Privacy policy
This website
Controller: Thomas Ulrich, Herrgasse 5, 5231 Schalchen, Austria, privacy@ut-systems.com.
Hosting. This website is delivered by Vercel Inc. (USA). When you open a page, Vercel processes server log data: the IP address of your device, date and time of the request, the address requested and the amount of data transferred, the HTTP status code, the referring page where one exists, and browser type and operating system. This is needed to deliver the website securely and reliably (Art. 6(1)(f) GDPR). Vercel keeps these logs only briefly. Vercel is certified under the EU-U.S. Data Privacy Framework, which covers the transfer to the USA (Art. 45 GDPR).
No analytics, no cookies. We use no analytics or tracking tools. The website sets no cookies, stores nothing on your device and loads nothing from other servers: fonts, images and the video come from stepdok.com itself. The pages contain no JavaScript.
E-mail. If you e-mail us, we process your address and the content to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed for that or for statutory retention periods.
Microsoft Store. The "Get it from Microsoft Store" buttons link to the Microsoft Store. Microsoft's privacy statement applies there.
Your rights. You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR); an informal e-mail is enough. You can also lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at).
The stepdok app
This section describes how the Windows app stepdok handles data. It is based on the privacy data sheet and the list of network connections in the app's source code (version 1.0). Organisations deploying stepdok can request the detailed data sheet for their data protection officers.
Principle
stepdok processes everything on your PC. There is no user account with the publisher, no cloud, no telemetry and no crash reports sent over the network. UT-Systems receives no images, step texts, guides, detected personal data, keystrokes or logs.
What is processed during a recording
Only after you explicitly start a recording, and only while it runs:
- Images of the recorded program (or of the chosen screen or region) for every step.
- Mouse clicks (position, time), to form steps and mark the click position.
- Keystrokes in the recorded program – only to recognise *that* something was typed into a field or that a shortcut was pressed. The typed value is taken over only when that is explicitly switched on (default: off), the field is not a password field and no personal data is detected. Nothing is stored from password fields. Can be switched off in the settings and by policy.
- Texts of the program's interface (Windows UI Automation) and local text recognition (Windows OCR), to name the clicked control and to detect personal data. These texts stay in memory; only control names in step texts are stored, and names that look like personal data are left out.
Password fields, programs on the "Never record" list (default: common password managers, Windows Security, sign-in dialogs) and stepdok's own windows appear in no image.
Detected personal data
stepdok detects and redacts names, e-mail addresses, phone numbers, IBAN/account numbers, dates of birth, places and addresses, tax ID, social security/AHV number, licence plates and your own patterns. The guide does not store the detected texts but category, confidence, field label, a hash and your decision; the detected text is additionally stored encrypted for you only.
Where the data is stored
- Guides (
.stepdokfiles) are stored in your library (default:Documents\stepdok) or in team folders set by you or your IT department. They contain redacted images and the unredacted originals encrypted with Windows DPAPI – only your Windows account can read them. In team folders others see only redacted images, your name as creator and, while you edit, a lock file with user and PC name. - Data folder (
%LOCALAPPDATA%\UT-Systems\stepdok): settings, search index, interim state of running recordings (images encrypted), templates, licence and logs. - Exports (Word, PDF, HTML, Markdown) are saved wherever you choose. They contain only redacted images without metadata.
- Logs contain only technical events, never keystrokes, detected texts or image content; the last 7 daily files are kept.
- stepdok's trash empties itself after 30 days.
Network connections
| Connection | When | What is sent | Switch off |
|---|---|---|---|
| Licence activation, check, deactivation (licences with a licence key) | click on "Activate" or "Deactivate"; check at most once a year for single-user licences activated online | licence key, a hash of the device ID (never the ID itself), app version, product, licence ID where applicable. No names, e-mail addresses or content. The server technically sees the IP address. | policy DisableOnlineActivation; offline activation with a request and response file |
| Update check (Setup version only) | at most once a day at start-up or on "Check now" | download of the version list and, if newer, the package; no content, no licence data | setting "Check for updates" or policy DisableUpdates |
| Microsoft Store (Store version) | trial, purchase and updates | Windows manages licence and updates through the Microsoft Store; Microsoft's privacy statement applies | – |
| Purchase links | only when you click a licence button | nothing from stepdok – your browser opens the page | do not click |
The MSIX version does not check for updates itself. If guides are stored on a network drive or in a synced cloud folder, Windows or the sync client transfers those files – that is the organisation's decision, not stepdok's.
Licence data
A licence file contains the licensee's name or organisation and e-mail address and device hashes; it is stored locally in the data folder. When you buy through the Microsoft Store, Microsoft processes the purchase data; UT-Systems receives no content from the app from Microsoft.
Your rights
For data processed by UT-Systems (licence activation, e-mail enquiries) you have the rights of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). Data that exists only on your PC is managed by you: delete guides, remove the data folder. If your organisation uses stepdok, it is the controller for the recorded content.
Privacy questions: privacy@ut-systems.com · Support: support@ut-systems.com