This policy explains what Second Step collects, why, where it is kept, who can see it, and how to make us delete it. It is written to be read, not skimmed. If anything here is unclear, email us and a person will answer.
Who we are. Shivendra Rawat, a sole proprietor trading as Second Step, based in Delhi NCR, India. GSTIN 09BPXPR0474L1ZW. Our registered address is available on request from the contact below. We operate getsecondstep.com and its subdomains, the Second Step agency service, and the software tools published under Second Step Labs (the "Labs tools"), including BookingBridge and the Second Step Ads Gateway. Contact for anything in this policy: [email protected].
Effective date. 6 October 2026 (first published 8 September 2026). Version 1.1.
1. Who this policy covers
It covers three groups of people, and each section below says which group it applies to.
- Visitors: anyone who reads this website or fills in a form on it.
- Clients: businesses that hire the agency, and the people who work at them.
- Tool users: anyone who connects a Google, Meta or property-management account to a Labs tool.
2. What we collect, and why
From visitors. Pages viewed, approximate location from your IP address, device and browser type, how you arrived (search, an ad, a link), and what you clicked. We collect this through Google Analytics 4, Microsoft Clarity, and, where you have consented, the Meta pixel. We use it to understand which pages work and which ads bring the right people. If you fill in a form we collect what you type: usually your name, work email, company website, an advertising budget band, and how your business makes a sale. We use it to reply to you and to run the audit you asked for.
From clients. Business contact details, the access you grant to your advertising, analytics, call-tracking, booking and CRM accounts, invoices and payment records, and the content of our working correspondence. We use it to deliver the service you engaged us for, to bill you, and to keep records the law requires us to keep.
From tool users. The data described in sections 3 and 4, read from the accounts you connect, plus your name and email from the sign-in, and the questions you type into an assistant feature. We use it to produce the reports and answers the tool exists to produce, and for nothing else.
We do not buy data about you, and we do not build profiles of you for anyone else.
3. Google user data
This section applies to tool users who connect a Google account, and is written to meet the Google API Services User Data Policy.
What we request. Read-only reporting access to Google Ads (the adwords scope) and, where the tool needs it, read-only access to Google Analytics (analytics.readonly). We do not request permission to create, edit or pause campaigns, spend money, or change settings in your account. If a future tool ever needs a write scope, it will ask for it separately and this policy will be updated first.
What we do with it. We read campaign, ad group, keyword, cost, click and conversion data and join it to your booking, call or CRM data to produce attribution reports for you, the account owner, and for the people you choose to share them with.
Limited Use. Second Step's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use Google user data only to provide and improve the features you can see in the tool; we do not sell it; we do not use it for advertising of our own; we do not let a person read it except with your consent, for security, to comply with law, or as needed to operate the service; and we do not transfer it to anyone except as needed to provide the feature, for security, or to comply with law.
AI features. Where a tool has an assistant that answers questions about your account, the question and the relevant slice of your data are sent to a model provider (currently Google, Anthropic or OpenAI through an API) to generate the answer. These providers are contractually barred from training on that data. We do not use Google user data to train or fine-tune any model, general or specialised.
Revoking access. You can revoke Second Step's access at any time at myaccount.google.com/permissions. Doing so stops all further reading immediately. Data already stored is deleted on the schedule in section 9.
4. Meta platform data
This section applies to tool users who connect a Meta (Facebook or Instagram) advertising account.
We request read access to advertising performance (ads_read) and, where a tool needs it, to your ad account list. We do not request permission to publish, edit or spend. We use this data to produce attribution and performance reports for you. We follow the Meta Platform Terms and Developer Policies. You can remove Second Step from your account at facebook.com/settings under Business Integrations, and you can request deletion of stored data as described on our Data Deletion page.
5. Property-management and booking data
BookingBridge connects to property-management systems (currently Hostfully) to match advertising clicks to reservations.
We store the reservation identifier, the reservation value, the check-in and check-out dates, the property identifier, and the source and click identifiers attached to the booking. We do not store guest names, email addresses, phone numbers, addresses or payment details. Where a system sends us those fields in a webhook, they are discarded before storage.
6. Cookies and similar technologies
The website uses a small number of cookies: strictly necessary ones for the site to work, analytics cookies from Google Analytics and Microsoft Clarity, and advertising cookies from the Meta pixel. Advertising cookies are set only after you consent through the banner, where consent is required by your location. The full list and how to change your choice are on our Cookie Notice page.
7. Legal bases
If you are in the European Economic Area, the United Kingdom or Switzerland: we process visitor data on the basis of consent (advertising cookies) and legitimate interest (analytics, replying to your enquiry); client data to perform a contract and to meet legal obligations; tool-user data to perform the contract you accepted when you connected an account.
If you are in India: we process personal data under the Digital Personal Data Protection Act, 2023, on the basis of your consent or for the legitimate uses the Act permits, and we honour the rights it grants you.
If you are elsewhere, including the United States: we apply the same practices to everyone.
8. Who we share data with
We share data only with providers who process it for us, under contract, to run the website and the tools. We do not sell personal data and we do not share it with advertisers or data brokers.
- Hosting and infrastructure: Hostinger (website), Cloudflare (edge, gateway workers), Railway (tool back-ends), Google Cloud including BigQuery (data warehouse).
- Analytics and advertising: Google Analytics, Microsoft Clarity, Meta.
- Business systems: Google Workspace (email, documents, sheets), Zoho Books (invoicing), CallRail (call tracking, for clients who use it).
- AI model providers: Google, Anthropic, OpenAI, and OpenRouter as a router, used only for assistant features and never for training.
- Sign-in: Google and Meta, when you choose to sign in with them.
The current list, with locations, is on our Security page. We update it when a provider changes. We will also disclose data if the law requires it, or to protect someone's safety.
9. How long we keep it
- Form submissions and enquiries: 24 months after our last contact, then deleted.
- Analytics data: 14 months in Google Analytics, as configured; Clarity per Microsoft's default retention.
- Client working data: for the length of the engagement plus 12 months, unless you ask us to delete it sooner or the law requires longer retention of invoices and tax records (eight years in India).
- Tool-user data read from connected accounts: while the connection is active, and deleted within 30 days after you disconnect or ask, whichever is first. Backups roll off within a further 30 days.
- Google user data specifically: deleted within 30 days of revocation or request, including from backups within the following 30 days.
10. Where it is stored and how it is protected
Data is stored in data centres operated by the providers in section 8, which are predominantly in the United States, with edge caching distributed worldwide. The table on our Security page names the region for each one. All data is encrypted in transit and at rest. Access credentials are stored as encrypted secrets, never in code or spreadsheets. Only the people who need access to deliver your service have it, and access is revoked when they leave. Details are on our Security page.
11. Your rights
Wherever you are, you can ask us to: tell you what we hold about you; correct it; delete it; give you a copy in a portable format; stop using it for a particular purpose; or withdraw consent you gave earlier. Email the contact address above. We reply within 30 days. If you are in the EEA or UK you may also complain to your data protection authority. If you are in India you may escalate to the Data Protection Board of India once we have replied, or if we fail to reply.
12. Children
Our services are for businesses and the adults who run them. We do not knowingly collect data from anyone under 18, and we delete it if we learn we have.
13. International transfers
Because our providers are in several countries, your data may be processed outside the country you live in. Where the law requires it, we rely on the providers' standard contractual clauses or equivalent safeguards.
14. Changes to this policy
We will post changes here with a new effective date and version number. For material changes that affect tool users, we will email the account owner before the change takes effect.
15. How to delete your data
Follow the steps on our Data Deletion page, or email the contact address above with the subject line "Delete my data". We confirm deletion by email within 30 days.