Privacy Policy

Last updated: July 21, 2026

Steel Toe Technologies, Inc. (“Steel Toe,” “we,” “us”) respects your privacy. This Privacy Policy explains what personal data we collect through the website at studio.steeltoetech.com and our services, how we use it, who we share it with, and the choices you have.

What this policy covers — and what it does not

This policy covers data we handle as a controller — that is, where we decide why and how it is processed. That means website visitors, prospects, contacts, and the administration of client accounts.

It does not cover data you ask us to process on your behalf during a paid engagement. There we act as a processor on your instructions, and that processing is governed by your Statement of Work and our Data Processing Agreement, not by this policy.

Where we build on infrastructure you own, our processor role ends at handoff: once the system runs in your accounts, you control and operate it, and we no longer process that data at all. Where we host for you, or support you under a retainer, we remain a processor for as long as that continues.

1. Data we collect

  • Quote and intake submissions — your name, email, company, and the project details you provide when requesting a quote or contacting us.
  • Account data — authentication and profile information managed through our auth provider (Clerk) when you create an account or client portal login.
  • Payment data — billing details and transaction metadata processed by our payment provider (Stripe). We do not receive or store full payment card numbers.
  • Usage and analytics data — pages viewed, referring links, approximate location, device and browser information, and interactions, collected to understand and improve the product (PostHog).
  • Diagnostic data — error and performance telemetry used to keep the service stable (Sentry).

2. How we use your data

  • To respond to your inquiries and prepare quotes and proposals.
  • To provide, operate, secure, and support the services you request.
  • To process payments and send transactional email (for example, receipts and project updates).
  • To analyze and improve the Site and our services.
  • To comply with legal obligations and enforce our agreements.

AI processing. We use third-party AI providers (currently Anthropic) in our delivery pipeline — for discovery, code review, requirements interviewing, and build assistance. Where information you send us is processed by one of these providers, we use only enterprise or commercial terms under which your data is not used to train their models, and a qualified human reviews AI-assisted output before it is delivered. Our AI Use Policy explains this in full.

We rely on your consent, the performance of a contract with you, and our legitimate interests in operating and improving our business as the legal bases for these uses, depending on your jurisdiction. We do not sell your personal data.

3. Sharing and sub-processors

We share personal data with service providers who process it on our behalf under contractual confidentiality and security obligations. Our current sub-processors include:

  • Anthropic — ai model inference for agent workflows (discovery, review, interview, build)
  • Clerk — authentication and account management
  • Stripe — payment processing
  • Vercel — website and application hosting, and cookieless web analytics
  • Neon — database hosting
  • PostHog — product analytics
  • Sentry — error and performance monitoring
  • Resend — transactional email delivery

A current, itemized list — including each sub-processor’s purpose and processing location — is maintained on our Sub-processors page. Business customers who need a Data Processing Agreement can request ours at contact@steeltoetech.io; it covers sub-processor notice, security measures, breach notification, and standard contractual clauses for international transfers.

We may also disclose data if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets.

4. Data retention

We retain personal data for as long as needed to fulfill the purposes described here — to provide services, meet legal and accounting obligations, and resolve disputes — and then delete or anonymize it. Retention periods vary by data type and legal requirement; as general guidance:

  • Quote and contact submissions — up to 24 months from your last interaction, unless you ask us to delete them sooner.
  • Account data — for the life of your account and a reasonable period after closure to meet legal obligations.
  • Payment and invoicing records — as required by tax and accounting law (typically up to 7 years).
  • Analytics and diagnostic data — retained in aggregated or pseudonymized form on a rolling basis (generally up to 14 months).

5. International transfers

We and our sub-processors may process data in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers of personal data.

6. Security

We use technical and organizational measures — including encryption in transit, access controls, and reputable infrastructure providers — to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email contact@steeltoetech.io. We will respond within the time required by applicable law (generally within 30 days). You may also have the right to lodge a complaint with a supervisory authority.

8. California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to know what personal information we collect and how we use and disclose it, to request access to or deletion of that information, to correct inaccurate information, and to be free from discrimination for exercising these rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information beyond the purposes permitted under the CPRA. To exercise any California right, email contact@steeltoetech.io; we will verify your request and respond within the time the law allows. You may use an authorized agent to submit a request on your behalf.

9. Cookies and analytics

We use a small number of strictly necessary cookies to keep you signed in and remember preferences; these are required for the Site to work. For analytics, we operate on an opt-in basis: our product-analytics cookies (PostHog) do not load until you accept them in the cookie banner. If you decline, no analytics cookies are set. You can change your choice at any time by clearing this site’s data in your browser, which will bring the banner back. Disabling strictly necessary cookies may affect how the Site functions.

10. Children

The Site and services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice.

12. Contact

For any privacy question or request, contact us at contact@steeltoetech.io.