Privacy policy
Last updated 7 October 2026.
StepCert is built so that we never see what you record. This policy explains the little personal information we do handle: what you give us to buy and use a licence, and what this website needs to run.
Who we are
In this policy, “StepCert”, “we” and “us” mean the business that sells StepCert and runs stepcert.com. We are the controller of the personal information described here. For anything about this policy or your information, email sales@stepcert.com.
In short
- Your recordings, screenshots, step text, notes, branding and settings stay in your browser on your computer. The extension never sends them to us or to anyone else.
- The extension contacts stepcert.com, and only to check your licence. There is one exception, which you choose: if you add a YouTube, Vimeo or SoundCloud link to a course, it asks that service for the video's title and thumbnail.
- We keep your email address and licence details so you can buy, use and manage StepCert. Stripe handles payment; we never see your card details.
- No analytics, advertising or tracking, in the extension or on this website. We don't sell personal information.
- If you use the contact form for schools and organisations, we get the details you enter so we can reply.
The StepCert extension
What stays on your computer
Everything you record or make with StepCert is kept in your browser's own storage, in the browser profile you use StepCert in: screenshots, step text (including values typed while recording, except password, card-number and similar fields, which are recorded as dots), the originals of personal details that StepCert replaced with example data, page titles and addresses, notes, branding and settings. None of it is sent to us or to anyone else. StepCert writes the step wording and finds personal details to replace or hide on your computer, without any AI or other online service.
Courses you put together in the Course builder are kept in the same way. The videos, documents and other files you add to a course stay where they are on your computer: StepCert keeps a link to each one and reads it when you preview or build the course.
StepCert's recorder is loaded into the web pages you open so it's ready when you press REC, but it ignores everything on a page until a recording is running.
Files leave your computer only when you export or save them (a document, a course package, a .walk file, a course file or a settings template) and put them somewhere yourself. What happens to them then is up to you and wherever you send them.
What the extension sends to us
Only what we need to check your licence, and only to stepcert.com:
- When you sign in: your email address, your licence key, a random ID the extension creates for that browser, and a short description such as “Chrome on Windows”. The extension doesn't keep your licence key; it keeps the sign-in tokens we send back.
- About once a day while you use it: a sign-in token and that browser's random ID, to confirm the licence is still active.
- When you sign out: the sign-in token, so we can remove that browser.
- When you choose Manage subscription: a sign-in token, so we can open your Stripe billing page.
We use this only to confirm your licence, limit it to 3 browsers at a time, sign out a browser whose sign-in has been copied elsewhere, and open your billing page. The extension has no analytics, crash reporting or tracking.
Video links you add to a course
If you add a YouTube, Vimeo or SoundCloud link in the Course builder, the extension asks that service for the title and thumbnail picture, so you can recognise the item on your timeline. The request goes from your browser straight to YouTube (Google), Vimeo or SoundCloud, not to us. It contains the address of the video or track and, like any request, shows that service your IP address. It carries no cookies and no referring page, and nothing about you, your licence or your recordings. Other links, and the files on your computer, are never looked up.
Your recordings, documents and courses
We have no access to your recordings, the files you export or the courses you build, so we don't process any personal information in them, either for ourselves or on your behalf. You, or the organisation you work for, are responsible for them: for being allowed to record the systems and information you capture, for hiding anything that shouldn't be shared, and for how the files are stored, shared and kept.
StepCert's tools help, but check every picture and every step's text before you share anything. StepCert replaces the personal details it recognises, not every name or detail on a screen; Hide boxes cover pictures rather than text; other values typed while recording appear in the step text and in courses; and a .walk file keeps its screenshots as recorded, with the boxes on top.
Courses you build run in your learning management system (LMS) and send learners' results only to it, or to the learning record store it tells the course to use. How those results are used and kept is up to your organisation and its LMS provider. Played outside an LMS, a course keeps the learner's progress in their own browser.
A course loads nothing from the internet unless you put a YouTube or Vimeo video in it. That video plays from YouTube or Vimeo inside the course, using YouTube's privacy-enhanced player (youtube-nocookie.com) and Vimeo's do-not-track setting, and that service's own privacy policy applies to the learner who watches it. A web link in a course opens in a new tab. A SCORM package you import into a course runs inside it as it was made, so what it loads or sends is up to whoever made it.
Buying and managing a licence
Payments are handled by Stripe. For purchases on stepcert.com, Stripe acts as merchant of record: it takes the payment, works out and collects any sales tax or VAT, and processes your card and billing details under its own privacy policy. We never see or store your card details.
From Stripe we receive and keep your email address, your Stripe customer and subscription IDs, and your subscription's status and dates. We create your licence key and store it with them. We use these to deliver your licence key, let you sign in, open your billing page, answer your questions and keep the records the law requires.
For each browser signed in to your licence we keep its random ID, its description (such as “Chrome on Windows”), when it signed in and last checked in, and a scrambled (hashed) copy of its current sign-in token, never the token itself. To spot a sign-in copied to another browser, we also keep scrambled copies of sign-in tokens that have already been used.
Emails
We email your licence key when you buy and whenever you ask for it on Manage your licence. These emails are sent through Cloudflare's email service and are about your licence only. So that the Manage page can't be used to flood someone's inbox, we send at most one email per address every 10 minutes, and keep a scrambled (hashed) copy of the address and the time to do that. If you email us, we keep the conversation so we can help you.
This website
stepcert.com is hosted by Cloudflare. Like any web host, Cloudflare processes technical information such as your IP address and browser details to deliver the site and protect it from abuse. We use:
- your approximate country, as Cloudflare works it out from your IP address, to show prices in your currency (we don't store it);
- your IP address, briefly, to limit how often sign-in, checkout, licence-email and contact-form requests can be made;
- short-lived technical logs of requests and errors, to find and fix problems and to look into abuse.
The contact form for schools and organisations
If you use the form under Schools, colleges and organisations, we receive your name, your email address, the type of organisation, the number of people who would use StepCert, anything you write, and your approximate country as Cloudflare works it out. It's emailed to us through Cloudflare's email service, and we use it only to reply to you about a trial and pricing.
To stop bots sending the form, it uses Cloudflare Turnstile. Its script is loaded from Cloudflare only when you scroll to the form, and it checks technical signals from your browser, not what you type in the form.
Apart from Turnstile on the contact form, the website has no analytics, advertising or tracking scripts and loads no fonts or scripts from other companies. It sets no cookies of its own. Cloudflare may set a cookie that's strictly necessary to protect the site, and Stripe's checkout and billing pages, which are on Stripe's own website, use cookies under Stripe's policy. The demo course on this site keeps your progress in your browser's own storage, on your device only.
Why we're allowed to use it
Under UK and EU data protection law, we rely on:
- our contract with you, to issue your licence key, let you sign in, keep to the 3-browser limit, open your billing page and help you;
- our legitimate interests in running a secure, working service: rate limits, technical logs, the bot check on the contact form, spotting copied sign-ins and showing prices in your currency;
- steps you ask us to take before a contract, to answer an enquiry you send us about a trial or team pricing;
- legal obligations, to keep purchase and tax records.
Who we share it with
We don't sell or rent personal information, and we don't share it for advertising. We share it only with the companies that run parts of the service, Stripe (payments, billing and tax) and Cloudflare (hosting, the licence database and sending email), and our email provider for messages you send us; with others when the law requires it or to protect our rights; and with a buyer or successor if the business is sold or reorganised, who must keep to this policy.
Where it's processed
Stripe and Cloudflare operate around the world, including in the United States, so information we hold may be processed outside the UK and the European Economic Area. Where it is, it's protected by the safeguards data protection law requires, such as standard contractual clauses or an adequacy decision.
How long we keep it
- Licence and purchase records: while your licence is active, and afterwards for as long as we need them for tax, accounting and legal reasons.
- Signed-in browsers: until you sign out, a newer sign-in replaces them, or they go 60 days without use. A browser unused for 60 days is signed out, and its record is deleted when that browser or your licence is next used to sign in, or sooner if you ask.
- Scrambled copies of used sign-in tokens: cleared out regularly once they're more than 60 days old.
- The licence-email limit: the scrambled address and time stop being used after 10 minutes and are cleared as later requests come in.
- Technical logs: a few days.
- Emails with us, and enquiries from the contact form: as long as we need them to help you and to keep our business records.
How we protect it
Sign-in tokens are signed so they can't be forged, change every time they're used, and are stored on our side only in scrambled form. The extension doesn't keep your licence key. Your billing page opens only for the address the licence was bought with: from the extension, from a time-limited link we email to that address, or through Stripe's own sign-in with a one-time code sent to it. Sign-in and licence-email requests are rate-limited.
Your rights
Depending on where you live, you can ask for a copy of the personal information we hold about you, ask us to correct or delete it, object to or restrict how we use it, or ask for it in a form you can take elsewhere. Email sales@stepcert.com and we'll reply within a month. We may need to keep records the law requires, and if we delete your licence details, your licence stops working.
In the UK you can complain to the Information Commissioner's Office (ico.org.uk), and in the EU to your local data protection authority. We'd be grateful for the chance to put things right first.
In US states with privacy laws, such as California: we don't sell personal information or share it for targeted advertising, and we won't treat you differently for using your rights.
Children
StepCert is for people at work and isn't aimed at children. We don't knowingly collect children's personal information.
Changes to this policy
If we change this policy we'll publish the new version here and update the date at the top. If a change affects how we use information we already hold, we'll also email licence holders.
Terms of sale and use
Last updated 7 October 2026.
These terms apply when you buy a StepCert licence, use the StepCert extension and the files it makes, or use stepcert.com. Please read them, especially Limits on our liability. By buying or using StepCert you agree to them.
Who we are, and who you are
In these terms, “StepCert”, “we” and “us” mean the business that sells StepCert and runs stepcert.com, and “you” means the person who buys or uses StepCert. If you use StepCert for an organisation, you confirm you're allowed to accept these terms for it, and “you” includes that organisation. Some parts apply differently depending on whether you're a consumer (buying for yourself, mainly outside your trade, business or profession) or a business customer (anyone else). Contact us at sales@stepcert.com.
Your licence
A StepCert licence is for one person. While your subscription is active you may use StepCert on up to 3 browsers at a time and make unlimited walkthroughs, documents and courses, for any number of learners. You may not share your licence key with other people, resell or sublicense StepCert, or try to get around its licence checks.
We may suspend or end your licence if you seriously or repeatedly break these terms, for example by sharing your licence key. Documents and courses you've already made keep working.
Billing
StepCert is billed yearly in advance and renews automatically until you cancel. Payments are taken by Stripe as merchant of record, and Stripe's own terms apply to the payment itself. You can cancel at any time from your account page; your licence stays active until the end of the year you've paid for. If you're not happy, email us within 30 days of your first payment for a full refund.
What you make is yours
You own the walkthroughs, documents and courses you create. Documents and courses keep working after your subscription ends. StepCert itself, including the extension, the course player and this website, belongs to us or our licensors; your licence lets you use it, and doesn't transfer any ownership.
Your recordings and your compliance
You're responsible for what you record, export and share with StepCert: that you're allowed to record the systems and information you capture, that you hide what shouldn't be shared, and that your use of StepCert meets the laws, regulations and policies that apply to you and your organisation. StepCert's tools, such as example data, the check before exporting, Suggest hiding and Hide boxes, help, but they won't find everything, so check your documents and courses before you share them. Nothing on this website, including the page about regulated sectors, is legal or compliance advice, and using StepCert doesn't by itself make you compliant with any law, regulation or standard.
If you're a business customer, you'll compensate us for any claims, losses, damages and reasonable costs (including legal fees) we suffer because of material you record, export or share with StepCert, or because you break these terms or the law, except to the extent they're caused by our own breach of these terms.
What StepCert does and doesn't do
- Keep your own copies. Recordings are stored only in your browser. We never have a copy and can't recover them. Clearing your browser's data, removing the extension, or a fault in your browser or computer can delete them, so save .walk files as backups.
- Check its work. Step wording, Suggest hiding and the other automatic features are aids. They can miss things or get things wrong, so check every picture and every step before you rely on or share a file.
- Certificates aren't qualifications. A certificate records how a learner did in a StepCert course. It isn't a qualification, and it isn't an assurance from us that anyone is competent. We don't check who took a course or how.
- No guarantee of compatibility. We can't promise StepCert will work with every website, browser, LMS or learning record store, or that it, the licence server or this website will always be available or free of errors. StepCert keeps working for up to 7 days when it can't reach the licence server.
- Other companies' services. Stripe, Cloudflare, your browser and your LMS are run by other companies under their own terms. We aren't responsible for them.
- Information on this website. Pages such as the one about regulated sectors and the comparison with other tools are general information. We try to keep them right, but we don't promise they're complete, accurate or up to date. Check anything important with your own advisers before relying on it.
Limits on our liability
For everyone
Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else that the law doesn't allow us to limit or exclude. If you're a consumer, nothing in these terms affects your legal rights.
We aren't responsible for delays or failures caused by events outside our reasonable control, such as failures of the internet or of hosting or payment providers, changes browsers make, or attacks on our systems.
If you're a business customer
StepCert and this website are provided “as is” and “as available”. To the fullest extent the law allows, we exclude all warranties, conditions and other terms that might otherwise be implied by statute, common law or anything else, including those about satisfactory quality, fitness for a particular purpose, accuracy and non-infringement.
We won't be liable to you, whether in contract, tort (including negligence), breach of statutory duty or otherwise, even if it was foreseeable, for any:
- loss of profits, revenue, sales, business, contracts or anticipated savings;
- loss of or damage to goodwill or reputation;
- loss, corruption or disclosure of data or information, including anything in files you make with StepCert;
- regulatory fines or penalties, or the cost of investigations or of notifying anyone about a data breach;
- business interruption, wasted time or wasted expenditure; or
- indirect or consequential loss.
Our total liability to you for all claims arising out of or in connection with StepCert, this website and these terms, however it arises, is limited to the amount you paid for StepCert in the 12 months before the event that gave rise to the claim.
If you're a consumer
The law gives you rights if digital content isn't of satisfactory quality, fit for purpose or as described (in the UK, under the Consumer Rights Act 2015). For example, if StepCert is faulty, you're entitled to a repair or a replacement or, if that isn't possible or doesn't fix it, some or all of your money back. Nothing in these terms affects those rights.
We're responsible for loss or damage you suffer that's a foreseeable result of our breaking these terms or failing to use reasonable care and skill. We aren't responsible for loss or damage that isn't foreseeable. StepCert is made for use at work: if you use it for any commercial, business or resale purpose, we won't be liable to you for any loss of profit, loss of business, business interruption or loss of business opportunity.
If you're outside the UK
The law where you live may give you rights that can't be excluded or limited. These terms apply only as far as that law allows, and the limits in this section apply to the fullest extent it permits. For example, some US states don't allow implied warranties to be excluded or certain damages to be limited, so some of the limits above may not apply to you.
General
- Changes to these terms. We may update these terms. If a change significantly affects you, we'll email you before it applies to you; if you don't agree, you can cancel before your next renewal.
- If part of these terms can't be enforced, the rest still applies, and that part applies to the fullest extent the law allows.
- Transfers. You may not transfer your licence to anyone else without our written agreement. We may transfer our rights and obligations to someone who takes over StepCert; if you're a consumer, this won't reduce your rights.
- Nobody else has any right to enforce these terms.
- Delays. If we don't enforce a term straight away, we can still enforce it later.
- Which law applies. These terms are governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction. If you're a consumer, you keep the protection of the mandatory laws of the country where you live and can bring claims in your local courts; if you live in Scotland or Northern Ireland, you can bring claims there.