Privacy Policy — StepFree Commerce

Last updated: 14 November 2026.

Controller: StepFree Commerce, operated by Ákos Földesi, sole trader, Luxembourg. Contact: hello@stepfreecommerce.com.

Website visitors

We use Cloudflare Web Analytics, which counts page views without cookies and without identifying you. We set no cookies.

If you choose a currency with the switch on the pricing page, your browser remembers that choice in its local storage so the next pages show the same currency. It stays on your device, is never sent to us, and you can remove it by clearing this site’s data in your browser. Otherwise we guess the currency from your device’s time zone, inside your browser; we do not look up your location.

If you arrive from one of our ads, the link carries a short campaign label (for example gads). It passes along our own links in the address bar only, and if you then request a quick check, we store the label with your request to see which ads lead to requests. No cookie is set, and the label does not identify you. We do not use Google’s or anyone else’s tracking tags.

Quick check requests

When you request a free quick check, we process the shop URL and email address you enter, and your consent. Purpose: run the check and send you the result. Legal basis: your consent and our legitimate interest in answering your request (GDPR Article 6(1)(a) and (f)). Requests wait on Cloudflare until we fetch them (they expire there automatically after 30 days), then are kept on our work machine and deleted 12 months after the request unless you become a client.

We sometimes contact businesses whose contact details are publicly listed (for example on their website or in a court filing that names the business). We process the business name, website, public business email address or professional profile, and our notes about the site’s accessibility. Legal basis: legitimate interest in offering a relevant service to businesses (Article 6(1)(f)). Source: public sources. We keep this data for up to 12 months, or less if you object. If you reply “unsubscribe” or object, we add your address to a suppression list and never contact you again; the suppression entry itself is kept so we can honour your request.

Clients

For contracts we process contact, billing and project data (Article 6(1)(b)), and keep invoices for 10 years as Luxembourg law requires. When you pay, Stripe tells us your name, email address and what you bought; we use them to email you the next steps and a link to our intake form, whose answers are collected with Tally. See also our data-processing addendum.

Processors

Stripe (payments), Cloudflare (website, forms), Resend (the email with next steps after payment), Tally (intake form), our mailbox provider, Anthropic (AI assistance on project work). Some are in the United States and rely on the EU–US Data Privacy Framework or standard contractual clauses.

Your rights