Privacy Policy

Who we are

SetterStack ("SetterStack", "we", "us") provides an AI assistant that helps businesses respond to Instagram and Facebook direct messages and comments, qualify leads, and book calls. When you use SetterStack to process messages from your own audience, you are the controller of that data and we act as your processor — the terms of that relationship are set out in our Data Processing Agreement.

Information we collect

• Account information — your name, email, password (stored hashed), workspace name, and role.
• Connected-account data — when you connect an Instagram or Facebook account, we receive the tokens and account details needed to send and receive messages on your behalf.
• Conversation data — the direct messages, comments, and profile details of the people who contact your connected accounts, so the assistant can read and reply. This may include names, handles, message content, and any details a person shares in a conversation.
• Configuration you provide — your offer, tone, knowledge base, automations, booking links, and brand settings.
• Billing information — handled by our payment processor (Stripe); we store your plan and a customer reference, not your full card number.
• Usage & technical data — log data, device/browser information, and product usage needed to run, secure, and improve the service.

How we use information

• To operate the service — reading and sending messages, qualifying leads, running automations, and booking calls on your behalf.
• To generate AI replies using the configuration and conversation context you provide.
• To provide support, secure the platform, prevent abuse, and comply with law.
• To bill you and manage your subscription.
• To improve the product. We do not sell personal information, and we do not use your leads' message content to train third-party AI models.

How AI is used

SetterStack uses third-party AI providers to generate replies. Conversation context is sent to these providers solely to produce a response for your account. We choose providers that do not train their models on data sent through our API.

Legal bases for processing (GDPR)

Where the GDPR applies, we process personal data under one or more of these bases:

• Contract — to provide the service you signed up for.
• Legitimate interests — to secure, maintain, and improve the platform and prevent abuse, balanced against your rights.
• Consent — where required (e.g. certain cookies or marketing), which you can withdraw at any time.
• Legal obligation — to comply with applicable law.

For your leads' data that flows through the platform, you are responsible for the lawful basis of contacting them (e.g. their opt-in by commenting your keyword or messaging you first).

Service providers (subprocessors)

We share data with vetted providers only as needed to run the service:

• Supabase — database and storage.
• Vercel — application hosting.
• Anthropic / OpenRouter — AI reply generation.
• Zernio — Instagram/Facebook messaging connectivity.
• Stripe — payment processing.
• Resend — transactional email.

A current list of subprocessors is available on request. We remain responsible for data handled on our behalf.

Meta platform data

Our use of information received from Meta (Instagram/Facebook) APIs follows Meta's Platform Terms and Developer Policies. We use that data only to provide the messaging features you enable, and we honor Instagram and Facebook messaging rules (including messaging-window limits).

Cookies & tracking

We use strictly-necessary cookies to keep you signed in and secure the app, plus a minimal amount of analytics to understand product usage. We don't use advertising trackers that sell your data. You can control cookies through your browser; blocking strictly-necessary ones may break sign-in.

International data transfers

We and our providers may process data in the United States and other countries. Where personal data is transferred across borders, we rely on an appropriate safeguard (such as Standard Contractual Clauses) with the relevant provider.

Data retention

We keep account and conversation data for as long as your account is active and as needed to provide the service. When you delete your workspace, we remove your data on a short, defined schedule (subject to a brief recovery window and any retention the law requires). You can request export or deletion at any time.

Your rights & choices

• Access, correct, export, or delete your data.
• Disconnect a social account at any time from Settings.
• Depending on your region (e.g. GDPR/CCPA), additional rights may apply. Contact us to exercise any of them.

California privacy rights (CCPA/CPRA)

If you're a California resident, you have the right to:

• Know what personal information we collect and how we use it (described above).
• Request access to, or deletion of, your personal information.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information — note we do not sell or share personal information as those terms are defined.
• Not be discriminated against for exercising these rights.

To exercise any of these, email info@setterstack.com.

Security

We use industry-standard measures — encryption in transit, hashed credentials, tenant isolation, and access controls — to protect data. No system is perfectly secure, but we work continuously to keep yours safe.

Children

SetterStack is a business tool not intended for anyone under 18, and we do not knowingly collect their data.

Changes

We may update this policy; we'll post the new version here with an updated date and, for material changes, notify you.

Contact

Questions or requests: info@setterstack.com.