Privacy Policy
What Setu collects, why, who processes it and what you can do about it.
Last updated 19 October 2026.
Who is responsible
Setu, India, decides how Setu uses the personal data of its users and is responsible for it. For data your business brings about its own customers and contacts, your business decides and Setu processes it for you (see the Terms, "Personal data you bring").
What we collect and why
Account: your name, email and profile photo from Google sign-in, to create and secure your account. Company: what you and your team enter (employees, knowledge, tasks, drafts, approvals, comments, connections, billing details), to run your company as you direct. Billing: payment references and your billing details, to bill your plan and meet tax law. Usage and security: measured AI usage and costs, audit records of actions, and technical logs (request ids, errors, timings) that hold no task content, to keep the service secure and bill correctly.
Customer messages that reach your employees through WhatsApp or email are stored so replies can be prepared; they are your customers' data, processed on your instructions.
How we use it
To run your company as you direct: prepare drafts, route work, enforce approvals and limits, send the notifications you asked for, bill your plan, and keep the service secure. We do not sell personal data, we do not use advertising, and we do not use your company's content to train AI models.
Who processes data for us
Managed hosting, database and private file-storage services operate Setu and hold the data needed to provide the service. Uploaded originals use private storage when that feature is enabled. Contact support for the current infrastructure and processor information, including the regions used for a particular data category.
Google provides sign-in. Your selected payment provider processes payments; Setu does not see or store card or UPI details. Email, messaging, app-connection and isolated-computer providers process data only when the corresponding feature is configured and used. A catalog listing alone does not mean that provider is connected or receiving your data.
For live AI work, the provider account you connect processes the task content it needs under that provider's terms and data settings. You pay that provider directly. Setu does not supply a shared AI key or funded AI credit for new live work.
Services you connect yourself (Gmail, Shopify, GitHub, HubSpot, Razorpay, a database you supply and others) receive only the calls your AI employees make with your approval, and their own terms apply.
Transfers outside India
Some of these providers store or process data in Singapore, the United States or the European Union. We transfer personal data only to countries the Government of India has not restricted, and only to providers bound by written terms to protect it and use it only to provide their service to us. We update this list here and email account owners at least 15 days before adding a provider that handles your company's content.
Security
Keys, tokens and connection strings are encrypted at rest. Each company is isolated at the database level. Every external write is approved by you or by an automatic rule you set, and is recorded. Sessions use secure cookies; the site uses HTTPS only.
If something goes wrong
If personal data we hold is breached, we act at once to contain and investigate it. Where the law requires, we report it to CERT-In within 6 hours of noticing it and to the Data Protection Board of India. We tell affected users without delay, by email and in Setu: what happened and when, the likely effects, what we have done, what you can do, and whom to contact. If the breach affects data we process for your business, we tell the account owner within 24 hours of becoming aware of it.
Your rights
Under the Digital Personal Data Protection Act, 2023 you can: get a summary of the personal data we hold about you, how we use it and who we shared it with; have it corrected, completed or updated; have it erased unless the law requires us to keep it (for example billing records); withdraw any consent you gave, as easily as you gave it (this does not affect what was done before, but we may then be unable to provide some or all of the service); nominate another person to use these rights if you die or become unable to; and complain to our Grievance Officer and then to the Data Protection Board of India.
You can edit your profile, export your company and delete your company yourself in Settings. For anything else, email [email protected] from your account email with the subject "Data request". We may ask you to confirm your identity. We reply within 15 days, free of charge. If you are a customer of a business that uses Setu, please contact that business first; we will help it respond.
Retention
Company data stays while your account exists. When you delete your company, every record we hold for it is removed except billing records we must keep; backups kept by our hosting provider roll over within 7 days. Guest demo companies are deleted 7 days after creation unless claimed. Billing and payment records are kept for 8 years, as tax and company law require. Audit records of actions stay with your company's history.
Operational records are removed on a schedule: sign-in sessions one day after they end; live-update copies, saved replies to repeated requests and expired one-use links after 30 days; incoming request receipts and sent notifications after 90 days; send records after 180 days. Your company's history, work, knowledge and billing records are not removed by this schedule.
Children
Setu is a business service and you must be at least 18 to use it. We do not knowingly collect personal data of anyone under 18. Do not upload data about children unless the law allows it and you have verifiable consent from a parent or lawful guardian. If you believe a child's data has reached us, write to [email protected] and we will delete it.
Product improvement and optional public-site analytics
First-party product-use counts record only allowlisted daily totals, such as employee or task creation. They do not contain prompts, files, company facts or personal identifiers and are not sent to a third-party analytics service. You can turn future counts off for your account in privacy settings; a company owner can also turn them off for that company. Anonymous earlier totals cannot be removed for a particular person.
When configured, Google Analytics can measure public-page views and Microsoft Clarity can record masked public-page layout and interactions. Each requires its own optional choice before its script loads. Private workspace, account, sign-in, support, API and payment pages are excluded from these scripts. Setu does not send private chats, prompts, uploaded documents or credentials as analytics events.
Public-page measurements use a fixed page title and a canonical public path instead of URL parameters, fragments, account identifiers or a referrer value. Replay is disabled for page contexts that fail the public-page privacy checks. Browser Do Not Track and Global Privacy Control opt-outs disable optional analytics and replay.
Choose Privacy choices on an eligible public page to change or withdraw consent. Withdrawing stops future optional collection after the page reloads; it does not erase data already processed.
Cookies
Essential cookies keep you signed in and protect forms. If an optional public-site analytics service is configured, its cookies and scripts are used only after the corresponding consent choice is saved. Analytics and masked session replay have separate choices. Setu does not use advertising cookies or enable advertising personalization through these integrations.
Contact and changes
Setu, India. Customer support: [email protected] · Monday to Saturday, 10 am to 6 pm IST. We may update this policy; the date at the top shows the current version, and we email account owners about material changes.
Grievance Officer
For a complaint about Setu, a payment, content on the service, or how we handle personal data, contact our Grievance Officer:
Grievance Officer · Email: [email protected] · Address: Setu, India
We acknowledge a complaint within 24 hours and resolve it within 15 days of receiving it. The Grievance Officer is also the contact for any question about how we process personal data. If you are not satisfied with our answer on a personal-data complaint, you may complain to the Data Protection Board of India.