Privacy policy

Who we are

TwoSteps is run by [Company name], registered with the Dutch Chamber of Commerce (KVK) under number [KVK number], at [Registered address]. We decide what happens with your data (we’re the “controller”). You can reach us at team@twosteps.network.

What we collect

• Your account: your email address and password (stored scrambled; we can’t read it). If you sign in with Google, Google tells us your name, email address and profile picture.
• Your page: what you put on it: your name, username, photo, cover, roles, skills, where you’re based, bio, links, and your work. A company page: the company’s name, logo, photos, industry and location.
• What only you see: your rates and where you’d rather work, if you add them. When paid work opens, also your business, tax and bank details, if you add them to be paid.
• Forms and the newsletter: your name, email and message when you contact us or ask for early access, and your email if you subscribe to The Brief.
• To keep the site safe and working: your IP address, briefly, to stop abuse (for example too many login attempts), and error reports when something breaks. With forms and page views we keep only a scrambled, one-way version of your IP address, never the address itself.
• Emails we send you, so we don’t send the same one twice.

Why, and on what grounds

• To run your account and show your page, because that’s what you signed up for (our agreement with you).
• To keep TwoSteps safe: stopping abuse, fixing errors. That’s our legitimate interest, and yours.
• To email you about your account (always), and with reminders, activity and news about TwoSteps (our legitimate interest; switch any of them off in email settings, or with the link in each email).
• To send The Brief’s newsletter, because you asked for it (your consent; unsubscribe any time).
• To keep financial records, when payments open, because the law requires it.

We don’t sell your data, and we don’t use it for advertising.

What’s public

Your page is public: anyone with its link can see your name, photo, bio, where you’re based, your links and your work. Until TwoSteps fully opens, pages aren’t listed in search engines. Your email address, rates, and business and bank details are never shown on your page.

Who helps us

These services handle data for us, only to do their job, under agreements that protect it:

• Supabase: our database, logins and file storage, in Ireland (EU).
• Vercel: hosts the website, in the EU, through a worldwide network.
• Resend: sends our emails.
• Sentry: error reports, so we can fix what breaks (without your IP address).
• Upstash: counts requests to stop abuse.
• Google: only if you choose to sign in with Google.
• Stripe: payments and payouts, once paid work opens.

Some of these companies are based in the United States. Where data leaves the EU, it’s protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

As long as you have an account. When you delete your account, your page disappears straight away and we delete your data within 30 days, unless the law makes us keep something longer (for example invoices, which Dutch law says to keep for seven years). Error reports are kept for 90 days at most.

Your rights

You can ask us to:

• show you what we have about you, or give you a copy (you can also download it in Settings › General);
• correct it (most of it you can change yourself, on your page and in Settings);
• delete it (you can delete your account yourself in Settings › General);
• stop or limit using it, or object to how we use it.

Write to team@twosteps.network and we’ll answer within a month. If you’re not happy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Cookies

We only use cookies the site needs to work: to keep you logged in, and to remember your settings (like day or night mode, and that you’ve seen the cookie notice). No advertising or tracking cookies.

Age

TwoSteps is for people aged 16 and over.

Changes

When we change this policy in a way that matters, we’ll tell you by email before it applies. The terms explain how TwoSteps works.