Privacy Policy

This Privacy Policy outlines how ToNextStep collects, processes, and protects your personal data when you visit or purchase digital assets on our platform.

1. Data Controller & Scope

ToNextStep operates as the data controller for user accounts, browsing data, and customer communications. Payment processing and transactional tax collection are managed through our Merchant of Record partner, Paddle.com Market Ltd.

2. Personal Data We Collect

We collect information necessary to deliver digital products and manage your account: • Account Information: Name, email address, and authentication credentials. • Order & License History: Records of purchased products, license keys, and downloadable asset activity. • Technical & Session Data: IP address, browser type, device information, and essential session cookies. Note: Payment card numbers, CVC codes, and sensitive financial credentials are NEVER collected or stored on our servers. All financial transactions occur inside Paddle's secure PCI-DSS compliant checkout window.

3. Legal Basis for Data Processing

We process your personal data under the following legal bases: • Performance of Contract: To deliver digital downloads, manage license keys, and provide order support. • Legitimate Interests: To prevent software piracy, detect fraudulent transactions, and secure our infrastructure. • Legal Compliance: To satisfy accounting, VAT, and tax reporting requirements. • Consent: For optional marketing communications, which you can opt out of at any time.

4. Third-Party Service Providers

We share data only with essential cloud infrastructure providers operating under strict confidentiality and data protection standards: • Paddle.com: Merchant of Record processing payments, invoicing, and tax compliance. • Supabase: Encrypted cloud database and authentication provider. • Vercel Inc.: Global web application hosting and CDN infrastructure. • Resend: Transactional email delivery service.

5. Data Retention

We retain account and license information for as long as your account remains active so you can re-download purchased assets. Statutory purchase and tax records are retained for the legally required period (typically 6–7 years) in accordance with financial regulations.

6. Your Rights

Under applicable data protection laws (including GDPR), you have the right to: • Access the personal data we hold about you. • Request correction of inaccurate data. • Request erasure of your account and personal data (subject to legal retention duties). • Withdraw consent for marketing at any time. To exercise any of these rights, please submit a request via our Contact page.

7. Cookies & Tracking

We use essential first-party cookies necessary for user authentication, security, and cart functionality. We do not use intrusive third-party tracking cookies or sell your personal information to third parties.

8. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in legal requirements or platform operations. The updated policy takes effect immediately upon publication on this page.

Questions about this document? Get in touch.