Privacy Policy

Stepora is a WhatsApp AI agent service for businesses. This policy explains what data we collect, how we use it, who we share it with, and what rights you have. Last updated: 6 November 2026.

Stepora is operated from Pakistan. The service is sold through our online store “Pulse”, and the product is described there as an “AI Coach” — the WhatsApp AI agent that answers your customers on WhatsApp.

1. What data we collect

We collect only what the service needs to work:

• Business information you give us. Your name, business name, email address, WhatsApp Business number, business hours, delivery areas and charges, payment methods, product list with prices, and the FAQs and instructions you write for the AI agent. This information is the training for your agent — it is what the agent answers from.
• WhatsApp messages. Messages between your business and your customers that pass through Stepora — the customer’s message, the agent’s reply, and whether you took over the conversation. We need these to reply, to keep the conversation history in your Team Inbox, and to train and improve your agent’s answers.
• Contact data. Your customers’ names, phone numbers, and the delivery details they give in an order (name, address, phone), as supplied by you or by the customer in the WhatsApp conversation. This data belongs to your business; we process it on your behalf.
• Usage data. How you use the service — messages sent and received, orders taken, broadcasts you confirm, automations that run, and panel activity such as sign-ins.
• Billing data. Your plan, wallet balance, top-ups, and payment records. Card payments are processed by Creem (see §3); we do not see or store your full card number.
• Technical data. Standard server data such as IP addresses and browser information, collected automatically when you use the panel or this site, for security and to keep the service running.

2. How we use your data

• To run the service: to deliver WhatsApp replies, keep your inbox, take orders, and run the automations you switch on.
• To bill you: to charge your plan and per-message fees, keep your wallet balance, and send low-balance warnings.
• To support you: to answer support messages, fix problems, and help with onboarding.
• To improve the service: to check where the agent gives wrong answers and improve its training. One customer’s data is never shown in another customer’s chat, and your business details are never used to train another business’s agent.
• To keep the service safe: to detect abuse, spam, and violations of our Acceptable Use Policy.

We do not sell your data, and we do not sell your customers’ data. We do not show advertising to your customers.

3. Who we share data with

We share data only with the providers the service runs on, and only for the purpose stated:

• Meta / WhatsApp. Messages are delivered through Meta’s WhatsApp Cloud API on your own WhatsApp Business account. Meta receives the messages it delivers, under Meta’s own terms and privacy policy.
• Creem. Our payment processor. When you pay by card, Creem processes the payment and receives the payment details needed for the transaction. We receive the payment confirmation, not your card number.
• DeepSeek. Our AI provider. Message content is sent to DeepSeek so the AI agent can draft replies to your customers. DeepSeek processes that content only to provide the reply.
• Legal requirements. We may share data if the law requires it, or to protect the safety of our users and the service.

We do not share your data with any other party for marketing, and we do not let any third party use your customers’ data for their own purposes.

4. How long we keep data

• Conversation history and orders stay in your Team Inbox while your account is active, so you can search and review them.
• Business information and training data are kept while your account is active.
• Billing and payment records are kept as long as the law requires for accounting, after which they are deleted or anonymised.
• Deleted accounts. If you cancel and ask us to delete your account, we delete your business information, conversation history, and training data within 30 days. Billing records that the law requires us to keep are kept for that legal period only.

5. Your rights

You can, at any time:

• Ask what data we hold about you or your business, and ask for a copy of it.
• Ask us to correct data that is wrong.
• Ask us to delete your account and your data (see §4 for billing-record exceptions).
• Ask us to stop using your data for anything beyond running the service.
• Ask how your data is processed by Meta, Creem, or DeepSeek, and we will point you to their policies.

To use any of these rights, email support@stepora.xyz. We reply to rights requests within 30 days.

6. Security

We protect your data with the measures a service of this size can reasonably provide: encrypted connections (HTTPS), access limited to the people who need it to run the service, and your own WhatsApp Business credentials kept separate per business. No system is perfectly secure; if you believe your account has been compromised, tell us at once at support@stepora.xyz so we can help you secure it.

7. Cookies

This site and the panel use only the cookies needed to keep you signed in and to remember your preferences. We do not use advertising cookies and we do not use third-party tracking cookies.

8. Changes to this policy

If we change this policy, we will update the “Last updated” date at the top of this page and, for material changes, tell you in the panel or by email. Continuing to use the service after a change means you accept the updated policy.

9. Contact us

For anything about this policy, or about your data, email support@stepora.xyz. We are a small team and answer support email personally.

Also see our Terms of Service and Acceptable Use Policy.