Privacy Policy

Contents

• I. Controller and scope
• II. Data processing on the website and in the app
• III. Use of the StepMade app
• IV. Health and activity data
• V. Use of the website www.stepmade.app
• VI. AI-supported features
• VII. Paid subscriptions and payment processing
• VIII. Analytics, marketing and attribution
• IX. Communication
• X. Transfers to third countries
• XI. Retention periods, deletion and blocking
• XII. Rights of data subjects

I. Controller and scope

1. Controller

The controller within the meaning of the GDPR is:

Fastic GmbH
Pappelallee 78/79
10437 Berlin
Germany

Email: datenschutz@stepmade.app
Postal address for data protection matters: Fastic GmbH, Data Protection Officer, Pappelallee 78/79, 10437 Berlin, Germany

The mandatory information pursuant to Section 5 of the German Digital Services Act (DDG, legal notice) is available in the StepMade app under “Profile → Help → Imprint” and on www.stepmade.app at /imprint.

Data Protection Officer

You can contact our Data Protection Officer directly, for example regarding particularly sensitive matters, as follows:

External Data Protection Officer
ePrivacy GmbH
represented by Prof. Dr. Christoph Bauer
Bei den Mühren 5, 20457 Hamburg, Germany

If you have any questions about the processing of personal data, requests for access, rectification or erasure, or wish to withdraw your consent, you can contact us at any time by email at datenschutz@stepmade.app or by post at the address above.

2. Scope of this privacy policy

This privacy policy applies to the following services of Fastic GmbH:

• the StepMade app for iOS and Android
• our website at www.stepmade.app, including onboarding, subscription purchase and customer account

Where a particular processing operation takes place exclusively for one of these services, this is indicated in the relevant section. Separate privacy notices apply to the Fastic and Movina apps.

II. Data processing on the website and in the app

1. Log files when accessing the website and the app

When you visit our website www.stepmade.app or use the StepMade app, the following access data is collected automatically:

• IP address (truncated, unless you have consented to further processing)
• date and time of access
• content accessed / API endpoint
• type and version of the device, browser or app
• operating system
• referrer URL (on the website)
• for mobile access: app version, build number, language, country, time zone, device model

On the website, we derive your country, region and city from your IP address in order to show you the appropriate language, the legal texts that apply in your country and, during the ordering process, prices and currency. We store these values in session cookies (m_country, m_region, m_city), which are deleted when you close your browser.

Purpose: ensuring operation, error analysis, defence against attacks, country-specific display.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service); Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). In the event of security incidents, the data may be analysed in a personally identifiable form.
Retention period: log files are generally deleted automatically within 30 days, unless security-related events require longer storage.

2. Contact, termination and withdrawal

Email enquiries (support@stepmade.app, datenschutz@stepmade.app): data needed to answer your enquiry, linked to your customer account where applicable. If you write to us via “Help and feedback” in the app, the app adds the app version, build number, operating system and your user ID to your email so that we can match your request to your account; you see this information before sending. Legal basis: Art. 6(1)(f) GDPR; for contract-related enquiries Art. 6(1)(b) GDPR. To handle enquiries, we use Google Workspace and Freshdesk (customer support system of Freshworks Inc., USA, Standard Contractual Clauses). To pre-sort and answer support requests, we use an AI model of OpenAI, L.L.C. (USA, Standard Contractual Clauses).

Termination and withdrawal form (www.stepmade.app/contract-revocation): type of request, type of termination, reason, date, user ID, first and last name, address, email address, feedback, language. The data is transmitted to our own backend (Firebase Cloud Functions, region europe-west1). Legal basis: Art. 6(1)(b) and (c) GDPR (contract handling, Section 312k German Civil Code).

3. Hosting and IT service providers

The StepMade app and our website are operated predominantly on cloud infrastructure in the European Union. We use:

• Google Firebase / Google Cloud Platform (europe-west1): authentication, database (Firestore), file storage, Cloud Functions, push delivery, app updates. A data processing agreement has been concluded with Google Ireland Ltd.
• Vercel Inc. (USA, Standard Contractual Clauses): hosting of our website www.stepmade.app. Delivery to European users takes place predominantly from European data centres.
• Internal communication and collaboration tools (including Slack Technologies, LLC, USA, EU-U.S. Data Privacy Framework): internal coordination, e.g. for handling support requests.
• Tableau (Salesforce, Inc., USA, EU-U.S. Data Privacy Framework or Standard Contractual Clauses): analysis and visualisation of aggregated or pseudonymised usage data.
• DoiT International DACH GmbH (Germany): contract management for Google Cloud (reseller); access to contract and technical account data.

Where data is transferred to the USA, this is based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses and, where necessary, supplementary technical measures (encryption). Legal basis: Art. 6(1)(f) GDPR and, for contractual services, Art. 6(1)(b) GDPR.

4. Our presence on social networks

Where we operate a profile on Instagram, a service of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland, and you visit our profile or interact with our posts (e.g. like, comment, send messages), we process the content and your Instagram username in order to communicate with you and operate our profile.

Meta also provides us with statistical analyses of the use of our profile (“Insights”). We are joint controllers with Meta for the processing related to these statistics (Art. 26 GDPR). In an agreement, Meta has undertaken to assume primary responsibility for this processing and to fulfil your data subject rights; the agreement is available at https://www.facebook.com/legal/terms/page_controller_addendum. We have no influence on any other data processing by Meta; further information can be found in Instagram's privacy policy at https://privacycenter.instagram.com/policy. Data may also be transferred to Meta Platforms Inc. in the USA (EU-U.S. Data Privacy Framework).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communicating with prospective customers and users and in presenting our services).

III. Use of the StepMade app

1. Onboarding questionnaire before a customer account is created

When you first start the StepMade app, you complete an onboarding questionnaire. Its purpose is

• to create your personal walking and step plan (baseline, weekly goals, walking days, duration and time of day of your walks, programme length),
• to schedule your reminders to fit your day,
• to give you a forecast for reaching your goal weight,
• to then offer you a suitable subscription.

The data collected is:

• main goal (e.g. lose weight, walk more, get fitter) and motivation
• height, current weight, goal weight
• optional: year of birth and gender
• walking days, preferred duration and preferred time of day of your walks
• opportunities for extra steps in everyday life (e.g. commute, lunch break, dog), preferred surroundings and whether you walk alone or with company
• programme length (8, 10 or 12 weeks) and start date
• your answers to short statements about your expectations
• your choices on system permissions (health data, notifications, on iOS app tracking)

We process health data from Apple Health or Health Connect (in particular your steps over the last up to 14 days as a baseline) only with your consent, see section IV.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Year of birth and gender are voluntary; without them, the forecast is less accurate. We do not treat height, weight and goal weight as special categories of personal data under Art. 9 GDPR.

After the first start, a pseudonymous customer profile is created (Firebase Authentication) so that you can use the onboarding and the free basic features immediately. This profile contains only the information you provided during onboarding and a technical user ID, but neither your name nor your contact details. You can discard the profile at any time by deleting it in the app (section XI) or by uninstalling the app.

2. Registration of the customer account

After purchasing a subscription, registration is required so that your subscription is available across devices and in the customer account on www.stepmade.app. Without a subscription, registration is voluntary. Your existing profile is converted into a registered account; your existing data is retained. In all cases, we process the data to provide the user agreement (Art. 6(1)(b) GDPR).

a) Registration with email and password
Data processed: email address, password (stored only in encrypted form as a hash in Firebase Authentication), timestamp. We also store your email address in your profile in order to contact you about your account and subscription. To confirm your email address and to reset your password, you will receive a link by email.

b) Registration via Google login
You sign in with your existing Google account. Google transmits to us: Google account ID, email address, display name, profile picture URL. Provider: Google Ireland Ltd. (EU); for users outside the EU, Google LLC (USA). We do not receive any Google login credentials.

c) Registration via Sign in with Apple
You sign in with your Apple ID. Apple transmits to us: anonymised Apple user ID, optionally your email address (also possible via Apple's “Hide My Email” relay address), name (only at first login). Provider: Apple Distribution International Ltd. (Ireland). When you delete your account, we revoke the link to your Apple ID.

d) Automatic sign-in after a purchase on the website
If you purchased your subscription on www.stepmade.app, we sign you in automatically after installing the app using a single-use sign-in code. The code is passed along with the download link and expires after a short time.

For all sign-in methods, the data is stored in the EU Firebase Authentication instance.

3. Use of the app and storage of your profile

While you use the app, we store:

• your plan (programme length, start and end date, baseline, weekly goals and their adjustments, walking days, duration and time of day of your walks, breaks you take)
• daily values and walks (see section IV)
• weight entries that you enter yourself or take over from Apple Health or Health Connect (weight, date and time of measurement)
• how a walk felt (e.g. “easy”, “just right”, “hard”), if you tell us
• selected app settings, language, country, units and reminders
• A/B test assignment and active feature flags
• push tokens (FCM, APNs) for sending notifications

Legal basis: Art. 6(1)(b) GDPR for the performance of the user agreement (free and paid features) and Art. 6(1)(f) GDPR for improving usability. We do not treat weight entries - like the height and weight information provided during onboarding - as special categories of personal data under Art. 9 GDPR.

When you take a break from your plan, you can optionally give a reason (e.g. “ill” or “in pain”). We use the reason only to adjust your plan; it is not stored in your profile. By giving a health-related reason, you consent to this processing (Art. 9(2)(a) GDPR).

IV. Health and activity data

At your express request, the StepMade app reads health and activity data from Apple Health or Health Connect and can write weight entries back to them. A connection is only established after your express consent (Art. 9(2)(a) GDPR) and the respective system permission. The app connects directly to the respective platform on your device; no intermediary service is used. Without a connection, you can use StepMade with estimated or self-entered values.

Data categories processed (depending on the connection)

To keep your daily progress and your plan up to date, the app also reads this data in the background (iOS: HealthKit background delivery; Android: Health Connect background access).

What stays on your device and what we store

We evaluate individual samples and hourly values only on your device. We transfer only the following to our servers (Firebase, region europe-west1):

• Daily values: steps, distance, estimated calories burned by walking, daily goal and whether you reached it, source of the step count (Apple Health, Health Connect or estimate)
• Walks: start and end, duration, steps and how the walk felt
• Weight entries: weight and date and time of measurement
• Baseline from onboarding: your average daily steps

Purpose: calculating your plan and adjusting it every week, showing your progress and your weight forecast, synchronising between your devices.

We do not use data from Apple Health and Health Connect for advertising and do not pass it on to advertising or analytics services.

Legal basis: express consent pursuant to Art. 9(2)(a) GDPR. You can disconnect at any time in Apple Health or Health Connect. Disconnecting only takes effect for the future; we delete values already stored together with your account or on request.

V. Use of the website www.stepmade.app

On www.stepmade.app we provide information about StepMade. In addition, you can complete a full onboarding process there - independently of the app - up to the purchase of a subscription. Users typically reach the website via online marketing. Downloading the StepMade app is only recommended after purchase. You can also access your customer account, payment links and - from within the app - individual purchase pages there.

The links to the App Store and Google Play on the website run via AppsFlyer OneLink (section VIII.4). We store your choice of light or dark design in your browser's local storage (Section 25(2) no. 2 TDDDG).

1. Onboarding questionnaire on www.stepmade.app

The onboarding questionnaire on www.stepmade.app corresponds in content to the app questionnaire described in section III.1. The same data categories are collected and the same legal bases apply as described there. The website does not access health data from Apple Health or Health Connect.

The data collected in the questionnaire is stored continuously - i.e. while you are filling it in - in the browser session storage and in Firebase (Firestore, region europe-west1) under a pseudonymous user ID. After registration, the questionnaire answers are linked to the permanent customer account so that the app starts with your plan. Without registration, the profile contains only the questionnaire answers and the technical user ID. Unregistered profiles that are not converted into a registered customer account within 30 days are deleted automatically.

2. Sign-in and authentication

You create your customer account after purchase with your first and last name, email address and password. You can sign in with email and password, with Apple or with Google (see section III.2), or via a single-use link or single-use code sent by email. If you open a page of www.stepmade.app from within the app (e.g. subscription management), we sign you in there automatically with your app account. Data processed: email address, name, authentication token, timestamp. Legal basis: Art. 6(1)(b) GDPR.

3. Subscription purchase and payment processing

On www.stepmade.app, subscriptions can be purchased and existing subscriptions managed (changing the payment method, cancellation with an optional reason, withdrawal). The data processed and the payment service providers used are described in section VII.

VI. AI-supported features

Where we create short coach texts in the StepMade app with the help of AI (e.g. a note on your progress today or on your next walk), we transmit input data to Google Ireland Ltd. (Vertex AI / Gemini), which acts as our processor. Processing takes place in data centres in the EU; Google does not use the data to train its own models.

Data transmitted: only numbers and categories about your plan, e.g. steps today, daily goal and remaining steps, planned and completed walks, walking minutes, programme week, weekly goals, break days, preferred time of day, type of day and the app language. We do not transmit your name, email address, weight or user ID. We store the generated texts in your profile in order to show them to you.

Legal basis: Art. 6(1)(b) GDPR (providing the coaching as part of the user agreement).

VII. Paid subscriptions and payment processing

When you book a paid subscription, we process the following, depending on the payment method:

• first and last name
• email address
• postal address (for invoicing)
• telephone number (optional)
• payment data (card brand, last 4 digits, expiry date; or IBAN and SEPA mandate; or PayPal billing agreement ID)
• shopping cart, selected plan, country, currency, promotional code

When you enter your address, we suggest matching addresses. For this purpose, we transmit your input to the Google Places API (Google Ireland Ltd.).

In certain countries, where offered there, we also offer purchases directly from us in the app instead of via the App Store or Google Play. Such purchases are processed via the same payment service providers as on the website.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract); for address suggestions Art. 6(1)(f) GDPR.

Payment service providers / stores

Depending on the payment method you choose and that we offer, your payment data is transmitted directly to the payment service provider or app store:

• Apple In-App Purchase - Apple Distribution International Ltd. (Ireland)
• Google Play Billing - Google Ireland Ltd.
• Stripe Payments Europe Ltd. (Ireland) - credit card, SEPA, Klarna, Apple Pay, Google Pay, bank transfer setup, payment links
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg)
• SEPA direct debit - usually directly via our bank (creditor ID DE16ZZZ00002707533); occasionally via GoCardless SAS (France)
• RevenueCat, Inc. (USA, Standard Contractual Clauses) - subscription management for app store purchases; data transmitted: pseudonymous user ID, AppsFlyer ID, Meta anonymous ID, Firebase app instance ID, device IDs (IDFV; IDFA or GAID only with your permission), Apple AdServices token, payment source, purchase events.

Apple and Google receipts are sent to the Apple App Store Server API or the Google Play Developer API for verification.

Payment reminders, dunning and debt collection

If a payment is not made, we remind you by email, by text message (if we have your phone number; sent via smsapi.pl, Poland) and, where applicable, by letter. To send physical letters, we use Pingen AG (Switzerland; adequacy decision of the European Commission), which forwards the letters to local postal service providers, and Deutsche Post AG (E-POST) (Germany). If payment arrears persist, we transmit the data required to enforce the claim (name, address, email address, contract and claim data) to Debtist GmbH (debt collection).

Legal basis: Art. 6(1)(b) GDPR (contract handling) and Art. 6(1)(f) GDPR (legitimate interest in enforcing outstanding claims).

VIII. Analytics, marketing and attribution

1. Cookies, similar technologies and consent management

What are cookies?

Cookies are small text files that are stored on your device when you visit a website or use an app. Similar technologies such as local storage, session storage and IndexedDB perform comparable functions. We use these technologies for the following purposes:

• Strictly necessary: authentication (Firebase Auth token), storage of your language, country and design settings, your consent choice, your onboarding answers during the session and the payment process (e.g. returning from Klarna). This processing does not require consent (Section 25(2) TDDDG).
• Subject to consent: the analytics, marketing and attribution services marked “yes” in the “Consent” column in sections VIII.2 to VIII.5. These are only activated after your consent.

You can delete cookies and local storage data at any time in your browser settings. Please note that deleting strictly necessary cookies may impair the functionality of our services.

Our consent and preference centres (CMP)

Before carrying out the processing subject to consent described in this section VIII, we obtain your consent via our consent and preference centres.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG (storing or accessing information on end devices).

A) In the StepMade app

In the StepMade app, we use the Google User Messaging Platform (UMP) of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. It complies with the IAB Europe Transparency & Consent Framework (TCF) version 2.2. No advertising is displayed in the StepMade app; the UMP is used exclusively to obtain your consent for analytics, marketing and attribution.

a) What the TCF is and how it works - The TCF is an industry-wide standard of the Interactive Advertising Bureau (IAB) Europe with which advertising and analytics providers uniformly declare their processing purposes and legal bases. In the consent banner, you can decide individually for each purpose and each vendor whether you consent. Your choice is stored on your device in a standardised TCF string and read by the integrated services so that they respect your choice.

b) Vendors displayed - The banner only displays the vendors that we actually use in the app (sections VIII.2 to VIII.5).

c) Processing purposes (TCF purposes) - TCF v2.2 distinguishes, among others: (1) store and/or access information on a device, (7) measure advertising performance, (8) measure content performance, (9) understand audiences through statistics, (10) develop and improve services. In addition, there are so-called special purposes (security, technical delivery), for which no consent is required under the TCF.

d) Consent versus legitimate interest - Some vendors state “legitimate interest” as the legal basis for individual purposes (Art. 6(1)(f) GDPR). You can object to this at any time in the banner. We do not pass on your data if you object - regardless of the legal basis stated by the vendor.

e) Withdrawal and accessing your settings again - You can withdraw your consent at any time with effect for the future or adjust your choice under:

Profile → Help → Privacy settings

The lawfulness of processing carried out before the withdrawal remains unaffected.

f) App Tracking Transparency (iOS) - On iOS, we additionally ask via Apple's ATT dialog whether we may use the advertising ID (IDFA) (see VIII.6).

g) Proof of your consent - We document the time and content of your consent so that we can demonstrate your consent as part of our accountability obligations (Art. 7(1) GDPR). The data stored for this purpose is retained for the duration of the consent and for up to three years after withdrawal or the last update.

B) On the website www.stepmade.app

When you first visit the onboarding and ordering pages on www.stepmade.app, you are informed about the services we use that require consent and can accept or reject them in full. If you reject them, the services requiring consent - in particular the analytics, marketing and attribution services listed in sections VIII.2 to VIII.5 and the associated cookies - are not activated.

Your choice is stored in the cookie stepmade_cookie_consent and in local storage for 360 days. You can change your choice at any time via the “Cookie settings” link in the footer.

The specific services listed below

We use the services listed in VIII.2 to VIII.5 only with your consent, unless they are technically necessary for the operation of the app. The “Consent” column shows which services this applies to. We first transmit usage events from the app and the website in encrypted form to our own backend and forward them from there - only within the scope of your consent - to the services listed below.

2. Product analytics and A/B tests

We use services without consent because they are strictly necessary for the stable and secure operation of the app (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).

3. Session recording

4. Mobile attribution

5. Direct and performance marketing

We are joint controllers with Meta Platforms Ireland Ltd. for the collection and transmission of data to Meta (Art. 26 GDPR). The essential content of the agreement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent processing.

The storage period at these providers is determined by their own policies; according to Meta, TikTok and Google, hashed matching data (e.g. email address) is used only for matching and deleted afterwards.

6. Advertising ID (IDFA / GAID)

On iOS, you are shown Apple's App Tracking Transparency (ATT) dialog. If you do not grant permission, the IDFA is not used; conversion measurement then takes place exclusively in anonymised form via Apple SKAdNetwork / AdAttributionKit. On Android, you can reset or disable your advertising ID at any time in the Google system settings.

IX. Communication

Reminders and push notifications

• We schedule reminders about your daily plan, your walks, an evening note and the weekly weigh-in locally on your device; no data is transmitted to us for this.
• For the technical delivery of push notifications sent from our servers, we use Firebase Cloud Messaging (FCM, Google Ireland Ltd.) and the Apple Push Notification Service (Apple Distribution International Ltd.).

We only send notifications after you have actively allowed them. You can switch off individual reminders under “Profile → Reminders”, and all of them together in your device's system settings.

Transactional emails

• Mailgun (EU) - Sinch Email (EU) AB / Sinch Holdings, sent via api.eu.mailgun.net: purchase confirmations, invoices, sign-in links, password resets, payment reminders
• Firebase Authentication (Google Ireland Ltd.): confirmation of your email address and password resets

SMS

• smsapi.pl (Poland) - sending reminder, confirmation and payment reminder text messages

Letters

• Pingen AG (Switzerland) - sending payment reminders and dunning letters
• Deutsche Post AG (E-POST) (Germany) - sending payment reminders and dunning letters

Legal basis: Art. 6(1)(b) GDPR for transactional communication and reminders about your plan; Art. 6(1)(a) GDPR for promotional notifications and text messages; consent can be withdrawn at any time.

X. Transfers to third countries

Where data is transferred to countries outside the EU/EEA without an adequacy decision (in particular the USA and the United Arab Emirates), we conclude the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 with the respective recipients and supplement them - where necessary - with additional technical measures (encryption, pseudonymisation). Where a recipient is certified under the EU-U.S. Data Privacy Framework, we base the transfer on the adequacy decision of the European Commission.

We transfer pseudonymous campaign and attribution data to a service provider in the United Arab Emirates that supports us in running our marketing campaigns (Standard Contractual Clauses).

You can request a copy of the respective safeguards from the controller (contact details in section I).

XI. Retention periods, deletion and blocking

We process your personal data only for as long as is necessary to achieve the stated purposes or as statutory retention obligations apply (in particular Section 257 German Commercial Code, Section 147 German Fiscal Code - 6 to 10 years).

In particular, the following periods apply:

• Customer account and usage data (plan, daily values, walks, weight entries, coach texts): until you delete your account, then deletion within 30 days unless statutory retention obligations apply
• Unregistered onboarding profiles (website): 30 days after creation unless converted into a registered customer account
• Invoice and tax data: 10 years (Section 147 German Fiscal Code)
• Terminations and withdrawals: 6 years from the end of the year (Section 257 German Commercial Code, business correspondence)
• Log files: 30 days
• Crashlytics data: 90 days
• Analytics data (Firebase Analytics, Google Analytics 4): 14 months
• Analytics data (Amplitude): up to 25 months
• Session recordings (Amplitude Session Replay): 90 days
• Cookie consent on the website: 360 days; marketing cookies _fbp, _fbc, _ttp: 90 days
• Marketing consents: until withdrawn, after which the consent itself is archived for 3 years for evidentiary purposes
• Support requests: 3 years from the end of the year in which the request was closed
• Push tokens: until the device is unregistered, the permission is revoked or the account is deleted

You can delete your account at any time in the app under “Profile → Delete account”. Deletion covers your personal data stored in our systems. Where third-party service providers keep their own copies of data as part of our processing (e.g. payment service providers, analytics and attribution services), deletion there takes place in accordance with the respective retention periods of these providers or upon your separate request. Statutory retention obligations (in particular invoice and tax data, 6-10 years) remain unaffected. You manage data that the app has written to Apple Health or Health Connect there. Deleting your account does not end an ongoing subscription: you cancel store subscriptions in the App Store or on Google Play, and web subscriptions in your customer account on www.stepmade.app.

XII. Rights of data subjects

You have the following rights towards us:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object (Art. 21 GDPR)
• right to withdraw consent at any time (Art. 7(3), Art. 9(2)(a) GDPR), without affecting the lawfulness of processing carried out before the withdrawal
• right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The competent supervisory authority for Fastic GmbH is the Berlin Commissioner for Data Protection and Freedom of Information.

You can obtain information about the data stored about you, and a copy of your data in a common, machine-readable format, by sending a request to datenschutz@stepmade.app.

Obligation to provide data

You are not obliged to provide us with personal data. However, without certain information we cannot provide individual services: without onboarding information we cannot create a personal plan, without registration (email address or Apple or Google account) we cannot provide a subscription, and without payment and billing data we cannot conclude a paid contract. Without a connection to Apple Health or Health Connect, your plan works with estimated values.

Automated decisions

Your plan, and in particular your weekly step goal, is calculated and adjusted automatically based on your information and your steps in the previous week. This is not a decision with legal effects within the meaning of Art. 22 GDPR; you can change your plan yourself at any time.

Children and young people

StepMade is intended for persons aged 18 and over. Use by persons aged 16 and 17 is only permitted with the consent of a parent or legal guardian. Persons under 16 may not use StepMade. Paid contracts may only be concluded by persons of full age. We do not knowingly collect personal data from persons under 16. If we become aware that personal data of a person under 16 has been collected without the required consent, we will delete it without undue delay. Please send any such information to datenschutz@stepmade.app.

Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on a balancing of interests pursuant to Art. 6(1)(f) GDPR; this also applies to profiling based on these provisions. In this case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You have the right to object at any time to the processing of your personal data for direct marketing purposes, with the result that the data will no longer be processed for these purposes.

This privacy policy is available in several languages. In the event of discrepancies, the German version shall prevail.