Stepup is an AI-powered customer-conversation platform that unifies WhatsApp, Instagram, Messenger, Telegram, TikTok and Web Chat into a single AI inbox, with broadcasts, analytics and CRM, in Arabic and English, for businesses across the GCC. This Privacy Policy explains what information we collect, how we use and protect it, and the rights you have over your data when you use our website and services at stepuphub.cloud. By using Stepup, you agree to the practices described below. We last updated this policy on 12 June 2026.

Introduction and Scope

This policy applies to the Stepup website, dashboard, AI inbox and all related services operated from Dubai, United Arab Emirates. It governs data we process about business customers who subscribe to Stepup, the team members they invite, website visitors, and the end customers whose messages flow through the platform. Where we handle data on behalf of a business customer, that business is the data controller and Stepup acts as a data processor under their instructions. If you do not agree with this policy, please discontinue use of our services.

Information We Collect

We collect account information you provide when registering, such as your name, business name, email address, phone number and billing details. Through the platform we process conversation content, contact lists, customer profiles and message metadata across the channels you connect. We also automatically collect technical data including IP address, device and browser type, log files and usage statistics that help us operate and improve the service. We do not intentionally collect special categories of sensitive personal data unless you choose to share them within your conversations.

How We Use Information

We use your information to provide, maintain and secure the Stepup platform, to route and respond to conversations, and to power AI features such as automated replies, suggestions and analytics. We use contact and billing data to manage subscriptions, process payments and send service-related notices. Aggregated and de-identified data may be used to monitor performance and improve our models and features. We will only send marketing communications where you have consented or where permitted by applicable law, and you can opt out at any time.

WhatsApp Business API and Meta Data

Stepup operates on the official Meta WhatsApp Business API, as well as the Instagram, Messenger and other Meta platform integrations you choose to connect. When you link these channels, we process messages and profile data in accordance with Meta's Platform Terms, Developer Policies and the WhatsApp Business Messaging Policy. We use this data solely to deliver the inbox, automation and analytics features you have enabled, and we do not sell it or use it for purposes incompatible with Meta's requirements. You are responsible for obtaining any consents required from your own customers before messaging them.

Cookies and Tracking

Our website and dashboard use cookies and similar technologies to keep you signed in, remember your preferences and understand how the service is used. We rely on essential cookies for core functionality and, with your consent, analytics cookies to measure performance and improve the experience. You can manage or disable non-essential cookies through your browser settings or our cookie banner, though some features may not work correctly without them. We do not use cookies to build advertising profiles of your end customers.

Data Sharing and Processors

We do not sell your personal data. We share information only with trusted sub-processors who help us run the service, including cloud hosting and infrastructure providers, payment processors, messaging gateways, and the CRM and business tools you choose to integrate. Each sub-processor is bound by contractual obligations to protect your data and process it only on our instructions. We may also disclose information where required by law, to protect our rights, or in connection with a corporate transaction such as a merger or acquisition.

Data Security

We apply technical and organizational safeguards designed to protect your data, including encryption in transit, access controls and isolated tenancy so that each business's data is kept separate from others. Access to production systems is restricted to authorized personnel on a need-to-know basis and is logged and monitored. While we work hard to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected users and relevant authorities of any data breach as required by applicable law.

International Transfers and GDPR

Stepup operates from the UAE and may process and store data on cloud infrastructure located in different countries, including outside the GCC and the European Economic Area. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms to ensure an adequate level of protection. For individuals in the EEA and UK, we process personal data in line with the GDPR and UK GDPR, relying on lawful bases such as contract performance, legitimate interests, legal obligation and consent. We comply with applicable UAE and GCC data protection laws as well.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, update or delete your personal data, to restrict or object to certain processing, and to request a portable copy of your data. You may also withdraw consent at any time where processing is based on consent, without affecting prior lawful processing. To exercise these rights, contact us at stepupagentcode@gmail.com, and we will respond within the timeframes required by law. Where Stepup acts as a processor for a business customer, we will direct end-customer requests to the relevant business and assist them in responding.

Data Retention and Contact

We retain personal data only for as long as necessary to provide the service, comply with legal and accounting obligations, resolve disputes and enforce our agreements. Conversation and account data is kept for the duration of your subscription and deleted or anonymized within a reasonable period after account closure, unless a longer retention period is required by law. For any questions, requests or concerns about this Privacy Policy or your data, contact us at stepupagentcode@gmail.com or write to Stepup, Dubai, United Arab Emirates. We may update this policy from time to time and will post the revised version on stepuphub.cloud with a new effective date.