Steady is a brand of Unity Space SLU, a company incorporated in Spain with its registered address at Calle Lirica 9, Spain ("we", "us", "our", "the company"). This policy explains what we collect, why we collect it, how we use it, who we share it with, and the rights you have — whether you visit our website, use the Steady platform, or are a member, donor or beneficiary of an organization that runs on Steady.
1. Who is responsible
Unity Space SLU is the data controller for the Steady website, and for platform accounts we operate directly. Where an organization runs its operations on Steady, that organization is the controller of the data it enters (its members, donors, cases and files) and we act as itsprocessor under a data processing agreement.
Questions, requests and complaints: privacy@getsteady.cc, or by post to Unity Space SLU, Calle Lirica 9, Spain.
2. What we collect
2.1 When you visit the website
- Technical data: IP address, browser type and version, device type, language, pages visited, referrer, and the date and time of requests.
- Cookies and similar storage, described in the cookie notice. We use analytics to understand which pages are read; we do not run advertising pixels.
2.2 When you create an account or use the platform
- Account data: name, email address and a password hash. Authentication is handled through a dedicated identity service; we never store a readable password.
- Organization data: the information an organization adds about its work — members, donors and donations, volunteers, grants, programs, cases, events, surveys, posts and uploaded files.
- Billing data: plan, subscription status, invoice references and payment history. Card numbers are entered directly with our payment processor and never reach our servers.
- Communications: messages you send us, and the transactional email we send on an organization's behalf (invitations, receipts, password resets, notifications).
2.3 Special categories
An organization may record sensitive information in its work — for example health circumstances, family relationships or financial hardship recorded in a case file, or food-security or housing needs. We treat this as equally protected tenant data, with the same isolation rules, and expect the organization to have a lawful basis for holding it. We do not use it for anything beyond storing and displaying it to the organization that entered it.
3. Why we process it and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Providing the platform | Account and organization data | Contract |
| Security, abuse prevention, diagnosis | Technical and account data | Legitimate interest |
| Billing and tax compliance | Billing data | Contract and legal obligation |
| Transactional email | Email addresses and message content | Contract |
| Product analytics | Aggregated usage events | Consent where required |
| Product updates (optional) | Email address | Consent, withdrawable at any time |
4. Who we share it with
We never sell personal data, and we do not buy or resell private contact databases. We share data only with the processors we need to run the product, listed on thesubprocessors page, each bound by a data processing agreement. Where an organization integrates a third-party service (Stripe for payments, a workflow tool, a mapping service), data is shared only as needed for that integration to function, and only with that organization's consent.
5. Where data is processed
We operate globally. Depending on the region chosen for an organization, data may be processed in the European Union, the United States, or another region where our processors operate. Wherever data is processed outside your region, transfers rely on appropriate safeguards — the European Commission's Standard Contractual Clauses for EU data, and equivalent lawful mechanisms elsewhere. You can ask which region your organization's data is stored in atprivacy@getsteady.cc.
6. How long we keep it
- Account and organization data is kept while the account is active, plus a short grace period after termination so a deletion can be undone if requested in error.
- Deleting a record removes it from the live system immediately and from backups on the normal retention cycle.
- Billing records are kept for as long as tax law requires (typically six to ten years depending on jurisdiction).
- Technical logs are retained in short, rolling windows unless an incident investigation requires more.
7. Security
- Tenant isolation is enforced at the database row level, keyed on the organization, and exercised continuously by automated tests.
- Data is encrypted in transit (TLS) and at rest for the databases that hold it.
- Passwords are stored as salted hashes; access to production is restricted and logged.
- Roles and permissions are enforced server-side, not merely hidden in the interface.
8. Your rights
Under the GDPR and equivalent laws you have the right to access, rectify, erase, restrict, port and object to our processing, and to withdraw consent at any time. To exercise any of them, write to privacy@getsteady.cc. We respond within 30 days. If you are not satisfied, you may complain to the Spanish data protection authority (AEPD) or the supervisory authority where you live.
If your data was provided by an organization that runs on Steady, you should first contact that organization: they control the data and can act on your request directly. We will support them with the platform's export and deletion tools.
9. Children
The platform is not directed at children under 16, and we do not knowingly collect their personal data. Where an organization intentionally runs a program for children, it is responsible for parental consent as required by its jurisdiction.
10. Automated decision-making
We do not carry out automated decision-making that produces legal or similarly significant effects. Signal suggestions in the product are recommendations with the evidence shown; an organization's staff makes the decisions.
11. Cookies
What we store in your browser is described in the cookie notice.
12. Changes
If this policy changes materially we will update the date at the top, announce the change on this page, and email account holders. Where a change requires consent, we will ask for it.