Privacy Policy
I. Who we are
Step Financial LLC (“Step,” “we”, “our”, or “us”) is a financial services company. Our platform helps our customers use and manage their money, and provides tools to help improve financial well-being. When you use these services, you’ll share some information with us that could be used to identify you or that is associated with information that identifies you (“Personal Information”). We want to be clear about the information we collect, how we use it, and whom we share it with. This Privacy Policy applies to Personal Information that we gather or collect via our website (the “Website”) or our mobile app (the “App”) (our Website and App collectively, our “Services”). It does not apply to any Personal Information collected by third-party websites not operated by Step.
This Privacy Policy applies to information collected from users of our Services, including those who are under the age of 18 (“U18 Users” or “Sponsees”), adult sponsors of U18 Users or individual adult users (“Sponsors”), and users of our App who are under the age of 13 (“U13 Users”). Additional information about our privacy practices specific to U13 Users and their Sponsors is available here. Additional privacy information for Sponsors is available here.
This Privacy Policy is incorporated into our Terms of Service.
If after reading this Privacy Policy you still have questions about anything in it, please contact us at privacy@step.com.
II. The information we collect
The Personal Information we collect includes:
Information you provide to us
Communication information you share when you reach out to us and use our Services
Technical information we automatically collect. We use cookies and similar technologies to collect Personal Information automatically as you navigate our Services. For additional information regarding our use of these technologies, see the Cookies and Analytics Technologies section below.
Personal Information provided to us through third parties, including, but not limited to, business partners, advertising networks, social networks, data analytics providers, mobile device providers, Internet or mobile service providers, recruiters and job application portals, and background check providers.
Identification Information you provide to us
When you use our Services, we collect identification information that you choose to share with us. When you set up an account with us, we need to collect a few important details about you. For Sponsors we collect your name, address, Social Security number, a unique username you would like to use for our Services, your phone number, your email address, your date of birth, a photograph of your face, a copy of your government-issued identification, and your hand-written signature. App users can also elect to share their contacts to help them easily identify other Step users. Certain components of our Services may require you to provide us with additional information. For example, our securities investing and direct deposit features may require you to provide us with additional information about your income and employment.
For U18 Users, we collect the information set forth in the “Use of the Services By Children” section below.
Communication Information
When you contact customer support or communicate with us in any other way, including by voluntarily responding to questionnaires, contests, surveys or requests for market research seeking your opinion and feedback, we’ll collect whatever information you volunteer, in addition to your name and email address, and in certain cases we may use third-party service providers to do so. Where permitted by applicable law, we may collect and maintain records of calls and chats with our agents, representatives, or employees via message, post, or similar functionality.
Commercial Information
If you submit an inquiry, or provide information on our Services, we may collect commercial information, including information about your purchases, subscriptions, and Services you have shown interest in, including, but not limited to, information about your accounts, cards, money transfers, points, and credit.
Employment Information
If you apply for employment with us, we will collect Personal Information related to your potential employment, including your education and employment history, address and contact information, demographic information, and any other information included in your resume or application.
Technical Information
When you use our Services, we automatically record information about which Services you’ve used and how you’ve used them. Examples of this information include:
Usage information on our Website or App (e.g., pages you visit on the Website, webpage from which you linked to our Website, duration of Website visit, App logins, features used, actions performed, and transactions conducted);
Time and date of your activities;
Your IP address;
Location Information:
When you browse the Site, we collect an estimate of your location through your IP address
When you use the App, we collect your Location Information through your device IP address, WiFi, Bluetooth, and, when you have enabled geolocation tracking, GPS coordinates (e.g., latitude/longitude) of your mobile device in order to help you locate in-network ATMs, enhance safety, and to detect and prevent fraud. If you have given the App permission to access your location, we will collect your device’s location as permitted by the settings you choose. If you want to opt out of the collection of your location information, please adjust your settings in your mobile device.
Device ID;
The kind of browser and computer you use;
Name of your internet service provider; and
Operating system version.
Personal Information Provided to Us Through Third Parties
We may collect Personal Information about you from other users, our affiliates, and third parties, as permitted by law, as follows:
Contact Information. Users who use our “Invite Friends” feature may provide us with your name and phone number in order for us to send you an invitation to download and use our App.
Identity Verification Information. We may collect Personal Information from third-party verification services, including biometric identity verification service providers, credit bureaus, financial institutions, mailing list providers, and publicly available sources to verify your identity. We may also collect information about you from third parties in connection with fraud detection process, or collection procedure, or as may otherwise be required by applicable law.
Social Media Information. We have pages and accounts on social media sites like Instagram, Facebook, TikTok, Twitter, YouTube, and LinkedIn (“Social Media Pages”). When you interact with our Social Media Pages, we will collect Personal Information that you elect to provide to us through those channels, such as your username and contact details. In addition, the companies that host our Social Media Pages may provide us with aggregate information and analytics regarding the use of our Social Media Pages.
Financial Information. When you link a deposit account, Step uses Plaid Inc. (“Plaid”) to gather your data from financial institutions. By using the Services, you grant Step and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from your relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy. If you choose to use our stock investing services, we partner with Drivewealth to provide you with stock investment services after you independently agree to their terms of service and privacy policy.
Advertising Information. We partner with Impact Tech, Inc., who may collect personal information when you interact with third-party sites from which you are linked to our Website. The collection and use of this information is subject to Impact's privacy policy: https://impact.com/privacy-policy/.
III. How we use your information
Personal Information
To provide the Services: Step may use your Personal Information to fulfill requests for products, Services, or information, including information about potential or future Services, including to:
Manage individual information and accounts;
Respond to questions, comments, and other requests;
Verify your identity;
Process payments and other financial transactions;
Process applications;
Communicate with you, including via SMS messaging. Note that we do not share your phone number with affiliates or third parties for their own marketing or promotional purposes. For more information, see our Mobile Terms;
Perform transfers, trades, and purchases that you request;
Provide access to certain benefits, functionalities, and features of our Services; and
Allow you to register for events.
For internal business purposes: Step may use Personal Information for its internal business purposes, including to:
Measure interest in Step’s Services;
Develop new products and Services or improve existing products and Services;
Ensure internal quality control;
Communicate about individual accounts and activities on Step’s Services and systems, and, in Step’s discretion, changes to any Step policy;
Comply with regulatory requirements;
Prevent potentially prohibited or illegal activities;
Enforce our Terms of Service;
Conduct interviews, surveys, and test features
Protect the safety of any person, to address fraud, security or technical issues, or to protect the Company’s rights or property;
Comply with applicable laws, rules and regulations or court orders; and
For any other purpose for which you have given express permission or consent to Step.
For marketing purposes: Step may analyze and use Personal Information to provide you with materials about offers, products, and Services from Step that may be of interest to you. Step may provide you with these materials by phone, postal mail, email, or otherwise as permitted by applicable law. Such uses include:
To tailor content, advertisements, and offers;
To notify you about offers, products, and services that may be of interest to you;
To provide Services to you;
For other purposes disclosed at the time you provide Personal Information; and
Otherwise, with your consent.
We also use Personal Information to conduct interest-based advertising as discussed in the Cookies and Analytics Technologies section below. You can unsubscribe from any marketing emails or text messages that we may send you by following the instructions included in the email or text correspondence or emailing us at privacy@step.com.
As part of a corporate transaction: such as in connection with the sale of part or all of our assets or business, the acquisition of part or all of another business or another business’ assets, or another corporate transaction, including bankruptcy.
For employment purposes: If you are applying for employment with us, we also use Personal Information to process your job application, to verify the information you have provided in your application, conduct interviews, perform background and reference checks, to communicate with you and answer your questions, to confirm your eligibility for employment, and improve our recruiting processes. We may also save your Personal Information for future employment opportunities with us.
Non-personal Information
We may also use information that does not personally identify you, including by aggregating and/or de-identifying Personal Information, in order to understand better how our visitors use the Services, research our visitors’ demographics, interests, and behavior, improve the Services, and for other similar purposes. We may share this information with others for information or promotional purposes, and may use non-personal information in any manner permitted by law.
VI. How long we keep your information
We will retain your information for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our products and Services, resolve disputes, establish legal defenses, conduct audits, enforce our agreements, and comply with applicable laws or regulations.
Criteria we will use to determine how long to retain your Personal Information include the nature and length of our business relationship with you; our legal rights, obligations, and retention requirements; and if we have an ongoing business purpose for retaining your Personal Information, such as communicating with you about ongoing or prospective Services you requested.
External Websites
Our Services may contain links to other websites and other websites may reference or link to our Services. These websites are operated by third parties not controlled by us, and by linking to them or being linked from them Step does not endorse, approve or make any representations about third party websites or domains. We encourage you to read the privacy policies of each and every website and domain that you interact with. We are not responsible for the privacy practices or content of such other websites or domains and you visit them at your own risk.
Social Media
Our Services may contain links and interactive features with various social media platforms. Any content you post via these social media pages is subject to the Terms of Use and Privacy Policies for those platforms. If you already use these platforms, their cookies may be set on your device when using our Services. You should be aware that Personal Information which you voluntarily include and transmit online in a publicly accessible social media platform, blog, or chat room, or otherwise online, or that you share in an open forum, may be viewed and used by others without any restrictions. We have no control over such uses of your information when interacting with a social media platform, forums or otherwise online and by using such services you assume the risk that the Personal Information provided by you may be viewed and used by third parties.
Security
Step takes commercially reasonable steps designed to protect the data you have given us from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. However, please be aware that no transmission of Personal Information over the Internet or the electronic storage of this information can be absolutely guaranteed to be free from unauthorized use or access. Before submitting any Personal Information via the Services, please keep in mind these risks and know that you do so at your own risk.
International Use and Cross-Border Data Transfers
If you are visiting our Services from outside of the United States, please note that our Services are hosted in the United States. Where permitted by applicable law, we may transfer the Personal Information we collect about you to the United States and other jurisdictions that may not be deemed to provide the same level of data protection as your home country, as necessary for the purposes set out in this Privacy Policy.
VII. Your choices
Depending on where you live, you may have the following rights with respect to your Personal Information under applicable data protection laws:
Access – The right to request access to and obtain a copy of any Personal Information we may have about you.
Deletion – The right to delete your Personal Information that we have collected or obtained, subject to certain exceptions.
Correction – The right to request that we correct any inaccuracies in your Personal Information, subject to certain exceptions.
Opt Out of Certain Processing – The right to: (a) opt out of the processing of your Personal Information for purposes of targeted advertising, (b) opt out of the sale or sharing of your Personal Information; (c) limit the use of your sensitive Personal Information (if applicable), and (d) opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not collect or process sensitive Personal Information outside of purposes permitted by law (such as section 7027(m) under the California Consumer Privacy Act Regulations), so we do not offer the option to limit its use. We also do not profile you or other individuals in a manner that would result in legal or similarly significant effects, so we do not offer an opt out.
Objection/Restriction of Processing – The right to object or restrict us from processing your Personal Information in certain circumstances.
Withdraw Consent – The right to withdraw your consent where we are relying on your consent to process your Personal Information.
Automated Decision-Making – The right to know when you are subject to automated decision-making, the Personal Information used to render the decision, the principal factors and parameters involved in the decision, and human review or correction of the decision (or its underlying data, where appropriate). You may also have the right to consent or opt out of this automated decision-making, depending on your location.
Lodge a Complaint – The right to lodge a complaint with a supervisory authority or other regulatory agency if you believe we have violated any of the rights afforded to you under applicable data protection laws. We encourage you to first reach out to us so we have an opportunity to address your concerns directly before you do so.
To exercise any of the privacy rights afforded to you under applicable data protection laws, e-mail us at privacy@step.com, or call us at 1-888-378-6023. You may also exercise your opt out rights by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC). We honor Opt-Out Preference Signals, including GPC. If you choose to use an Opt-Out Preference Signal, you will need to turn it on for each supported browser or browser extension you use.
You will not be discriminated against in any way by virtue of your exercise of the rights listed in this Notice. However, should you withdraw your consent or object to processing of your Personal Information, or if you choose not to provide certain Personal Information, we may be unable to provide some, or all, of our Services to you.
Only you, or an authorized agent that you authorize to act on your behalf, may make a request related to your Personal Information. You may also make a request on behalf of your minor child. We must verify your identity before fulfilling your requests, and if we cannot verify your identity, we may request additional information from you. If you are an authorized agent making a request on behalf of another person, we will also need to verify your identity, which may require proof of your written authorization or evidence of a power of attorney. We endeavor to respond to requests within the time period required by applicable law. If we require more time, we will inform you of the reason and extension period in writing.
We do not charge a fee to process or respond to your requests unless they are excessive or repetitive. If we determine that a request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We may deny certain requests, or only fulfill some in part, as permitted or required by law. If you are not satisfied with the resolution of your request and you are afforded a right to appeal such decision, you will be notified of our appeal process in our response to your request.
Communications Preferences
If you no longer want to receive marketing emails from us, you can use the “unsubscribe” link found at the bottom of the email to opt out of receiving future emails. You will continue to receive transaction-related emails regarding products or services you have requested.
Sharing Preferences
We may give you choices regarding the sharing of your information with affiliates and third parties. Choices you have about the sharing of your information will be described in the privacy policies or notices you receive in connection with specific Services you obtain from us.
Other Requests
If you wish to terminate your Step account or delete your data, you can contact us at privacy@step.com or initiate a request within our App.
VIII. Changes to this privacy policy
We may change this Privacy Policy from time to time. If we do, we will post the revised policy on this page with a new “Last Updated” date. All changes will become effective when posted unless indicated otherwise. If we make any material changes, we will notify you in accordance with applicable law. You are responsible for periodically visiting our Website and this Privacy Policy to check for any changes.
IX. Use of the services by children
Our Website is not intended for children under the age of thirteen. Children under the age of thirteen are permitted to use our App with their parent or guardian’s consent. Where we determine that an individual attempting to set up a Step account is a U13 User, we will ask for that U13 User’s parent or guardian’s contact information in order to obtain verifiable consent before allowing that U13 User to use our Services.
What Information Does Step Collect from Children and How Is It Used?
To participate in our Services, U18 Users and their Sponsors must create an account using the App. We ask all U18 Users to provide us with the phone number of their Sponsor, so we can notify the Sponsor of the U18 User’s interest in Step, request consent for the U18 User to use our Services and provide us with their personal information, and authorize the Sponsor to oversee the U18 User’s account.
We request personal information from U18 Users that is reasonably necessary for their use of the Services, including their name, date of birth, phone number, email address, and mailing address. We also collect technical information and utilize cookies and analytics technologies when U18 Users engage with our Website. When we collect Personal Information from U18 Users, we will retain that information only as long as reasonably necessary to fulfill the purpose for which it was provided, ensure the security of our users and our Services, or as required by law.
Parents or legal guardians of U18 Users older than thirteen who are not their child’s Sponsor can contact us at privacy@step.com to request the identity of their child’s Sponsor. Parents or legal guardians of U13 Users can contact us at privacy@step.com to request access to and review of the Personal Information we have collected about their child, update their child’s information, request deletion of their child’s information, or ask that we restrict further collection or use of their child’s information. In the event we discover we have collected information from a U13 User in a manner inconsistent with applicable law, we will either delete the information or promptly seek consent from a parent or legal guardian. Please note that our deletion of your child’s information means that they will no longer be able to have a Step account or otherwise use our Services.
For more information, see our Children’s Privacy Statement.
X. California residents
Under California Civil Code Section 1798.83 (California's “Shine the Light” law), California residents with an established business relationship with us can annually request that we provide them with information about the Personal Information we have shared with third parties for those third parties' own direct marketing purposes. Step does not share Personal Information with third parties for their own direct marketing purposes. If you would like to request more information under California’s “Shine the Light” law, you can contact us as detailed in the “Contact Us” section below.
This section provides additional information regarding Step’s practices pursuant to the California Consumer Privacy Act of 2018 and its implementing regulations, as amended by the California Privacy Rights Act (“CCPA”), where “Personal Information” has the definition set forth in the CCPA.
Please see the below chart for detailed information about the categories of Personal Information we have collected from California residents during the twelve months preceding the date on which this Notice was last updated and the categories of third parties to whom we sell or share Personal Information. For each category of Personal Information set forth in the chart below, the categories of third parties to whom we disclose it for a business or commercial purpose are set forth in the How We Disclose Personal Information section above.
Personal Information Category set forth in Cal. Civ. Code § 1798.140
| Categories of Third Parties to Whom We Sell or Share Personal Information |
Personal identifiers, including real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, or other similar identifiers.
| Third-party marketers, analytics providers and other third parties that set cookies and other online tracking technologies on our Services. |
California Customer Records Personal Information (Cal. Civ. Code § 1798.80(e)), including name, signature, physical characteristics or description, address, telephone number, education, employment, employment history, etc.
| We do not sell or share this category of Personal Information. |
Characteristics of protected classifications under California or federal law. This may include age, veteran status, accommodations information, gender identity and expression, sexual orientation, and religion.
| We do not sell or share this category of Personal Information. |
Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
| Third-party marketers, analytics providers and other third parties that set cookies and other online tracking technologies on our Services. |
Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information about individual interactions with an Internet website, application, or advertisement.
| Third-party marketers, analytics providers and other third parties that set cookies and other online tracking technologies on our Services. |
Geolocation data, such as your IP address. | Third-party marketers, analytics providers and other third parties that set cookies and other online tracking technologies on our Services. |
Sensory data including audio, electronic, visual, thermal, olfactory, or similar information.
| We do not sell or share this category of Personal Information. |
Professional or employment-related information.
| Third-party marketers, analytics providers and other third parties that set cookies and other online tracking technologies on our Services. |
Non-public education information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99)
| We do not sell or share this category of Personal Information. |
Inferences drawn from any of the information categories to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
| Third-party marketers, analytics providers and other third parties that set cookies and other online tracking technologies on our Services. |
Sensitive Personal Information as set forth in Cal. Civ. Code § 1798.140, including social security number, driver’s license number, state identification card, or passport number; citizenship or immigration information; racial or ethnic origin; account access credentials (like usernames or account numbers combined with password or other security/access code to access an account); precise geolocation.
| We do not sell or share this category of Personal Information. |
Financial Incentives
From time to time, we may offer you programs, benefits, and other offerings that may be considered a “financial incentive” as defined by the CCPA. You can opt into the financial incentive by submitting personal information, to include personal identifiers such as name, phone number, and email address.
While we do not assign a monetary value to the data that we collect, based on our reasonable estimate, the value you received in connection with the financial incentive is reasonably equal to or greater than the value we receive from the use of the personal information you provide. We use this information to improve our products, services, and customer experiences.
Participation in these financial incentives is optional and you can withdraw your participation at any time. If you subsequently wish to withdraw from the financial incentive, you may do so by emailing us at privacy@step.com.
If you opt out, we will not reduce the value of any financial incentives you previously received from us.
Contact Us
If you have questions or comments about this Privacy Policy, please contact us at privacy@step.com.