This Privacy Policy explains how Enigmatic IT Solutions FZE ("Steer", "we", "us") collects, uses, discloses and protects personal data when you use the Steer service at steer.social, pages published under steer.social subdomains or custom domains, and related applications (together, the "Service"). Sharjah Free Zone, Sharjah, United Arab Emirates
We are the controller of the personal data described in this Policy. Questions and requests can be sent to support@steer.social.
In short. Steer turns a profile into a page that people can talk to, in the account holder's own cloned voice. To do that we process a voice recording and a voice model, the content you publish, and the questions visitors ask your page. We do not sell personal data, we do not use it for advertising, and we measure visits without tracking cookies.
This Policy applies to two groups of people:
Where a section applies to only one group, it says so.
| Category | Data | Source |
|---|---|---|
| Identity and contact | Name, email address and, if you sign in by phone, your mobile number and country. | You |
| Credentials | A salted, one-way hash of your password. We never store or see the password itself. One-time codes sent by email or SMS are short-lived and discarded after use. If you sign in with Google, Google tells us your name, email address and a Google account identifier, and we keep those instead of a password; we never see your Google password and request no other access to your Google account. | You |
| Page content | Everything you place on a page: name, role, location, biography, questions and answers, links, photo, colours, language, sides, and the voice you choose. | You |
| Voice recording | An audio recording of your voice, if you choose to clone it. | You |
| Voice model | A synthetic voice model derived from your recording, held under an identifier linked to your page. | Derived |
| Conversation records | The questions visitors ask your page and the answers your page gave, shown to you in your dashboard. | Visitors |
| Usage and billing | Conversation counts, plan, purchased credits, and identifiers issued by our payment processor. Card numbers are entered directly with the payment processor and never reach our systems. | You, derived |
| Access settings | For private pages, the access code you set (visible to you so you can share it). | You |
| Technical | Your approximate country at sign-up (from your network address), timestamps of sign-in, and security logs. | Derived |
| Category | Data | Notes |
|---|---|---|
| Questions | What a visitor types or says to a page. | Spoken questions are sent to our speech-recognition processor (currently OpenAI) to be turned into text, either through our servers or directly from the visitor's browser. We keep the text, not the audio. If that service is unavailable, the browser's own speech recognition may be used instead, under the browser maker's terms. |
| Visit measurement | A short, irreversible hash of the visitor's network address and browser type, scoped to one page and one day; the visitor's approximate country; and, where a browser sends it, the site the visitor came from. | We keep counts, not the address. The hash cannot be reversed or used to follow anyone across sites or days. |
| Private page access | A cookie recording that the visitor entered the correct access code for a private page. | Only set on private pages; expires after 30 days. |
We do not knowingly collect any special category data. Voice recordings are used solely to produce and operate the account holder's voice model as described in section 4.
| Purpose | Basis |
|---|---|
| Providing the Service: creating and hosting pages, answering visitors' questions, speaking answers aloud, showing you your conversations | Performance of our contract with you |
| Creating and operating your voice model | Your explicit consent, given when you clone a voice; you may withdraw it at any time (section 4) |
| Account security: sign-in codes, fraud and abuse prevention, rate limiting, security logs | Our legitimate interest in keeping the Service secure; legal obligations |
| Billing, invoices, tax and accounting records | Performance of contract; legal obligations |
| Measuring visits and usage, improving the Service | Our legitimate interest in operating and improving the Service, using aggregated and pseudonymised data |
| Service messages: verification codes, receipts, notices about your account or these terms | Performance of contract; legitimate interest |
| Marketing email to account holders | Only with your consent; every such message includes a way to opt out |
| Responding to complaints, misuse reports and legal requests | Legal obligations; legitimate interest in protecting people and the Service |
We do not make decisions with legal or similarly significant effects on you by automated means.
We do not sell personal data and we do not share it with third parties for their own marketing. We disclose personal data only:
We operate from the United Arab Emirates. Our processors operate in other countries, including the United States, and personal data, including voice recordings and voice models, is transferred to and processed in those countries. Where applicable law requires a lawful basis for such a transfer, we rely on your explicit consent, given when you create an account and again when you clone a voice, together with the contractual safeguards in our agreements with each processor.
| Data | Retained |
|---|---|
| Account and page content | While your account is open |
| Raw voice recordings | Not retained after processing |
| Voice model | Until you replace it or delete your account |
| Conversation records | The most recent conversations for each page, so you can see what visitors ask; older records are pruned automatically |
| Visit measurement | Aggregate counters only, kept for historical reporting; the daily visitor hash is discarded after the day it relates to |
| Security logs | For a limited period, no longer than needed to detect and investigate abuse |
| Billing records | As long as tax and accounting law requires |
You can delete your account at any time from Settings in the studio. Deletion erases your pages, your conversation records and your voice model, cancels any subscription, and cannot be undone. Residual copies may persist in encrypted backups for a limited period and are then overwritten.
Steer is offered to people aged 18 and over. Accounts are not offered to residents of the European Economic Area at this time; we decline sign-ups from that region. Published pages remain readable worldwide so that a link shared by an account holder keeps working for everyone.
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to certain processing, to receive a copy in a portable format, and to withdraw consent where processing is based on consent. Most of these you can exercise yourself: edit or delete pages, replace your voice, and delete your account from the studio. For anything else, write to support@steer.social; we respond within 30 days and may ask you to verify your identity first. You may also complain to the data-protection authority where you live.
Visitors. If you spoke to a page and want your questions removed from the account holder's dashboard, contact us with the page address and approximate time, and we will remove them.
All traffic is encrypted in transit. Passwords are stored only as salted hashes. Access to production systems is limited to authorised personnel and protected by strong authentication, including a second factor for administrative access. Generated audio is recorded for provenance, and cloned voices are watermarked (section 4). No method of transmission or storage is completely secure; if we become aware of a breach affecting your personal data, we will notify you and any relevant authority as the law requires.
We use only strictly necessary cookies: a session cookie once you sign in, a cookie that protects forms against cross-site requests, and, on private pages, the cookie described in section 2.2. Visit measurement on steer.social and in the studio uses a random first-party identifier kept in your browser's local storage (not a cookie, and never shared across sites) so that we can see how people move from the front page to a published page; clearing your browser's site data removes it. In the studio we may also record how the screens are used (clicks, scrolling, which steps are reached) to find usability problems; everything typed into a form, and the text of your page, is masked before it leaves your browser. Published pages are not measured in the visitor's browser at all. We do not use advertising cookies.
The Service is not directed to children and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this Policy from time to time. The date at the top shows when it last changed. For material changes we will notify account holders by email or by a notice in the studio before the change takes effect.
Enigmatic IT Solutions FZE
Sharjah Free Zone, Sharjah, United Arab Emirates
Privacy enquiries: support@steer.social · General: support@steer.social