Last updated 3 November 2026
This is what StepBerry collects, why, who else touches it, where it is kept and for how long. It covers the hosted service at stepberry.app. The local version sends nothing to us at all.
StepBerry is a brand of KOOTOOBOO LTD. CO., a United States business, which runs it. Reach us at hello@stepberry.app. For a workspace’s content and the people in it, the business that owns the workspace is in charge (the controller) and we work for it (the processor), under the terms of service. For what we collect for ourselves — workspace requests, the owner’s account, billing and diagnostics — we are the controller.
Accounts. A name, an email address and a password, which is stored as a one-way hash and is never readable. Staff who join by link give a name only; an email is optional. We record when each person was last active, which is how plan limits are counted, and the browser used to sign in, so you can see your own sessions.
Workspace content. Procedures, answers, uploaded images and video, signatures (with the name and the time), and the ticks on phone checklists. This is the business’s content: the workspace owner decides what goes in and who sees it.
Voice and recordings. When you dictate or upload a recording, the audio is sent for transcription and the text comes back. We do not keep the audio, and nothing is made from it that could identify you by your voice. Read-aloud turns a procedure’s text into speech, and that audio is cached so the same text is not synthesised twice.
Billing. Stripe handles payment and keeps your card details. We keep only Stripe’s identifiers for your customer and subscription, your plan, and whether a payment has failed.
Workspace requests. The business name, email address, chosen address and note from the signup form.
Activity log. Every change anyone makes in a workspace is recorded: who made it, what they changed, and when. The owner and admins can read it under Settings → Activity. It exists so a business can see who changed a procedure its staff rely on. Reading, searching and ticking a checklist are not changes and are not recorded there.
Diagnostics. When something breaks — a server error, a failed email, a script error in the browser — we record what failed, where in the app, and a technical description. These records exist to fix things and are used for nothing else.
Nothing else. There is no analytics script, no advertising tracker and no pixel, and no third party collects anything about you across sites through ours. The only cookie is the one that keeps you signed in, which the service cannot work without. Display preferences such as text size stay in your own browser. Because we do not track, a “Do Not Track” or Global Privacy Control signal from your browser changes nothing: there is nothing to opt out of.
To run the service: show the right content to the right people, send invitations, password resets and signup replies, draft and search procedures with AI, read procedures aloud, bill paid plans, and find and fix failures. We do not use it to profile you or to advertise, and we send no marketing email.
Where the law asks us to name a legal basis: running the service for you is performance of a contract; keeping it secure, fixing failures and preventing abuse is our legitimate interest; keeping billing records is a legal obligation. We do not rely on consent for anything, so there is nothing to withdraw.
On a paid plan, drafting, searching, transcription and read-aloud use AI models run on Cloudflare’s infrastructure. Your text and audio go to those models to be processed and come back as results. Cloudflare does not keep inputs or outputs once the request is answered, and neither we nor Cloudflare use your content to train models.
If you added your own provider’s API key — which is how the free plan works — then the text you type, and any recording you upload, is sent to the provider you chose, on your own account with them, and that provider’s terms and privacy policy govern what it does with it: how long it keeps it, where it processes it, and whether it trains on it. We choose none of that for you and we have no control over it. Change provider, or remove the key, at any time in Settings → AI model.
That key is stored encrypted, and the encryption key is held separately from the database. It is never displayed again after you save it — Settings shows only its last four characters — it is never written to the activity log, and it is sent to nobody but the provider address you entered. If you connect your own AI client through the MCP tools instead, that client’s provider’s terms apply in the same way.
Cloudflare hosts the service, stores the databases and files, runs the AI models, sends our email and receives email to our addresses. It acts on our instructions under its data processing addendum, which includes the EU standard contractual clauses and the UK addendum; its own sub-processors are listed at cloudflare.com/gdpr/subprocessors.
Stripe processes payments. When it does so for us it follows our instructions; Stripe also uses payment information for its own fraud prevention and legal compliance, as its own privacy policy at stripe.com/privacy describes.
We do not sell personal information, we do not share it for advertising, and we do not give it to anyone else unless the law requires it or you ask us to. If StepBerry is ever taken over by another company, your information goes with the service, under this policy, and we will tell workspace owners.
Your workspace’s database and files are stored in Cloudflare’s western North America region. Requests and AI processing run in Cloudflare’s data centres, which may be elsewhere. If you are in the European Union or the United Kingdom, your information is transferred to the United States; Cloudflare’s and Stripe’s data processing terms include the standard contractual clauses, and we will sign them with your business on request.
The business that runs the workspace is responsible for its content and for the people it lets in. Your name, when you were last active, the checklists you tick, anything you sign and any change you make to a procedure or answer are visible to the people who run that workspace. Questions about that information go to them first; they can ask us to correct or delete it, and we help them do so.
A procedure’s checklists can be sent to a phone as a link. Anyone with the link can open that page, and the ticks made there are recorded against it. Deleting the link, or the procedure, ends it.
Workspace content and staff records: as long as the workspace exists. The activity log is kept for as long as the workspace exists, and a person’s entries stay in it after their account is removed, because a log that erases itself answers nothing. Deleting a procedure deletes its uploaded files and the ticks made on its share links. Password-reset links live for an hour. Sign-in sessions last 30 days, or a year for staff who joined by link, unless you sign out. Workspace requests: until the workspace is created or the request is declined. Diagnostic records: until the failure is fixed and the record is no longer needed to spot a recurrence. Billing identifiers: as long as tax and accounting law requires. When a workspace is closed we delete its database and files on request.
Everything travels over HTTPS. Passwords and access tokens are stored hashed. An AI provider’s key that you add is encrypted before it is stored, with a key that is not in the database and that differs per workspace. Each workspace has its own database and file store, separate from every other customer’s. We do not look at the content of a workspace except to fix a problem you have reported or when the law requires. If a security breach affects you, we will tell the workspace owner without undue delay, and the authorities where the law requires it.
You can see and change your own name and email in Settings. Answers can be exported as a file from the Canned answers page. Wherever you are, you can ask us to tell you what we hold about you, correct it, give you a copy, or delete it, by writing to the address below from the email on your account. We answer within a month. We do not treat anyone differently for asking.
If you are in the EU or the UK you also have the right to object to or restrict processing, to take your data with you, and to complain to your data protection authority. If you are in California, you have the right to know, correct and delete, and to opt out of sale or sharing; we do not sell or share personal information, so there is no opt-out to make. Other states and countries give similar rights, and we honour them. Staff should ask the business that runs their workspace first; we help it respond.
StepBerry is for businesses and the people who work there. It is not for children under 13, and we do not knowingly collect their information. If you think a child has an account, tell us and we will remove it.
We will update this page when what we do changes, with the date at the top, and email workspace owners about anything significant before it takes effect.