Privacy Policy · Steppe

This policy explains what personal data we collect through steppe.in, why we collect it, how long we keep it, who we share it with and what rights you have. It is written for visitors to this website and for people who contact us. It does not cover data our customers put into the Steppe platform, which is described in section 10.

1. Who we are

Steppe is a compliance platform built and operated by VASUIST ("we", "us"). For the personal data described in this policy, VASUIST is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and the controller under the EU and UK General Data Protection Regulation (GDPR).

You can reach us at outpost@steppe.in or on +91 98731 57096.

2. What we collect and why

When	What we collect	Why	Legal basis
You subscribe to our guides	Your email address and the page you subscribed from	To send you new articles and guides	Your consent (DPDP Act section 6; GDPR article 6(1)(a))
You book a demo	Your name, email, company and any notes you add on the booking form	To schedule and hold the demo and follow up about Steppe	You provided it voluntarily for this purpose (DPDP Act section 7(a)); steps you asked for before a contract (GDPR article 6(1)(b))
You email or call us	Your name, contact details and what you write or tell us	To reply and keep a record of the conversation	You provided it voluntarily for this purpose (DPDP Act section 7(a)); our legitimate interest in answering you (GDPR article 6(1)(f))
You visit any page	Your IP address, browser type, the page requested and the time, in our web server logs	To keep the website running and secure and to investigate abuse	Reasonable security purposes; our legitimate interest in protecting the service (GDPR article 6(1)(f))

We collect only what is listed above. We do not buy personal data, we do not sell it, and we do not use it to build advertising profiles.

3. Cookies and tracking

This website sets no cookies and runs no analytics or advertising trackers. Our fonts and files are served from our own servers, so visiting steppe.in does not send your details to third party font or script providers. If we add analytics in future, we will update this policy before we do.

We share personal data only with service providers that process it on our behalf, under contracts that limit what they can do with it:

Amazon Web Services hosts this website and the Steppe platform in Mumbai, India.
Hostinger provides the email service for outpost@steppe.in.
Calendly handles demo bookings. When you book, you use Calendly's form and Calendly's own privacy policy also applies.
Our newsletter email provider, once the newsletter is live. We will name it here before we send the first issue.

We may also disclose personal data where the law requires it, for example to comply with a lawful request from a government authority.

5. Transfers outside India

Some of our providers, such as Calendly, process data outside India. Transfers of personal data outside India are permitted under the DPDP Act except to countries the Central Government restricts, and we will follow any such restriction. For people in the EU or UK, we rely on the safeguards our providers offer for international transfers, such as standard contractual clauses.

6. How long we keep it

Newsletter: until you unsubscribe or ask us to delete your email.
Demo bookings and correspondence: up to 24 months after our last contact with you, unless you become a customer, in which case your contract governs it.
Web server logs: up to 30 days.

When the purpose is served or you withdraw consent, we delete the data unless the law requires us to keep it longer.

7. Your rights

Under the DPDP Act you can ask us for a summary of the personal data we hold about you and how we process it, ask us to correct, complete, update or erase it, withdraw your consent at any time (as easily as you gave it), have a grievance addressed by us, and nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

Under the GDPR, if you are in the EU or UK, you can also ask us to restrict or stop processing, object to processing based on our legitimate interests, and receive your data in a portable format. You can complain to your local supervisory authority.

To exercise any of these rights, write to outpost@steppe.in. Every newsletter email also has an unsubscribe link. We will confirm your request and respond within 30 days.

8. Grievance Officer

If you have a concern about how we handle your personal data, contact our Grievance Officer:

Vaishnavi Sharma, Founder, VASUIST
outpost@steppe.in · +91 98731 57096

If you are not satisfied with our response, you may complain to the Data Protection Board of India once you have used our grievance process.

9. How we protect it

All traffic to steppe.in is encrypted in transit. Access to personal data is limited to the people who need it to do the work described above. If a personal data breach occurs, we will inform affected people and the Data Protection Board of India as the law requires. Our security page describes the controls behind the Steppe platform.

10. Data inside the Steppe platform

When a company uses Steppe, the data it stores in its workspace belongs to that company. For that data, VASUIST acts as a Data Processor on the customer's instructions, under the customer's agreement with us. If you are an employee or user of one of our customers, contact your employer first about your data in Steppe.

11. Children

This website is meant for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us their data, write to us and we will delete it.

12. Changes to this policy

If we change this policy, we will post the new version here with a new date. If a change affects how we use data you have already given us, we will tell you before it takes effect.