Privacy Policy

This privacy policy explains how personal data is processed in the Small Steps app and on this website.

1. Controller

ESBM-Solutions UG (haftungsbeschränkt) i. Gr., Ditfurthstraße 48, 33611 Bielefeld, Germany. Email: support@esbm-solutions.com

2. What data we process

Account

On first launch the app creates an anonymous account with a random identifier, without an email address and without a password. This identifier links your scans and purchases to your device.

Your child's profile

You can voluntarily provide a name and a date of birth. These details are only used for display inside the app (for example to label the prints) and are not used for any other purpose.

Scans and print images

At the heart of the app are images of your baby's foot or hand. These images deserve particular protection. They are transmitted encrypted and stored in the EU (Supabase, Frankfurt region). Only your account has access; the storage buckets are not public.

Purchases

Purchases go through the Apple App Store or Google Play. We receive no payment data, only a transaction confirmation that unlocks your downloads (purchase handling and verification via RevenueCat).

Crash reports

To keep the app stable we use Sentry (servers in the EU). Crash reports contain technical device information, but no scans and no profile details.

Ad measurement with TikTok (only with consent)

If you expressly agree in the app, we transmit event data to TikTok (TikTok Technology Limited, Ireland; part of the ByteDance group) in order to measure and improve the performance of our ads. What is transmitted is device information (including advertising IDs such as IDFA/GAID, on iOS only if you additionally allow this in the app tracking dialog), your IP address, and app events such as installation, app start, completed registration, a completed scan, viewing the style picker, the start of the purchase flow, and purchases including the purchase amount. In addition, the TikTok SDK automatically records usage and return events. Your scans, your photos and your child's profile details are never transmitted to TikTok.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future in the app settings. Processing by TikTok can involve a transfer to third countries (including the USA and China); according to TikTok, these transfers are based on the EU standard contractual clauses. More information: the TikTok privacy policy at https://www.tiktok.com/legal/privacy-policy.

Attribution measurement with Airbridge (only with consent)

With the same consent we transmit event data to Airbridge, the measurement service of AB180 Inc. (Teheran-ro 419, Gangnam-gu, Seoul, Republic of Korea). Airbridge assigns installations and app events to our advertising campaigns (“attribution”) so that we can see which ad someone found Small Steps through. What is transmitted is device and connection information (including advertising IDs such as IDFA/GAID, on iOS only if you additionally allow this in the app tracking dialog, your IP address, device model and operating system version), a pseudonymous identifier of your account, and app events: installation and app start, account created or signed in (including the sign-in method used), completed onboarding, completed scan, viewing the style picker, the start of the purchase flow, and purchases including the purchase amount, the selected styles and the transaction number. Your scans, your photos and your child's profile details are never transmitted to Airbridge.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future in the app settings; without consent the Airbridge SDK is not started at all and sends no data. We have a data processing agreement (Auftragsverarbeitungsvertrag) with AB180 under Art. 28 GDPR. Processing takes place in the Republic of Korea and in Japan. For both countries an adequacy decision of the EU Commission is in place (Japan 2019, Republic of Korea 2021), so the transfer is based on Art. 45 GDPR. The EU representative under Art. 27 GDPR is Maetzler Rechtsanwalts GmbH & Co KG (GDPR-Rep.eu), Schellinggasse 3/10, 1010 Vienna, Austria; data protection contact at AB180: compliance@ab180.co. More information: Airbridge privacy policy.

Push notifications

Push notifications are optional. We use your push token only to let you know when your styles are ready. Delivery runs through Expo and through Apple and Google.

3. Image processing by AI

We transmit the images only as a close-up of the foot or the hand. Faces are not transmitted. Names, dates of birth and other profile details are not transmitted to the AI service providers.

OpenAI

For the artistic styles our servers send your scan to the image API of OpenAI, which creates the selected styles from it. OpenAI processes the images as a processor (Auftragsverarbeiter) and does not use API data to train its models. We have a data processing agreement (Data Processing Addendum) with OpenAI under Art. 28 GDPR.

4. Transfers to third countries

OpenAI is based in the United States, so the image processing takes place outside the EU. The transfer is based on a data processing agreement under Art. 28 GDPR and on the standard contractual clauses of the EU Commission under Art. 46(2)(c) GDPR. Despite these safeguards it cannot be fully ruled out that US authorities access the transmitted data.

Only if you have given consent to ad measurement do two further third countries come into play: Airbridge (AB180 Inc.) processes the event data in the Republic of Korea and in Japan, and for both countries there is an adequacy decision of the EU Commission (Art. 45 GDPR). With TikTok there can be a transfer to the USA and to China, based on the EU standard contractual clauses. If you withdraw your consent, these transfers stop.

All other data, meaning account, profile, scans, renders and purchases, stays in the EU.

5. Hosting

• Database and storage: Supabase, EU region (Frankfurt)
• Backend servers: Hetzner, Germany (our own infrastructure, Coolify)
• This website: Hetzner, Germany (no cookies, no tracking)

6. Legal bases

Processing takes place to perform the contract (Art. 6(1)(b) GDPR: scan, render, purchase, download), on the basis of your consent (Art. 6(1)(a) GDPR: for example push notifications, camera access) and on the basis of our legitimate interest in stable operation (Art. 6(1)(f) GDPR: crash reports).

7. Retention and deletion

Scans, renders and profile details stay stored for as long as your account exists. You can have your account deleted at any time, see Delete account. We keep purchase receipts to the extent that commercial and tax law obligations require.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), as well as the right to lodge a complaint with a data protection supervisory authority. To do so, write to support@esbm-solutions.com.

Note: this text is a careful draft, but it does not replace legal advice. It needs a lawyer's review before the official launch (in particular: images of children, third country transfers to OpenAI, TikTok and Airbridge, for Airbridge including the question whether the adequacy decision for the Republic of Korea covers this specific recipient, data processing agreements, retention periods, and the question whether the consent dialog in the app names the recipients sufficiently).