, invoices and receipts, taxes, recurring charges, refunds and customer service for such orders | United Kingdom, United States or Canada, depending on the Paddle entity — see clause 7. Paddle processes the payment data as a separate seller of record under its own Privacy Notice (paddle.com/legal/privacy) |
| Apple (App Store) and Google (Google Play) — when you buy in the app for iOS/Android | Payment and card data you enter on the store's side (we do not see it). From us — an internal identifier of your AI STEP account (a random code without your name or e-mail) so that the purchase is linked to your account. What we receive from the store — clause 5.8 | Processing in-app purchases, renewals, cancellations and refunds; our server verifies the purchase with the store to open and keep your access | Apple / Google infrastructure, may be outside the EEA — see clause 7. For the payment itself Apple and Google act as independent controllers under their own privacy policies |
| OpenAI (currently) and/or Anthropic | Only the text of the current conversation (your messages and the previous answers — at most the last 20 messages, as context) and the interface language; for an image — the text of the request. OpenAI also checks your last message with its moderation filter before the answer is generated. No name, no e-mail, no payment data, no device identifiers, no geolocation | To generate the AI Mentor's answer and the AI tools' output, and to block prohibited requests | May be outside the EEA — see clause 7 |
| Sentry (Functional Software, Inc.) — crash monitoring | Crash and error reports: type of error, stack trace, app version, operating system / browser version, a random installation identifier (the same one as in our analytics events). No IP address, no request headers or cookies, no e-mail: the sending of default personal data is switched off, and keys from links and e-mail addresses are cut out of the report text before it is sent | To learn about crashes and errors, group them and fix them. We do not send Sentry your name, e-mail or IP address | EU region (Frankfurt); the operating company is from the United States, so access from there is possible — see clause 7 |
| Resend — e-mail delivery | Your e-mail address, the subject and text of the e-mail, delivery events (delivered, opened, link clicked, bounced, marked as spam) | To send service e-mails (sign-up confirmation, password reset, access, payment, subscription) and — with your separate consent — the newsletter; to see whether an e-mail arrived | May be outside the EEA, including the United States — see clause 7 |
| Hetzner Online GmbH — website hosting | Technical data of requests to aistep.app (IP address, browser type, request time) — as part of the web server's operation and its logs; encrypted database backups | Hosting the website and the in-browser app, protection against abuse, keeping backups | Germany (EU) |
| GitHub (Microsoft) — second copy of the backup | An encrypted file with a backup of the database (kept for up to 30 days) | A second copy in case our main infrastructure fails | United States; may be outside the EEA — see clause 7 |
| Namecheap (Private Email) — support mailbox | E-mails you send to support@aistep.app (your address, subject, text and attachments) and our replies | To receive your messages and reply to them | United States; may be outside the EEA — see clause 7 |
| Telegram — only if you linked our bot yourself | Chat identifier and username, the bot's messages to you and your messages to the bot (we forward them to our support team in Telegram together with your name and e-mail so that we can reply) | Delivering the bot's messages and replying to yours | Telegram's infrastructure, may be outside the EEA — see clause 7. Telegram acts as an independent controller under its own privacy policy |
| Google CDN (CanvasKit) — website only | The technical data inherent to any browser request for a file — IP address, browser type | Delivering the CanvasKit rendering engine and fallback fonts so the web interface draws correctly | Google's global CDN |
| The push service of your browser (Google, Mozilla, Apple or Microsoft, depending on the browser) — website only, if you allowed notifications | The delivery address of your push subscription and the notification itself, encrypted so that the push service cannot read it | Delivering web notifications to your browser | Infrastructure of the browser vendor, may be outside the EEA — see clause 7 |
5.2. The main interface font is bundled locally with the application, and we do not connect the Google Fonts service. On the website, however, your browser loads the rendering engine files (CanvasKit) and, where needed, fallback fonts from Google's CDN; Google sees your IP address and browser type, as in any request (table above, clause 7). Our product analytics is our own and lives in our own database; third-party advertising and analytics networks are not connected at the moment — see clause 5.6.
5.3. We do not sell personal data to anyone, we do not rent it and we do not trade it for services.
5.4. We do not hand your AI conversations over for training AI models. We send a request to the AI provider to get you an answer, and that is the only purpose of that transfer.
5.5. We may disclose data where a law of Ukraine obliges us to do so — for example, a lawful request from a court or a state authority acting within its powers. We disclose only what is actually demanded.
5.6. Third-party advertising and analytics systems.
5.6.1. At the moment we do not connect third-party advertising or analytics systems to the website or the apps (such as the Meta pixel, Google Analytics, Google Ads or TikTok) and we send them none of your data.
5.6.2. If we decide to connect them, we will first update this Policy (section 13) and will connect them only after you press «Accept» in the consent banner: without your consent their code is not loaded and nothing is sent to them. We will not pass them your quiz answers, your AI Mentor conversations, your password or your payment details.
5.6.3. The consent banner already works: the «Accept» and «Decline» buttons are equal in size and weight, and your choice is remembered. You can change it at any time: the «Cookie settings» link in the site footer → «Decline».
5.7. The model provider: consent in the app, and where the chat works. In the iOS and Android app, before your first message to the AI Mentor, we separately ask for your explicit consent to send the text of your requests to the model provider — OpenAI and/or Anthropic (clause 5.1). The legal basis for the processing itself remains the performance of the contract (clause 3.1). The AI Mentor is not available in countries and regions where the model providers do not offer their service. To avoid opening the chat where the model providers do not operate, your device's time zone is sent to our server together with the request; we do not store it in your account and do not link it to you.
5.8. Purchases in the App Store and Google Play.
5.8.1. The payment is taken by Apple or Google. For the payment data (card, billing address, payment history in the store) they act as independent controllers under their own privacy policies; we never receive your card details.
5.8.2. To link the purchase to your AI STEP account, the app passes the store an internal identifier of your account — a random code that contains neither your name nor your e-mail.
5.8.3. Our server checks each purchase with the store through the App Store Server API (Apple) and the Google Play Developer API (Google), and receives server notifications from the stores (App Store Server Notifications; Google Play real-time developer notifications delivered through Google Cloud Pub/Sub) about renewals, cancellations, billing problems and refunds — so that your access is correct even when the app is closed.
5.8.4. From the store we receive and store: the purchase and transaction identifiers (the original transaction ID on the App Store, the purchase token and order number on Google Play), the product (plan), the dates of purchase, renewal and expiry, the auto-renewal status and the subscription status (trial, active, cancelled, grace period, expired, refunded), the environment (a real or a test purchase), and — for renewals and refunds — the price and currency as reported by the store. Google may also make available to us, in the Google Play Console and its reports, the order details and the country and postal code of the buyer; we use them only for accounting, taxes, refunds and disputes. Apple's sales reports do not identify you.
5.8.5. Legal bases: performance of the contract — to open and keep your access (Art. 6(1)(b) GDPR); legal obligation — accounting and tax records (Art. 6(1)(c)); legitimate interest — checking that a purchase belongs to your account and is not used by another one (Art. 6(1)(f)).
5.8.6. Retention — see clause 6.8. Deleting your AI STEP account does not cancel the store subscription (clause 10.4).
5.9. Notifications and reminders.
5.9.1. In the iOS and Android apps, lesson reminders are local notifications: the app schedules them on your device through the operating system. We do not receive a push token, and the reminder time is stored only on the device. The system permission to show notifications is requested only after our own explanation screen, and the app works fully without it.
5.9.2. Your choice of notification kinds (reminders, progress, offers) is stored on the device and on our server together with your account or the anonymous identifier of your device, so that we do not send you kinds you have turned off. Offers are off until you turn them on yourself.
5.9.3. On the website, if you allow notifications in your browser, we store the push subscription (the delivery address issued by your browser's push service and its encryption keys), your time zone, language and browser type, linked to your account or e-mail; notifications are delivered through the push service of your browser (clause 5.1).
5.9.4. You can turn notifications off at any time — in Profile → "Notifications" (without an active subscription — "Account" → "Notifications"), or in the settings of your device or browser.
6.1. Account, learning progress, streak and certificate badges — while your account exists. If you delete the account, we delete them (see clause 10).
6.2. Payment and accounting records — for the periods required by Ukrainian accounting and tax legislation (as a rule, at least 1,095 days from the filing of the tax report for which they were used — clause 44.3 of the Tax Code of Ukraine). We cannot delete these earlier even at your request, because keeping them is a legal duty; after the statutory period expires, they are deleted.
6.3. Leads (an e-mail, a name and the technical goal key and segment left without registration) — until you withdraw consent or unsubscribe, after which we remove the e-mail from the mailing base. A lead with no account and no activity is deleted automatically after 24 months. The proof of marketing consent (clause 2.1) is kept as long as your e-mail is in the mailing base.
6.4. AI request texts — your chat history is stored only on your device. On our server, the text of a request is processed to pass it to the model provider and is not stored. The exception is a complaint about an answer: the question and the answer are saved together with the complaint and deleted together with your account. On the AI provider's side, the retention period for a transmitted request is governed by that provider's own policy, not by ours.
6.5. Technical logs — kept for a short operational period on the side of Supabase and Hetzner (our hosting providers) and rotated automatically. The IP address we record in our database together with an event when you leave your e-mail in a form is kept for 7 days.
6.6. Usage events — kept in our database while they remain useful for product decisions; they are tied to your account and are removed or de-identified when the account is deleted.
6.7. Crash and error reports — kept on Sentry's side for a limited retention period set in the project (90 days by default) and then deleted automatically. They contain no name, e-mail or IP address, so there is nothing to delete separately when you delete your account.
6.8. Data about purchases in the App Store and Google Play — the subscription record (identifiers, plan, dates, status) is kept while your account exists and is deleted with it; the records of renewals and refunds are kept as accounting records (clause 6.2), and after the account is deleted they are no longer linked to you.
6.9. Notification data — your notification choices are kept while your account (or your e-mail in our mailing base) exists; a browser push subscription is switched off when you turn notifications off or when your browser's push service reports that it is no longer valid, and is deleted together with the account it is linked to.
6.10. Credits ✦ — the balance and the ledger of credits are kept while your account exists and are deleted with it.
6.11. Purchase log (credit packs, courses, certificates: what was bought, the transaction identifier, amount, date, status) — these are accounting records, and their period is set by accounting and tax legislation (clause 6.2); after the account is deleted the record remains without any link to you.
6.12. Record of your consent at payment on the website — 3 years after the last charge (for an order that was never paid, 3 years from the date of the record). When you delete your account, the link between the record and the account is removed, but the IP address, the browser type and the order number (which contains the internal identifier of the account) stay until the end of this period: the record is pseudonymised, not anonymised.
6.13. Backups — once a week we make an encrypted backup of the database; copies are kept on our server (Hetzner) and as a service file in GitHub for up to 30 days. After you delete your account, your data disappears from the backups as they are replaced, within about 30 days.
7.1. Our database and server functions are hosted in the EU (Frankfurt) by Supabase. The website is hosted on a Hetzner server in Germany (EU).
7.2. AI providers (OpenAI, Anthropic) may process the transmitted request text outside the EEA, including in the United States. For such transfers we rely on the legal mechanisms available under the GDPR and Ukrainian law — an adequacy decision where one covers the recipient, or the European Commission's Standard Contractual Clauses (SCC) in the provider's data processing terms.
7.3. Regardless of the mechanism, we apply minimisation: only the text of the current conversation and the interface language go to the AI provider (clause 5.1), and everything travels over an encrypted TLS connection.
7.4. Sentry (crash reports), Resend (e-mail delivery), GitHub (the encrypted backup), Namecheap (the support mailbox), the push service of your browser (web notifications, if you allowed them) when you pay on the website as a customer outside Ukraine — Paddle, and — when you buy in the app for iOS/Android — Apple and Google may also process data outside the EEA, including in the United States, on the grounds described in clause 7.2: the Standard Contractual Clauses (SCC) in the provider's terms and/or the adequacy decision under the EU-U.S. Data Privacy Framework where the provider is certified under it. A crash report contains no IP address, no e-mail and no other direct identifiers (clause 5.1). Telegram receives data only after you link the bot yourself and processes it as an independent controller under its own privacy policy, possibly also outside the EEA. If you do not want this transfer, do not link the bot, or send it "stop".
8.1. Row Level Security (RLS) is enabled in our database: the rules are written so that a user's requests reach only that user's own rows — your progress and your subscription.
8.2. Private keys and API keys live only on the server (Supabase Edge Functions) and are never shipped to the browser or embedded in the client application.
8.3. Encryption in transit — all traffic between your browser, our service and our processors runs over TLS.
8.4. Passwords are stored only as hashes, handled by Supabase Auth. Nobody on our side can read your password.
8.5. Access is limited — administrative access to production data is granted only to the people who need it for support, billing and operations, and only to the extent needed.
8.6. Honestly: absolute security does not exist. No service can promise that data will never be compromised. What we can promise is minimisation, the measures above, and that if a breach occurs that is likely to affect your rights, we will notify you and the competent supervisory authority as the law requires.
9.1. You have the right to:
9.1.1. know and access — get confirmation of what data about you we process and receive a copy;
9.1.2. rectify — correct inaccurate or incomplete data (name, e-mail, quiz answers);
9.1.3. erase — have your data deleted, except what we must keep by law (clause 6.2);
9.1.4. restrict processing — for example while a dispute over accuracy is being resolved;
9.1.5. data portability — receive the data you gave us in a structured, machine-readable format;
9.1.6. object — to processing based on our legitimate interest, and at any time to marketing;
9.1.7. withdraw consent — for the newsletter, notifications, the Telegram bot and the advertising and analytics partners, at any time and without explanation;
9.1.8. not be subject to a decision made solely automatically with legal effect for you — we make no such decisions.
9.2. How to use them: write to support@aistep.app from the e-mail address of your account (this is how we verify it is you) and describe what you want. Nothing more formal is needed.
9.3. How fast we answer: within 30 days as required by Ukrainian law. For requests under the GDPR — within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you about the extension and the reason within the first month.
9.4. Complaints. Write to support@aistep.app with the subject "Data complaint": we will confirm receipt within 30 days (usually within 3 business days) and tell you the outcome. You may also, at any time and without contacting us first, complain to a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EEA — the data protection authority of your country; in the UK — the Information Commissioner's Office (ICO), ico.org.uk.
10.1. You can delete your account in three ways: yourself in the app (Profile → "Delete account"; without an active subscription — the "Account" button (person icon) at the top of the payment screen → "Delete account"), on the page aistep.app/delete-account, or by sending a request from your account e-mail to support@aistep.app. We do not require a reason.
10.2. What is deleted: the account and login data (including the password hash), your name, learning progress, streak and internal certificate badges, quiz answers, your complaints about AI answers together with the question and the answer, images created for you by the AI Mentor, the Telegram bot link (chat identifier and username), your notification settings and the browser push subscriptions linked to your account, your subscription record (including the identifiers of a purchase in the App Store or Google Play), your credit balance and ledger ✦, your right to purchased courses and certificates, your data in the "Invite a friend" programme, and the link between usage events and you. Your chat history is stored only on your device: it is not on our server, and it is erased from the device when you log out.
10.3. What remains: payment and accounting records (date, amount, plan, transaction status; for purchases in the App Store and Google Play — the records of renewals and refunds) — we are obliged to keep them for the statutory accounting and tax periods, without the link to you, and they are deleted once those periods expire. The records of one-off purchases (what was bought, transaction identifier, amount, date, status) also remain, without any link to your account. The record of your consent at payment on the website (clause 2.1) loses its link to the account when you delete it, but is kept until the end of the period in clause 6.12 (pseudonymised). Backups that still contain your data are replaced automatically within about 30 days (clause 6.13). Data already transmitted to an AI provider as a request is retained on that provider's side under its own policy.
10.4. An active subscription. A subscription bought on the website is stopped by us when you delete your account: no further charges are taken. A subscription bought in the app for iOS/Android we cannot stop — cancel it in the subscription settings of your Apple ID or Google account, otherwise the store will keep charging you. Deleting the account does not by itself refund a payment; for refunds see clause 2.3.4.
11.1. What the service keeps in your browser is what it needs to work. Third-party advertising and analytics cookies are separate and load only after your consent (clause 5.6): until you press «Accept», they are not set.
11.2. Stored locally in your browser (localStorage / similar) and on our side as part of your account:
11.2.1. quiz answers — so the funnel and the learning path survive a page reload;
11.2.2. learning progress — so a lesson opens where you left it;
11.2.3. interface language — so you are not asked again on every visit;
11.2.4. the display status of offers — so a promo, the discount wheel or the final offer is not shown to you over and over;
11.2.5. the authentication session — technically necessary, managed by Supabase Auth; without it you would be logged out on every page load; 11.2.6. your answer to the consent banner — so we do not ask again on every visit and a refusal is remembered;
11.2.7. your chat history with the AI Mentor — kept only on your device (in the browser or the app) so you can see earlier conversations; it is not on our server and is erased when you log out;
11.2.8. in the iOS and Android apps — the date and time you agreed to send messages to the model provider (clause 5.7), your notification choices and the reminder time (clause 5.9).
11.3. How to clear it: use your browser settings (clearing site data / cookies and local storage for our domain), or your browser's private mode. Clearing will log you out and may reset locally stored quiz answers and offer states; your progress and subscription stay safe in your account.
11.4. Loading the CanvasKit rendering engine from Google's CDN involves a normal HTTP request from your browser to Google, which inherently reveals your IP address and browser type to that CDN. It is required to draw the interface.
12.1. AI STEP is intended for persons aged 18 and over. We do not knowingly collect data of minors and we do not direct the service at them.
12.2. If you believe a person under 18 has created an account, write to support@aistep.app — we will check and delete the account and the associated data (except records the law requires us to keep); for payments on the website we refund the money (Terms, clause 4.3).
12.3. The age rating of the app in the App Store and Google Play describes its content; it does not change the age requirement of this clause: the service may be used from the age of 18.
13.1. This Policy may change as the product changes — for example if we add or replace a processor. The current version is always the one published in the service, with the version date at the top.
13.2. About material changes — new categories of data, a new recipient, a new purpose — we will notify you in advance by e-mail and/or with a notice inside the service, so you can read them and decide.
13.3. Purely editorial edits (wording, typos, clearer structure) take effect on publication with an updated version date.
14.1. E-mail: support@aistep.app — access, correction, deletion, portability, objection, withdrawal of consent, refund questions, security reports. This is the primary and fastest channel.
14.2. Phone: +380 75 245 00 87 — the controller's contact number (clause 14.3). For payments, refunds and personal data, the main and fastest channel is the e-mail above: that way both of us keep a written record.
14.3. Controller: individual entrepreneur (FOP) Riasna Sofiia Volodymyrivna, taxpayer ID (RNOKPP) 3872001402, 08205, Ukraine, Kyiv region, Bucha district, Irpin, Kobylianskoi Olhy St., building 1v/9, apartment 16, phone +380 75 245 00 87.
14.4. Version date of this Policy: 26 October 2026.
14.5. Single point of contact for users and for authorities, including for the purposes of the EU Digital Services Act where it applies to us: support@aistep.app. We accept messages in Ukrainian and English, and we also answer in Russian.