Privacy Policy

This policy covers the Steerd marketing website (steerd.io). The Steerd application, once you sign in, is covered by its own in-product privacy notice at https://app.steerd.io/privacy. We collect only what this website needs to work, we never sell personal data, and nothing optional loads until you allow it.

Controller

Unbogify GmbH, Zelterstr. 10, 10439 Berlin, Germany. For any privacy question, contact legal@nightlybuildgroup.com.

What we process, and why

Server logs. When you load a page, our hosting provider processes technical data (such as a shortened IP address, the requested page, browser type and a timestamp) to deliver the site securely and reliably. Legal basis: our legitimate interest in operating a safe website (Art. 6 (1)(f) GDPR). These logs are kept only briefly.

Contact form

The sales contact form (steerd.io/contact) collects the name, email address, company, team size and message you type in. We use this only to answer your enquiry: it is emailed straight to our sales inbox, read by our sales team, and never added to any marketing list. Legal basis: our legitimate interest in responding to a business enquiry you initiated, or the steps you asked us to take before entering into a contract with you (Art. 6 (1)(f) and, where applicable, (1)(b) GDPR). We delete the mail once your enquiry is closed.

Google Analytics, only with your consent

We would like to understand which pages are useful. We use Google Analytics 4 for anonymous, aggregated usage statistics, but only if you opt in. By default it is switched off (Google Consent Mode, deny-by-default): no analytics cookies are set and no analytics data is sent until you allow analytics in the banner. IP addresses are anonymized. Legal basis: your consent (Art. 6 (1)(a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer.

Provider: Google Ireland Limited. When analytics is enabled, data may be transferred to Google LLC in the USA; this is safeguarded by the EU Standard Contractual Clauses and Google’s additional measures. Google acts as our processor under a data processing agreement.

Ad measurement, only with your consent

We advertise Steerd on Google Ads and Microsoft Advertising, and we would like to know whether those ads lead to signups. When you click one of our ads, the ad platform adds a click identifier to the address of the page you land on (gclid, gbraid or wbraid for Google, msclkid for Microsoft). Only if you allow ad measurement in the banner do we keep that identifier in your browser for the rest of your visit (in session storage, which is cleared when you close the tab) and pass it on to our sign-up page. If you then create an account, we store it with your account. Without your consent we ignore the identifier: we neither keep it nor pass it on. If you allow analytics without ad measurement, we also take it out of the page address and the referring address that Google Analytics reports. We load no Google Ads or Microsoft Advertising tag on this website.

What it is for: we keep the identifier for one purpose, to tell the ad platform what the click led to (an offline conversion), so the platform can learn which ads work. We report up to three events, each of them once: that you signed up, that you started working with Steerd (your first issued invoice, your first exported CV or your fifth time entry), and that you took out a paid subscription. Such a report contains the click identifier, which of the three it was, when it happened and, for a paid subscription, its price before discounts and VAT. It also says that you consented to this measurement and that the data is not to be used for personalized advertising. It never contains your name, your email address or anything you keep in Steerd. Legal basis: your consent (Art. 6 (1)(a) GDPR, and § 25 (1) TDDDG for keeping the identifier in your browser).

Recipients of these reports: Google Ireland Limited (Google Ads) and Microsoft Ireland Operations Limited (Microsoft Advertising). Both may process the data in the USA as well, at Google LLC and Microsoft Corporation, which are certified under the EU-U.S. Data Privacy Framework; for certified companies, the European Commission’s adequacy decision applies (Art. 45 GDPR).

How long, and how to withdraw: we delete the identifier 90 days after you sign up, because an ad platform accepts a conversion only up to 90 days after the click, and with your account if you delete it sooner. You can withdraw your consent at any time via “Cookie settings” in the footer: the identifier is then removed from your browser and no longer passed on. If you have already signed up, withdraw in the app under Settings, Profile, Privacy, which deletes the stored identifier straight away, or write to legal@nightlybuildgroup.com. A withdrawal applies from then on; it does not affect what happened with your consent before it.

From this website to sign-up

When you go from this website to sign up, the sign-up links can carry where you came from. If you allow analytics, they carry the first page of your visit we measured and the first campaign parameters (utm_source and similar) we saw in a page address. Measuring starts when you allow analytics, so a page you left before that is not included. Until you click, both stay in your browser for the rest of the visit only (in session storage), and they are removed if you withdraw analytics. When your account is created, the app records them in our product analytics (PostHog, in the EU), which the app’s privacy notice describes. Legal basis: your consent (Art. 6 (1)(a) GDPR, and § 25 (1) TDDDG for keeping them in your browser).

A partner’s referral code travels without asking, because carrying it to your checkout is what gives you the discount the partner’s link offers. It stays in session storage for the rest of the visit and is then stored with your account, so the discount reaches your subscription and the partner is credited. Legal basis: the steps toward the contract you are about to make (Art. 6 (1)(b) GDPR) and our legitimate interest in crediting the partner who sent you (Art. 6 (1)(f) GDPR). Keeping it in your browser is strictly necessary for the discount you followed the link for (§ 25 (2) no. 2 TDDDG).

Cookies

This site sets no cookies until you make a choice. If you allow analytics, Google Analytics sets cookies (for example _ga) to recognize returning visits. If you allow analytics and ad measurement, Google’s script (gtag.js) may also set advertising cookies (for example _gcl_au) that connect a visit to the ad click that brought it. Your consent choice itself is stored locally in your browser so we don’t ask again. You can change or withdraw it any time via “Cookie settings.”

Hosting

The website is hosted within the European Union by a provider acting as our processor under a data processing agreement (Art. 28 GDPR).

Sharing

We do not sell your data. We only use the processors named above, each under a data processing agreement, and ad clicks go to Google and Microsoft only with your consent, as described under “Ad measurement.”

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• have it corrected or erased
• restrict or object to processing
• receive your data in a portable format
• withdraw consent at any time, with effect for the future
• lodge a complaint with a supervisory authority

To exercise any of these, email legal@nightlybuildgroup.com. Our competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).