Skip to content
Stepclimbby BufferSol
Inspect a repo free

Privacy policy

How Stepclimb collects, uses and protects personal data, and the rights you have over it.

Last updated

Who we are

Stepclimb is operated by BufferSol Technologies LLC, 447 W Broadway, 2nd Floor Suite #1964, New York, NY 10013, United States. This policy explains what personal data we handle when you visit stepclimb.buffersoltech.com, create an account or use the service.

For account and billing data we are the controller. For the contents of repositories you ask us to upgrade, you are the controller and we are your processor. The data processing addendum covers that second case.

Data we collect

We collect only what we need to run the service.

  • Account data: your email address, name if you give one, and your GitHub account identifier and username, and two factor settings if you turn them on.
  • Organization data: workspace name, members, roles, API keys (stored hashed) and the settings you configure.
  • Billing data: your plan and subscription status. Card details go straight to Stripe and never touch our servers.
  • Repository data: a free inspection reads composer.json, composer.lock and package.json only. An upgrade run clones the repository into an isolated sandbox that is destroyed when the run ends. We do not retain customer code. Run logs are kept for 30 days with secrets redacted.
  • Technical data: IP address, browser type and request logs, kept briefly for security, abuse prevention and debugging.

We do not sell personal data and we do not use repository content for advertising or to train models. Nothing from your repositories is sent to an AI service.

How we use it and our legal bases

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR.

  • Contract: to create your account, run the upgrades you ask for and bill you.
  • Legitimate interests: to secure the service, prevent abuse and spam, and keep records that let us fix problems.
  • Legal obligation: to keep tax and accounting records.
  • Consent: for optional communications, which you can withdraw at any time.

Who we share data with

We share data only with the subprocessors listed on our subprocessors page, and only to provide the service. We may also disclose data if a valid legal request requires it, and we will tell you first unless the law forbids it.

Retention

  • Account and organization data is kept while your account is open.
  • Customer code is not kept after a run. Run logs are deleted after 30 days.
  • After you delete your account we remove your data within 30 days, except billing records we must keep by law, which are kept for the period the law requires.
  • Server logs are kept for up to 30 days.
  • Backups roll off within 35 days after deletion.

Account deletion and data export

You can export or delete your data yourself. In the app, open Settings, then Account. You can also use the API: GET /api/account/export returns a copy of your data, and DELETE /api/account permanently deletes your account and workspace.

Your rights under GDPR and UK GDPR

You can ask us to access, correct, delete, restrict or port your personal data, and you can object to processing based on legitimate interests. Most of these you can do from Settings. For anything else, email us. You also have the right to complain to your data protection authority.

California rights under CCPA and CPRA

If you live in California you can ask what personal information we hold, ask us to delete or correct it, and ask us to stop selling or sharing it. We do not sell or share personal information for cross context advertising. We will not discriminate against you for using these rights.

International transfers

Our subprocessors are mainly in the United States. When we transfer personal data from the EEA, UK or Switzerland, we rely on the EU Standard Contractual Clauses and the UK addendum, and on the EU US Data Privacy Framework where a provider is certified.

Security

We encrypt data in transit and at rest and limit access to people who need it. See the security page for details. No system is perfectly secure, and we will notify you of a breach that affects you as the law requires.

Children

Stepclimb is not directed at children under 16 and we do not knowingly collect their data.

Changes to this policy

If we make a material change we will email account owners at least 14 days before it takes effect.

Contact

Questions or requests: contact@buffersoltech.com. For general help, write to contact@buffersoltech.com.