Skip to content

Privacy

What this site does with your data, which companies handle it for us, and how to ask us about it.

Last updated

Who is responsible

This site is run by Step Function, a consultancy for beauty and wellness CPG. The controller of the personal data described here is [legal entity name], [registered address].

For any question about this notice or about your data, write to [data protection contact] at support@stpfn.com.

[State here whether a data protection officer, an EU representative or a UK representative has been appointed. None is named in this draft.]

The short version

This notice covers this website only. Work we do for a client is covered by that engagement’s own terms.

  • The site has no accounts, no contact form and no advertising or cross-site tracking code.
  • The site sets no cookies of its own. The Cal.com booking calendar sets its own, and it loads only when you ask for it.
  • Analytics, when switched on, stores nothing on your device, builds no profile of you and sends nothing if your browser has Do Not Track switched on.
  • The two tools run in your browser. What you type leaves it only if you ask for the result by email.
  • Four companies process data for us: Vercel, PostHog, Cal.com and Resend. Each is described below.

When you visit

Hosting by Vercel

The site is hosted by Vercel. Every request your browser makes for a page, an image or a font goes to Vercel’s servers.

What is processed
Your IP address, your browser’s user agent, the address requested and the time of the request, as with any web server.
Why
To deliver the site to you and to keep it available and secure.
How long
Our code keeps none of it. Vercel’s request logs follow the retention of the plan the site is on. [Owner: state the Vercel plan and its log retention.]

Fonts

The typefaces are served from this site with the rest of the page. Your browser makes no request to Google or to any other font host.

The motion setting

If you press “Pause motion”, your browser stores that choice in its local storage, under the name sf-tier, so the site stays still on your next visit. It holds one word, is never sent to us, and is removed when you resume motion.

If you press “Light page” or “Dark page”, your browser stores that choice in its local storage, under the name sf-theme, so the pages open the same way on your next visit. It holds one word, light or dark, and is never sent to us. Nothing else is stored on your device by this site.

Analytics

We use PostHog to count visits and to see which parts of the site are read. It runs only when the site has been configured with a PostHog key. It sends nothing if your browser has Do Not Track switched on.

PostHog

What is processed
A fixed list of events: a page view, the audience you select, the sections you reach, how far you scroll, a click on a booking link, whether the booking calendar opened and whether a booking was made, that a tool was started and finished (with a short summary such as “3 findings”, never the text you typed), whether a result email was sent, and the graphics tier your device was given. With each event PostHog receives the page’s address and title, the referring address, your browser’s user agent (which names the browser, operating system and device type), your screen size, your time zone and language setting, and your IP address as the sender of the request.
What identifies you
A random identifier created in the page’s memory. It is not written to a cookie or to your browser’s storage, and it is discarded when you reload or close the page, so one visit cannot be linked to the next. PostHog is set never to create a person profile.
What is switched off
Session recording, heatmaps, automatic capture of clicks and form input, surveys, feature flags, and the loading of any script from PostHog.
Why
To learn which pages and sections are read, so we can improve the site. [Counsel: confirm the legal basis; this draft assumes legitimate interests, and that no consent is needed because nothing is stored on or read from the device.]
Where
PostHog’s cloud in the United States (us.i.posthog.com), unless the site is configured with another PostHog host. [Owner: confirm the region.]
How long
Follows the data retention set in our PostHog project. [Owner: state the retention period, and whether the project discards IP addresses.]

Booking a call

Bookings are taken by Cal.com. Nothing from Cal.com loads when you open a page. The contact page shows a plain link to our Cal.com booking page, and the calendar itself loads only after you press “Choose a time” or a booking link on that page.

If no calendar has been configured, the page offers an email link instead, and nothing is sent until you send that email from your own mail program.

Cal.com

What is processed
Once you ask for it, the calendar runs in a frame served by Cal.com, which receives your IP address and browser details and sets its own cookies inside that frame. When you book, Cal.com receives what you enter: your name, your email address, the time you choose and any notes. If you came from one of our audience pages, the booking also records which one (founders, investors or strategics).
Why
To arrange the call you asked for and to send both of us the invitation.
How long
Follows the settings of our Cal.com account. [Owner: state the retention, and name the calendar and video providers connected to the Cal.com account, which also receive the booking.]

The two tools

The EU deadline checker compares the ingredient list you paste with a register that is part of the page. The retail readiness diagnostic scores the answers you give. Both do this in your browser: what you enter is not sent to us or to anyone else.

If analytics is on, it records that a tool was started and finished, with a summary such as “3 findings”. It does not record what you typed.

If you ask for a result by email

This is the one case in which what you typed leaves your browser. Your email address and your input (the ingredient list, or your answers) are sent to our server, hosted by Vercel. The server works the result out again from that input, writes the email and passes it to Resend, which delivers it.

What is processed
Resend receives your email address and the email itself, which contains the result. A reply to it goes to our inbox. Our own inbox receives a blind copy of the email, when one has been configured.
Why
To send you the result you asked for. We receive the copy so that we know what was asked and can answer if you reply. [Owner: state whether you contact people who request a result. Counsel: confirm the legal basis for that.]
What our server keeps
No database and no file. To limit abuse, the server counts requests by IP address in its working memory: at most ten in ten minutes. That count is never written to storage and is lost when the server instance stops. If Resend refuses a message, the server writes Resend’s error to its log, which Vercel holds under its own retention.
How long
Resend keeps a record of sent email under the retention of our Resend plan. The copy in our inbox is kept with our correspondence. [Owner: state both periods.]

If you email us

We receive whatever you send, and we keep it with our correspondence for as long as we need it to answer you or to work with you. [Owner: name the mail provider and state the retention period.]

Who receives your data

The four companies named above, each acting on our instructions: Vercel (hosting and the server that sends result emails), PostHog (analytics), Cal.com (booking) and Resend (email delivery). [Owner: confirm a data processing agreement is in place with each, and add the mail and calendar providers.]

We do not sell personal data, and we do not share it for advertising.

These companies are based in, or may process data in, the United States. [Counsel: state the transfer mechanism relied on for each, for example the EU–US Data Privacy Framework and its UK extension, or standard contractual clauses.]

Your rights

To use any right below, write to support@stpfn.com. We answer within one month. We may need to ask who you are before we act on a request.

In the United Kingdom and the European Union

Under the UK GDPR and the EU GDPR you may ask us for a copy of the personal data we hold about you; ask us to correct it or delete it; ask us to restrict how we use it; object to our use of it where we rely on legitimate interests, which includes analytics; ask for the data you gave us in a portable form; and withdraw any consent you have given.

You may also complain to a regulator: in the UK, the Information Commissioner’s Office (https://ico.org.uk); in the EU, the data protection authority of the country where you live or work.

In California

California law gives residents the right to know what personal information a business collects and why, to have it deleted or corrected, and not to be treated differently for asking. This notice lists what the site collects. We do not sell personal information or share it for cross-context behavioural advertising. [Counsel: confirm whether the CCPA applies to the firm at all.]

The site honours a Do Not Track signal by leaving analytics off. It does not read the Global Privacy Control signal, because there is no sale or sharing for it to switch off. [Counsel: confirm this is sufficient.]

Security

The site keeps no database of visitor data. Its pages are served with a content security policy that lets your browser connect only to the site itself and to the providers named in this notice. The key that lets the site send email through Resend is held on the server and is never sent to your browser.

Children

The site is written for businesses. It is not directed at children, and we do not knowingly collect their data.

Changes to this notice

When this notice changes, the date at the top changes with it. If the site starts to process data in a new way, this notice is updated before that change goes live.