Plain-English summary: the site is readable without an account, we don't store card numbers, and the only personal data that reaches us is what you type into a form or what analytics records.
This policy explains what stuckatstep ("we", "us") collects when you use this site, why, and how to get it removed. It covers this site only — once you're on Netspend's own pages, their policy applies.
stuckatstep is an independent guide site. It isn't operated by Netspend or by any card issuer. The data controller is the site operator, reachable via the contact page.
Where a form on this site takes details, it collects the card number, expiry and CVV, and sometimes an email address. That's it — no name, no SSN, no address unless a form explicitly says so.
Standard server logs (IP address, browser, referring page, timestamps) and analytics. Analytics is aggregate — page views, scroll depth, click counts — and is used to see which pages work.
Where a form on this site takes card details, they're passed through to the issuer to start the activation and are not stored on this site afterwards.
They are not written to a database here, not kept in a spreadsheet, and not sold. If the form is reloaded, the details are gone and have to be re-entered.
Details you type into Netspend's own flow never touch this site at all.
Where the GDPR applies, the lawful bases are legitimate interests for analytics and security, and consent where a form asks for it. Where it doesn't apply, the same principles are followed anyway.
Analytics sets cookies. They're aggregate and don't identify you personally. Blocking them in the browser doesn't break the site — the guides still read fine.
Three categories, no more:
Nobody else. No data brokers, no ad networks beyond the analytics above, no selling.
Card details: not retained here at all. Contact emails: kept while the query is live and for a reasonable period after, then deleted. Server logs: typically 30 days. Analytics: aggregate, retained up to 14 months.
You can ask what's held about you, ask for a copy, ask for correction, ask for deletion, and object to processing. Use the contact page. Requests are answered within 30 days.
Because card details aren't retained, a request for those usually comes back empty — that's expected, not an error.
The site runs over HTTPS. Card details are transmitted encrypted to the issuer. No system is perfect, and this is a guide site rather than a bank — the issuer holds the authoritative record.
The site isn't aimed at under-13s and doesn't knowingly collect their data.
If this policy changes materially, the date at the top changes with it. Continued use after a change means the updated policy applies.
Tell us first via the contact page and we'll try to fix it. Where the GDPR applies you can also complain to a supervisory authority.