Privacy Policy
What Setu collects, why, who processes it and what you can do about it.
Last updated 27 September 2026.
Who is responsible
Setu, India, decides how Setu uses the personal data of its users and is responsible for it. For data your business brings about its own customers and contacts, your business decides and Setu processes it for you (see the Terms, "Personal data you bring").
What we collect and why
Account: your name, email and profile photo from Google sign-in, to create and secure your account. Company: what you and your team enter (employees, knowledge, tasks, drafts, approvals, comments, connections, billing details), to run your company as you direct. Billing: payment references and your billing details, to bill your plan and meet tax law. Usage and security: measured AI usage and costs, audit records of actions, and technical logs (request ids, errors, timings) that hold no task content, to keep the service secure and bill correctly.
Customer messages that reach your employees through WhatsApp or email are stored so replies can be prepared; they are your customers' data, processed on your instructions.
How we use it
To run your company as you direct: prepare drafts, route work, enforce approvals and limits, send the notifications you asked for, bill your plan, and keep the service secure. We do not sell personal data, we do not use advertising, and we do not use your company's content to train AI models.
Who processes data for us
DigitalOcean runs Setu and stores the database (India, Bengaluru). DigitalOcean Spaces stores the original files you upload, encrypted with Setu's own key (Singapore, because the India region does not accept new storage at this time). Temporal Cloud coordinates long-running work (India, Mumbai).
Google provides sign-in (global). Cashfree Payments processes payments (India); we never see or store card or UPI details. Brevo sends invitations and notifications by email (European Union). Meta's WhatsApp Business Platform sends WhatsApp notifications and carries customer WhatsApp messages you connect (global). Composio manages sign-ins to apps you connect (United States). E2B runs code your AI employees write in an isolated sandbox (United States).
OpenAI and Anthropic process task content for runs that use Setu's own AI accounts (United States). With your own key, the provider you chose processes it under its own terms.
Services you connect yourself (Gmail, Shopify, GitHub, HubSpot, Razorpay, a database you supply and others) receive only the calls your AI employees make with your approval, and their own terms apply.
Transfers outside India
Some of these providers store or process data in Singapore, the United States or the European Union. We transfer personal data only to countries the Government of India has not restricted, and only to providers bound by written terms to protect it and use it only to provide their service to us. We update this list here and email account owners at least 15 days before adding a provider that handles your company's content.
Security
Keys, tokens and connection strings are encrypted at rest. Each company is isolated at the database level. Every external write is approved by you or by an automatic rule you set, and is recorded. Sessions use secure cookies; the site uses HTTPS only.
If something goes wrong
If personal data we hold is breached, we act at once to contain and investigate it. Where the law requires, we report it to CERT-In within 6 hours of noticing it and to the Data Protection Board of India. We tell affected users without delay, by email and in Setu: what happened and when, the likely effects, what we have done, what you can do, and whom to contact. If the breach affects data we process for your business, we tell the account owner within 24 hours of becoming aware of it.
Your rights
Under the Digital Personal Data Protection Act, 2023 you can: get a summary of the personal data we hold about you, how we use it and who we shared it with; have it corrected, completed or updated; have it erased unless the law requires us to keep it (for example billing records); withdraw any consent you gave, as easily as you gave it (this does not affect what was done before, but we may then be unable to provide some or all of the service); nominate another person to use these rights if you die or become unable to; and complain to our Grievance Officer and then to the Data Protection Board of India.
You can edit your profile, export your company and delete your company yourself in Settings. For anything else, email [email protected] from your account email with the subject "Data request". We may ask you to confirm your identity. We reply within 15 days, free of charge. If you are a customer of a business that uses Setu, please contact that business first; we will help it respond.
Retention
Company data stays while your account exists. When you delete your company, every record we hold for it is removed except billing records we must keep; backups kept by our hosting provider roll over within 7 days. Guest demo companies are deleted 7 days after creation unless claimed. Billing and payment records are kept for 8 years, as tax and company law require. Audit records of actions stay with your company's history.
Operational records are removed on a schedule: sign-in sessions one day after they end; live-update copies, saved replies to repeated requests and expired one-use links after 30 days; incoming request receipts and sent notifications after 90 days; send records after 180 days. Your company's history, work, knowledge and billing records are not removed by this schedule.
Children
Setu is a business service and you must be at least 18 to use it. We do not knowingly collect personal data of anyone under 18. Do not upload data about children unless the law allows it and you have verifiable consent from a parent or lawful guardian. If you believe a child's data has reached us, write to [email protected] and we will delete it.
Cookies
Setu uses only the cookies needed to keep you signed in and to protect forms. No advertising or tracking cookies.
Contact and changes
Setu, India. Customer support: [email protected] · Monday to Saturday, 10 am to 6 pm IST. We may update this policy; the date at the top shows the current version, and we email account owners about material changes.
Grievance Officer
For a complaint about Setu, a payment, content on the service, or how we handle personal data, contact our Grievance Officer:
Grievance Officer · Email: [email protected] · Address: Setu, India
We acknowledge a complaint within 24 hours and resolve it within 15 days of receiving it. The Grievance Officer is also the contact for any question about how we process personal data. If you are not satisfied with our answer on a personal-data complaint, you may complain to the Data Protection Board of India.