Steppe Stone Capture
Privacy Policy
Tester version · Last updated 5 November 2026
This is the version for our first testers. It describes how Steppe Stone Capture works today. We will review and update it before Capture opens to the public. Questions? Write to support@steppeandstone.one.
1. Who we are
Steppe Stone Capture ("Capture") is operated by Steppe and Stone FZ-L.L.C, a company registered in the Meydan Free Zone, Dubai, United Arab Emirates ("we", "us"). We are responsible for the personal data described here. You can reach us at support@steppeandstone.one.
2. What we collect
• Account details: your name, email address and sign-in details. • Waitlist answers: your email and what you tell us about how you travel. • Receipts: the photos and PDFs you add, and what Capture reads from them, such as vendor, date, amount, currency, category and items. Receipts can contain other details, like part of a card number or an address. • Trips and reports: trip names and dates, cash entries, self-made receipts, notes and the reports you create. • Settings: your home currency and app preferences. • Technical data: IP address, browser and device type, and error logs we need to run and protect the app.
3. How we use it
• To run Capture for you: read your receipts, convert currencies, sort expenses into trips and build your reports. • To save copies of your receipts and your spreadsheet to your own Google Drive and Sheets. • To manage the waitlist and tester access, and to contact you about your account, changes and support. • To fix bugs and improve Capture, including with the feedback you send us. • To keep Capture secure and to meet legal obligations. We do not sell your data, and we do not use it for advertising.
4. Services we use
We share data only with the services that run Capture for us: • Replit hosts the app. Your account and expense data sit in Replit's PostgreSQL database, and your receipt photos and PDFs in Replit App Storage. • Clerk handles sign-in and account security. • OpenAI reads your receipt images to pull out the details, through Replit's AI integration. Under OpenAI's API terms, this data is not used to train their models by default. • Google: Capture needs a Google account. It saves your receipt copies and spreadsheet in your own Google Drive and Sheets. Waitlist answers are stored in a Google Sheet in Steppe & Stone's Google account. • Exchange rates come from the European Central Bank (via Frankfurter) and the Central Bank of the UAE. We only send currencies and dates, never personal data. We may also share data when the law requires it, or with a buyer if our business is ever transferred, under the same protections.
5. Where your data goes
These services may process data in the United States, the European Union and other countries. Where the law requires it, we rely on safeguards such as the standard contractual clauses these providers offer.
6. Our legal basis
Where laws such as the GDPR apply, we process your data: • to provide the service you signed up for (contract), • to keep Capture secure and improve it (legitimate interests), • with your consent, for example for the waitlist and access to your Google Drive. You can withdraw consent at any time, • and to meet legal obligations.
7. How long we keep it
• Account data, receipts and reports: as long as your account is open. If you delete your account, we delete this data straight away. Backups are cleared within 90 days. • Waitlist answers: until you join or ask us to remove them, and at the latest 12 months after the tester phase ends. • Copies in your own Google Drive stay there until you delete them. We cannot delete them for you. • Records we must keep by law are kept as long as the law requires.
8. Your rights
Wherever you live, you can ask us to: • show you the data we hold about you, • correct it, • delete it, • give you a copy to take elsewhere, • stop or limit certain uses of it. Email support@steppeandstone.one and we will reply within 30 days. If you are in the EU or UK, you can also complain to your local data protection authority. In the UAE, you can contact the UAE's data protection authority.
9. Security
Data is encrypted in transit, access is limited to people who need it, and we only use the established providers listed above. Capture is still in its tester phase, and no system is completely secure, so please do not upload passports or ID cards, full card numbers, bank statements or health documents. If a breach puts your data at risk, we will tell you without undue delay, and inform the authorities where the law requires it.
10. Cookies
Capture uses only the cookies it needs to sign you in and keep the app working. We do not use advertising or tracking cookies.
11. Children
Capture is not meant for anyone under 16, and we do not knowingly collect their data.
12. Changes
This policy will change as Capture grows. We will update the date at the top, and tell you by email or in the app before any important change.
13. Contact
Steppe and Stone FZ-L.L.C Meydan Free Zone, Dubai, United Arab Emirates support@steppeandstone.one