Privacy Policy
In short
- STEVE keeps your account details, the brain documents loaded into your account, and a log of which STEVE tools were used and when.
- The STEVE connection doesn’t receive your messages to ChatGPT or Claude, their answers, your chat history or your AI’s memory.
- STEVE’s server and database are in Amsterdam, the Netherlands. Sign-in runs on WorkOS in the United States, and some logs, support emails and interview information may be processed in other countries (section 7).
- We don’t sell personal data, and we don’t use your brain documents or support emails to train AI models.
- You can disconnect STEVE at any time, and ask us for a copy, a correction or deletion by emailing support@usesteve.com. We reply within 30 days.
1. Who we are, and our role
STEVE is operated by Shimi Dvir, an individual business operator based in Tel Aviv, Israel (“we”, “us”).
For anything about your personal data, write to support@usesteve.com.
We are the controller (under Israeli law, the database controller) of the personal data we handle for our own purposes: account administration, the website, the usage log, access requests and support correspondence.
Brain documents may contain personal data about people a business works with, such as its staff, customers or suppliers. We hold and process that data on behalf of the business that supplied it, only to provide STEVE to that business and on its instructions. For that data, the business is the controller, and we act as its processor (under Israeli law, a holder). If your request concerns personal data in another business’s brain, we’ll pass it to that business and help it respond as the law requires.
STEVE is currently offered to businesses outside the European Union, so we have not appointed a representative in the EU.
2. What this policy covers
This policy explains how we handle personal data when you visit the STEVE website at usesteve.com, request access, use your STEVE account, connect STEVE to ChatGPT or Claude, or write to us.
By invitation, our team builds your brain with you through a guided interview. This policy also covers the information we collect in that interview.
The STEVE connection lets your ChatGPT or Claude read the brain loaded into your STEVE account, and STEVE’s support guides. The connection is read-only: it doesn’t change your brain, and it doesn’t connect to your Google Drive or Notion.
Accounts are for adults (18+); STEVE’s content is suitable for a general audience. We don’t knowingly open accounts for anyone under 18. If you believe we have, contact us and we’ll close the account.
3. The data we handle
| Data | Why we use it | Who processes it, and where | How long we keep it |
|---|---|---|---|
| Account and sign-in data: your name, email address and business name, your account and WorkOS user identifiers, and the link between your account and your business | To open and run your account, let you sign in, and support you | WorkOS, our sign-in provider, in the United States; and STEVE’s server, hosted by Railway in Amsterdam | While your account is active. Deleted within 30 days after your account is closed or you ask us to delete it. |
| Your password | To let you sign in | WorkOS only, stored in hashed form. STEVE never sees it. | Until your account is deleted at WorkOS, within 30 days after it is closed |
| Sign-in tokens: the access your AI receives after you sign in | To check that each request comes from your account, before STEVE answers it | Issued by WorkOS; kept by your AI platform to stay connected; checked by STEVE’s server | Checked on each request. STEVE doesn’t store them or record them in its usage log. |
| Brain documents loaded into your account: document text, document names, version information and earlier versions. They may include personal data about people your business works with, held for your business (section 1). | To serve them to your own ChatGPT or Claude when you ask, and to look into a problem if you write to us | STEVE’s server, hosted by Railway in Amsterdam. When your AI requests a document, OpenAI (ChatGPT) or Anthropic (Claude) receives its text inside your account. | While your account is active, including earlier versions. Deleted within 30 days after your account is closed or you ask us to delete them. |
| Interview information: what you tell us in the guided interview, and our notes and drafts | To build your brain with you | Our team runs the interview with you in the STEVE Builder. What you say and type in the interview (if you speak, your audio is turned into text) is processed by our AI providers, Anthropic, OpenAI and ElevenLabs, to run the interview and write your brain (OpenAI or ElevenLabs turns your audio into text, and ElevenLabs reads the interview’s questions and replies aloud). It is stored on systems operated by STEVE’s team. | Up to 90 days after the interview ends, then deleted. Deleted sooner, within 30 days, if you close your account or ask us to delete it. |
| Usage log: which STEVE tool was used, which document or support guide, when, the result, and the account | To operate, secure and improve STEVE | STEVE’s server, hosted by Railway in Amsterdam | 12 months from each entry. Then we delete the entries. We may keep only overall statistics that can’t identify a person or business. |
| Hosting technical logs, which may include IP addresses | Security and operations | Railway, our hosting provider, in Amsterdam; it may also process hosting logs in the United States | Up to 90 days |
| Access requests and support emails: your contact details, what you write, and any attachments, excerpts or screenshots you choose to send | To answer your request and help you | Our support email provider, Microsoft (Microsoft 365), in the data centres Microsoft uses for our account. Cloudflare forwards emails sent to support@usesteve.com to that mailbox. | Up to 24 months from receipt, including access requests that don’t lead to an account |
We get this data from you; from the person at your business who arranges your account or supplies your brain documents; from WorkOS when you sign in; and from your use of STEVE.
Brain documents describe your business. Include only what your AI needs to work for your business, and see section 4 for what not to include.
4. What STEVE doesn’t receive, and what not to send
- Your conversations. The STEVE connection doesn’t receive your messages to ChatGPT or Claude, their answers, your chat history or your AI’s memory. It receives only the requests your AI sends to STEVE, each with a sign-in token: which tool, and which document or support guide.
- Your AI’s memory. When a STEVE guide uses what your AI remembers, that happens inside your conversation. It isn’t sent to STEVE.
- Your Google Drive or Notion. STEVE doesn’t connect to them and doesn’t see the edits you make there.
- What you email us. If you send us a chat excerpt or screenshot, we receive what you choose to include, and handle it as support correspondence (section 3).
Our usage log doesn’t record the text of your documents, sign-in tokens or IP addresses.
STEVE isn’t designed to receive payment card details, health information, government identification numbers, passwords or other sign-in secrets, salary or performance-review information about staff, or information about children, whether in brain documents, in requests to STEVE or in support emails. Please don’t include them. Enter your STEVE password only on the WorkOS sign-in page. If you think such information was sent to us by mistake, contact us, and we’ll assess it and remove it where appropriate.
5. Why we use data, and our legal bases
We use personal data only for the purposes below. Where the EU General Data Protection Regulation (GDPR) applies, the third column shows the legal basis we rely on.
| Purpose | Data used | Legal basis where GDPR applies |
|---|---|---|
| Provide STEVE: open and run your account, let you sign in, check each request, and serve your brain and STEVE’s guides to your AI when you ask | Account and sign-in data, sign-in tokens, brain documents | If you are our customer yourself: performing our contract with you, or taking steps you ask for before it. If your business is our customer: our legitimate interest in providing STEVE to your business and managing who can use its account. |
| Build your brain with you in the guided interview | Interview information | The same as the row above: performing our contract with you, or our legitimate interest in providing STEVE to your business. |
| Answer access requests and support emails, and look into problems you report | Access requests and support emails, account data, and brain documents when needed to look into a problem | Performing our contract with you, where it applies. Otherwise, our legitimate interest in answering you and fixing problems. |
| Keep STEVE secure and working: prevent misuse, and find and fix faults | Usage log, hosting technical logs, account data | Our legitimate interest in protecting STEVE, its users and their information. |
| Improve STEVE | Usage log, and after 12 months only overall statistics, if we keep any. Not the content of brain documents. | Our legitimate interest in understanding how reliable STEVE is and which features are used. |
| Meet legal duties | Only the data that a specific legal duty or binding order covers | Complying with a legal obligation. |
Personal data in brain documents that we hold for a business is used only to provide STEVE to that business, on its instructions (section 1). The business decides the purposes and legal basis for that data.
You are not legally required to give us any personal data. The account and sign-in details we ask for when we open your account are needed to give you access: without them, we can’t open or run your account. You choose which business information goes into your brain, and STEVE can serve only documents that have been supplied to it.
We don’t sell personal data or share it for advertising. We don’t use brain documents or support emails to train AI models. We don’t make decisions about you based only on automated processing.
6. Who receives data, and why
- Railway, our hosting provider, runs STEVE’s server and database and keeps the hosting technical logs, to host STEVE.
- WorkOS, our sign-in provider, runs the sign-in page, stores your password in hashed form, and issues the sign-in tokens that let your AI use STEVE.
- Microsoft (Microsoft 365), our support email provider, runs the support mailbox, to receive and store our emails with you. Cloudflare forwards emails sent to support@usesteve.com to that mailbox.
- Our AI providers for the interview, Anthropic, OpenAI and ElevenLabs, process what you say and type in the guided interview, to run the interview and write your brain.
- The AI platform you choose to connect, OpenAI (ChatGPT) or Anthropic (Claude). When your AI uses STEVE, STEVE sends back information about your brain (such as its status, version and list of documents and guides), the text of the document requested, or a support guide. The platform receives it inside your own account, and handles it under the terms, plan and data settings of your account there, which we don’t control. Check those settings before you ask your AI to read confidential or personal information.
- Authorities, when a law or a binding order requires us to share data.
- A new owner, if the business that runs STEVE is sold or reorganized. Personal data may then pass to the new owner to keep providing STEVE, as the law allows and under protections consistent with this policy. We’ll tell affected users if the controller changes.
These providers receive the data needed for these functions. Railway processes data on our behalf under a data-processing agreement signed with us. WorkOS and Cloudflare, and Anthropic and ElevenLabs when we use them for the interview, process data on our behalf under data-processing agreements that are part of their service terms. Microsoft provides our support email service, and OpenAI provides services for the interview, under their business terms. Your own ChatGPT or Claude account is governed by the terms, plan and data settings described above. Some providers may also process limited data for their own purposes, such as security, under their own privacy policies.
7. Where data is kept, and transfers abroad
We run STEVE from Israel. STEVE’s application server and database are hosted by Railway in Amsterdam, the Netherlands. WorkOS processes sign-in data in the United States. Railway may process hosting logs and operational data in the United States. Our support email provider, Microsoft, stores support emails in the data centres it uses for our Microsoft 365 account, which may be outside Israel. Cloudflare, which forwards them, may process them in other countries. The AI platform you connect receives what your AI requests under your account with it. Our AI providers for the interview, Anthropic, OpenAI and ElevenLabs, are based in the United States and may process interview information there and in other countries.
Under Israeli law: transfers to the Netherlands rely on the fact that EU countries are parties to the Council of Europe’s data protection convention. Transfers to providers in the United States and other countries are made under the providers’ service terms and, where they apply, the data-processing agreements described in section 6.
Where GDPR applies: the European Commission recognises Israel as providing an adequate level of protection. Railway’s, Anthropic’s and ElevenLabs’s data-processing agreements include the European Commission’s Standard Contractual Clauses for the transfers they cover. For the other providers, we rely on the safeguards set out in their own terms.
You can ask us for information about these safeguards, or a copy of them, at support@usesteve.com. We may remove confidential commercial terms.
8. How long we keep data
- Account details and brain documents, including earlier versions: while your account is active. Deleted within 30 days after your account is closed, or after a verified request to delete them.
- Your WorkOS user record and password: deleted within 30 days after your account is closed. WorkOS may keep sign-in security logs for the period set out in WorkOS’s own privacy policy.
- Usage log: no more than 12 months from each entry. Then we delete the entries. We may keep only overall statistics that can’t identify a person or business, and can’t reasonably be linked back to one. When your account is closed or you ask us to delete your data, we delete the entries linked to your account within 30 days.
- Hosting technical logs: no more than 90 days from collection.
- Access requests and support emails: no more than 24 months from receipt.
- Interview information: up to 90 days after the interview ends, then deleted. Deleted sooner, within 30 days, if your account is closed or you ask us to delete it.
- Database backups: we do not keep separate database backups in this version.
These are maximum periods. They don’t stop you from asking us to delete data sooner (section 9). If the law requires us to keep particular data, we keep only that, use it only for that purpose, and tell you where we’re allowed to.
9. Your choices and rights
- Disconnect STEVE at any time in your ChatGPT or Claude settings. That stops the use of STEVE through that connection. It doesn’t close your account, delete your data, or delete information already sent to the AI platform.
- Access: ask for the personal data we hold about you.
- Correction or deletion: under Israeli law, ask us to correct or delete personal data that is inaccurate, incomplete, unclear or out of date.
- Deletion and closing your account: ask us to delete your data or close your account. We delete it as described in section 8, including the usage-log entries linked to your account, or we remove from them anything that identifies you.
- A copy of your brain: ask for a copy of the brain documents we hold for your business.
- Where GDPR applies, you can also ask for rectification, erasure or restriction of processing, object to processing based on our legitimate interests, and receive the personal data you gave us in a structured, machine-readable format, or have it sent to another controller. These rights have the conditions and exceptions set by that law.
To make a request, email support@usesteve.com. You don’t need a STEVE account to make a request. If you have one, please write from its email address. We may ask for reasonable information to confirm that the request comes from you.
We reply within 30 days. Where GDPR applies and a request is complex, or one of many, we may extend this by up to two more months. If we do, we’ll tell you why within the first 30 days.
You can complain to Israel’s Privacy Protection Authority. Where GDPR applies, you can also complain to a data protection supervisory authority in the EU, in particular in the country where you live or work, or where you believe the problem happened. You don’t have to contact us first.
10. Security
- Sign-in is handled by WorkOS. Your password is stored there in hashed form, and STEVE never sees it.
- Every request from your AI carries a sign-in token that STEVE checks before it answers. Each account reaches only its own business’s brain.
- Connections to STEVE are encrypted (HTTPS).
- Access to the data we hold is restricted to authorized people and service providers who need it for their work.
No system is perfectly secure. If a security incident affects your personal data, we’ll tell you and the authorities as the law requires. If it affects personal data we hold for a business, we’ll tell that business without undue delay.
11. Cookies and the website
The STEVE website doesn’t use cookies, analytics or advertising trackers. The sign-in page is run by WorkOS and may use cookies that sign-in needs. When you visit the website, our hosting provider’s technical logs may record your IP address, as described in section 3. Because STEVE doesn’t track you across websites, a browser “Do Not Track” signal doesn’t change how the website works.
12. Changes to this policy
We’ll publish updates here and change the effective date. If a change materially affects how we use your personal data, we’ll tell account holders by email at least 30 days before it takes effect. Before we use personal data we already hold for a new purpose, we’ll give the people concerned the information the law requires, and ask for their consent where the law requires it. Publishing an update doesn’t by itself allow a new use of data we already hold.
13. Contact us
Shimi Dvir
Tel Aviv, Israel
support@usesteve.com