1. Who we are

StepBy ("StepBy", "we", "us", or "our") is a personal travel-concierge service that generates tailored trip itineraries, operated by KaiCheng Fan, an individual based in Taipei, Taiwan (R.O.C.).

For any privacy question, or to exercise the rights described below, contact us at privacy@stepby.com.tw.

This policy explains what personal data we collect when you use the StepBy website at https://www.stepby.com.tw (the "Service"), why we collect it, who we share it with, and the choices and rights you have.

2. The data we collect

Account data. When you create an account we collect your email address and an authentication credential. Your password is handled by our authentication provider and stored only in hashed form — we never see or store your plain-text password.

Traveler profile. To personalize itineraries, you may provide a profile that can include your travel style and pace, budget preferences, and preferred lodging and transport. It may also include sensitive information you choose to share, such as:

• Dietary requirements (which can reveal or imply religious beliefs or health conditions),
• Mobility and accessibility needs (which can reveal health information),
• Nationality or passport/citizenship context (used for visa- and entry-relevant suggestions).

We treat these as sensitive personal data and collect them only with your consent, and only to generate and refine your itineraries. You are never required to provide them; if you omit them, your itinerary is generated without them.

Trip data. The trip briefs you submit (destinations, dates, party size, interests, constraints), the itineraries we generate for you, and any feedback or edits you provide afterward.

Technical and usage data. Basic information created when you use the Service, such as log data, device/browser information, and interactions needed to operate, secure, and improve the Service.

Cookies. We use only strictly necessary cookies — principally to keep you securely signed in (set by our authentication provider). We do not use advertising or third-party tracking cookies. See Section 8.

3. How we use your data

We use your data to: create and manage your account; generate, quality-check, and revise your personalized itineraries; show hotel prices, maps, and travel-time information relevant to your trip; send you transactional emails that are necessary to operate your account (such as email confirmation and password resets); maintain the security and integrity of the Service; and comply with legal obligations.

Under Taiwan's PDPA, we collect and process your data on the basis of your consent and of the contractual relationship created when you use the Service to plan a trip. For sensitive profile data, we rely specifically on your consent, which you may withdraw at any time.

We do not sell your personal data. We do not use your sensitive profile data for advertising, and we do not use it to train third-party AI models beyond what is necessary to generate your own itinerary at the time you request it (see Section 4).

4. Third parties who process data for us (sub-processors)

To run StepBy we rely on reputable third-party providers. Each receives only the data needed for its function, and several are located outside Taiwan — using the Service therefore involves international transfers of your data (see Section 6).

• Supabase — user authentication and database hosting (stores your account, profile, and trip data).
• Railway — application hosting/compute.
• Anthropic (Claude API) — generates and quality-checks your itinerary from the trip and profile details you provide. Under Anthropic's commercial API terms, your inputs and outputs are not used to train its models.
• Mapbox — geocoding, maps, and travel-time estimates for locations in your itinerary.
• RapidAPI / Booking.com — retrieves indicative hotel prices and availability for your destination.
• Resend — delivers transactional email (account confirmation, password reset) from our domain.
• Google Maps Platform (Places API) — verifies that places exist and retrieves opening hours to improve itinerary accuracy.
• Travelpayouts — (if/when enabled) affiliate link routing for hotel bookings (see Section 7).

We do not permit these providers to use your personal data for their own independent purposes.

5. How long we keep your data

We keep your account, profile, and trip data for as long as your account is active. If you delete your account or ask us to remove your data, we delete or anonymize your personal data within 90 days, except where we must retain limited records to meet legal, security, or accounting obligations. Background job records and generated itineraries may be pruned automatically on a rolling basis.

6. International data transfers

StepBy is operated from Taiwan, but several of our providers (Section 4) process data in the United States and other countries. Where your data is transferred across borders, we take reasonable steps to ensure it remains protected in line with this policy and applicable law. By using the Service and providing your data, you acknowledge these transfers.

7. Affiliate links and bookings

When your itinerary includes a hotel, the "book" link may hand you off to a third-party travel site (such as Booking.com). (Once our affiliate program is active:) some of these links are affiliate links, meaning we may earn a commission if you complete a booking, at no additional cost to you. Any booking you make happens on the third party's own site and is governed by that third party's terms and privacy policy — we do not receive your payment-card details.

8. Cookies

We use only cookies that are necessary to provide the Service — principally to keep you signed in. Because these are strictly necessary, they do not require consent under most frameworks, but we disclose them here for transparency. We do not use non-essential or advertising cookies.

9. Your rights and choices

Under Taiwan's PDPA, you have rights over your personal data, including the right to: inquire about and review the data we hold about you; request a copy of it; request correction or supplementation of inaccurate data; request that we delete your data; and request that we stop collecting, processing, or using your data. You may also withdraw consent (including for sensitive profile data) at any time.

To exercise any of these, contact privacy@stepby.com.tw. We will respond within the time required by applicable law. You can also update or remove much of your profile directly in the app, and withdrawing consent for a sensitive field simply removes it from future itinerary generation.

10. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, access controls, and restricted API credentials. No method of transmission or storage is perfectly secure, but we work to protect your information and to limit who and what can access it.

11. Children

The Service is not directed to, and not intended for, individuals under the age of 18. We do not knowingly collect personal data from children. If you believe someone under 18 has provided us their data, contact us at privacy@stepby.com.tw and we will delete it.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.

13. Contact

Questions, requests, or complaints: privacy@stepby.com.tw.