Privacy notice
Last updated: 1 November 2026
Who is responsible
TermStep (termstep.com) is run by Fatih Unal, a sole trader registered in Türkiye (registration details to be added before launch), the data controller for the personal data described here. Contact: hello@termstep.com.
Visiting the site
- You can use the free site without an account. We do not use advertising, tracking cookies or analytics.
- Your browser remembers a few settings on your own device: colour theme, which key stages you have folded on the map, and which qualification you chose. They are not sent to us.
- Our host, Cloudflare, briefly processes your IP address and browser details to deliver the page and protect it from attacks.
If you create an account or subscribe
| What | Why | Legal basis |
|---|---|---|
| Email address, name, and if you sign in with Google, your Google account ID | To create your account and sign you in | Contract |
| Your school, and your role (teacher or student) | To give you the right access under a school licence | Contract, or the school's legitimate interest |
| Your plan, its status and renewal date | To give you access to what you paid for | Contract |
| Sign-in records and security logs | To keep accounts safe and stop misuse | Legitimate interests |
| Emails we send you (receipts, renewal reminders, account notices) | To run your subscription and meet our legal duties | Contract and legal obligation |
We never see or store your card details. Payments are handled by Paddle.com, our Merchant of Record, under Paddle's privacy notice. Paddle tells us your name, email address, country, and what you bought.
Who we share data with
- Paddle: payments, tax and invoices.
- Cloudflare: hosting, security and storing account data.
- Resend: sending account emails.
- Google: only if you choose to sign in with Google, or open slides and worksheets hosted on Google.
- Your school: if you join through a school licence, the school admin can see your name, email, role and when you last signed in.
We never sell your data or use it for advertising. Some of these providers store data outside your country, protected by standard contractual clauses or similar safeguards.
Children
Students under 16 should join through their school or with a parent's or guardian's permission. We collect only what is needed to give access, and we never send marketing to students.
How long we keep data
- Account data is kept while your account is open, and deleted within 90 days after you close it.
- Payment and invoice records are kept for as long as tax law requires (usually 5 to 10 years). Paddle keeps these.
- Security logs are kept for up to 12 months.
Your rights
You can ask to see, correct, download or delete your personal data. You can also object to how we use it, or ask us to limit it. Email hello@termstep.com and we will reply within one month. If you are unhappy, you can complain to the data protection authority in your country. In the UK, that is the Information Commissioner's Office (ico.org.uk).
Changes
If we change this notice in a way that matters, we will email account holders before the change takes effect.