Privacy Policy

This Privacy Policy outlines how ToNextStep collects, processes, and protects your personal data when you visit or purchase digital assets on our platform.

Draft — written on stated assumptions, not yet reviewedThis page was rewritten on 2026-09-14 because the previous version named Paddle as Merchant of Record, which is no longer true. It rests on five assumptions, all of which need confirming before launch: (1) there is NO merchant of record — ToNextStep sells directly and SpaceRemit is only a payment processor; (2) no tax is calculated or collected at checkout, and any tax obligation is the seller's; (3) the only payment methods are the local wallets and transfers SpaceRemit offers, and cards are not accepted; (4) refunds return through SpaceRemit to the method used, and where that method cannot receive one, an alternative is agreed with the buyer; (5) the name on a buyer's statement or wallet history is SpaceRemit or its local agent, not ToNextStep. A lawyer should review this before it is relied on.

1. Data Controller & Scope

ToNextStep is the data controller for user accounts, browsing data, and customer communications. We are also the seller of record: there is no merchant of record standing between us and you. Payments are handled by SpaceRemit, a payment services provider acting on our instructions, which processes the payment details you enter and returns to us only what we need to recognise your order — an identifier, an amount, and a status. Your payment credentials are entered on SpaceRemit's own systems and are never received or stored by ToNextStep.

2. Personal Data We Collect

We collect information necessary to deliver digital products and manage your account: • Account Information: Name, email address, and authentication credentials. • Order & License History: Records of purchased products, license keys, and downloadable asset activity. • Technical & Session Data: IP address, browser type, device information, and essential session cookies. Note: Payment card numbers, CVC codes, and sensitive financial credentials are NEVER collected or stored on our servers. All financial transactions occur inside SpaceRemit's own payment window, which runs on their systems rather than ours.

3. Legal Basis for Data Processing

We process your personal data under the following legal bases: • Performance of Contract: To deliver digital downloads, manage license keys, and provide order support. • Legitimate Interests: To prevent software piracy, detect fraudulent transactions, and secure our infrastructure. • Legal Compliance: To satisfy accounting, VAT, and tax reporting requirements. • Consent: For optional marketing communications, which you can opt out of at any time.

4. Third-Party Service Providers

We share data only with providers that are necessary to run the store, each under confidentiality and data protection obligations: • SpaceRemit: the payment services provider that processes payments and returns the transaction status used to release your download. Payment details are given to SpaceRemit directly by you and do not pass through our systems. • Supabase: authentication, database and file storage. • Resend: transactional email — receipts and download links. • Vercel: application hosting and delivery. We do not sell personal data, and we do not share it for advertising purposes.

5. Data Retention

We retain account and license information for as long as your account remains active so you can re-download purchased assets. Statutory purchase and tax records are retained for the legally required period (typically 6–7 years) in accordance with financial regulations.

6. Your Rights

Under applicable data protection laws (including GDPR), you have the right to: • Access the personal data we hold about you. • Request correction of inaccurate data. • Request erasure of your account and personal data (subject to legal retention duties). • Withdraw consent for marketing at any time. To exercise any of these rights, please submit a request via our Contact page.

7. Cookies & Tracking

We use essential first-party cookies necessary for user authentication, security, and cart functionality. We do not use intrusive third-party tracking cookies or sell your personal information to third parties.

8. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in legal requirements or platform operations. The updated policy takes effect immediately upon publication on this page.

Questions about this document? Get in touch.