This Privacy Policy explains how JMSP 3 LLC, doing business as Setu (“Setu,” “we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with the Setu website operations platform, including setuop.com and the Setu account dashboard (collectively, the “Platform”).
This Privacy Policy applies to: (1) visitors to setuop.com, (2) prospects who request a demo or contact Setu, and (3) Setu account holders (“Clients”) and their authorized team members who use the Platform to build and manage websites. It does NOT govern the privacy practices of individual websites built by Setu for its Clients. Each Client website operates under its own privacy notice, which the Client is responsible for providing to its own visitors. See Section 9 below for the distinction.
1. Information We Collect
1.1 Information You Provide Directly
- Account information: name, email address, business name, phone number, billing address
- Authentication information: password (stored as a salted hash, never in plain text), or Google OAuth identifiers if you sign in with Google
- Payment information: processed entirely by Stripe, Inc. Setu does not directly receive or store full payment card numbers
- Communications: messages you send us via email, contact forms, or support requests, including the content of those messages
- Content you upload to the Platform: website content, images, and other media you create or upload using the Setu CMS, which is Client Content owned by you under the Master Service Agreement
1.2 Information Collected Automatically
- Usage data: pages visited, features used, timestamps, session duration, and general interaction patterns within the Platform
- Device and technical data: IP address, browser type, operating system, device identifiers, and approximate location derived from IP address
- Log data: server logs, audit logs of account actions, and login events including IP address, user agent, and timestamp, retained for security and operational purposes
- Cookies and similar technologies: see Section 5 below
1.3 Information from Third Parties
- If you sign in using Google OAuth, we receive your name, email address, and profile information as authorized by Google and by you
- Payment and billing status information from Stripe, including subscription status and payment history
2. How We Use Information
We use the information described above for the following purposes:
- To create and administer your Setu account and provide the Platform and Services described in the Master Service Agreement
- To process payments and manage billing through Stripe
- To communicate with you, including transactional emails (billing notices, security alerts, form submission notifications) and, where applicable, responses to support requests
- To monitor, maintain, and improve the security, stability, and performance of the Platform
- To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Acceptable Use Policy
- To comply with legal obligations and respond to lawful requests from public authorities
- To send you operational and administrative communications. We do not use your information to send marketing communications without your consent, and you may opt out of any non-essential communications at any time
3. Legal Basis for Processing
Where applicable law requires a legal basis for processing personal information, Setu relies on: performance of a contract (to provide the Services you have signed up for), legitimate interests (to secure and improve the Platform), compliance with legal obligations, and, where applicable, your consent.
4. How We Share Information
We do not sell your personal information. We share information only as described below:
4.1 Sub-Processors and Service Providers
We engage the following third-party service providers to operate the Platform. This list mirrors the sub-processor disclosure in our Master Service Agreement:
- Cloudflare, Inc. — CDN, hosting infrastructure, domain routing, media storage, Workers runtime
- Neon Technologies, Inc. — PostgreSQL database hosting
- Railway Corp. — Backend API hosting, Redis cache, background job processing
- Amazon Web Services, Inc. — Automated site backups
- Stripe, Inc. — Payment processing and subscription management
- Resend, Inc. — Transactional email delivery
- Google LLC — Authentication (Google OAuth) and analytics integrations, where enabled
Each of these providers is contractually bound to use information only as necessary to provide their services to Setu and is subject to its own privacy and security practices.
4.2 Legal and Safety Disclosures
We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Setu, our Clients, or others, or to investigate fraud or security issues.
4.3 Business Transfers
If Setu is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.
5. Cookies and Tracking Technologies
Setu uses cookies and similar technologies on setuop.com and within the Platform dashboard for the following purposes:
- Essential cookies: required for authentication, session management, and core Platform functionality. These cannot be disabled without affecting the ability to use the Platform
- Analytics cookies: used to understand how visitors use setuop.com, where enabled
You can control cookies through your browser settings. Disabling essential cookies may prevent you from logging in or using core features of the Platform.
This section governs cookies on setuop.com and the Setu dashboard only. Cookie consent on individual Client websites is the responsibility of the Client — see Section 9.
6. Data Retention
We retain account and Client Content for as long as your account is active. Upon termination of your account, consistent with the Master Service Agreement, Setu retains your data for thirty (30) days to allow you to request an export. After that period, Setu may permanently delete your account data, including Client Content, website configuration, and account records, and has no further obligation to retain it.
Audit logs, security logs, and records necessary for legal, tax, or compliance purposes may be retained for longer periods as required by applicable law.
7. Data Security
Setu implements commercially reasonable technical and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and destruction, including TLS/SSL encryption in transit, encrypted credential storage, access controls, audit logging, and multi-factor authentication options for administrative accounts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
In the event of a confirmed security incident affecting your data, we will notify you without unreasonable delay, consistent with our obligations under the Master Service Agreement and applicable law.
8. Your Rights and Choices
Depending on your location, you may have rights regarding your personal information, which may include the right to access, correct, delete, or export your data, and the right to object to or restrict certain processing. To exercise these rights, contact us at setuoperations@gmail.com. We will respond within a reasonable time and in accordance with applicable law.
Tennessee residents have rights under the Tennessee Information Protection Act (TIPA). California residents may have rights under the California Consumer Privacy Act (CCPA). If you are located in the European Economic Area, you may have rights under the General Data Protection Regulation (GDPR). Setu’s primary client base is United States-based small and mid-sized businesses; if you believe a specific regional privacy law applies to you, please contact us and we will address your request under the applicable framework.
9. Important Distinction: Setu’s Data vs. Your Website Visitors’ Data
This Privacy Policy governs information Setu collects directly — as the operator of setuop.com and the Setu dashboard. It does NOT govern personal information that visitors submit through contact forms, quote requests, or other lead-capture tools on a Client’s individual website built using the Setu Platform.
As set forth in the Master Service Agreement (Article 8.1), with respect to that visitor data, the Client is the data controller and Setu acts only as a data processor on the Client’s behalf, following the Client’s instructions and using the data solely to provide the Services. Each Client is solely responsible for providing its own privacy notice to its website visitors, obtaining any required consents, and responding to data subject requests related to its own website. If you submitted information through a contact form on a business’s website built with Setu, please contact that business directly regarding your data.
10. Children’s Privacy
The Platform is intended for business use by adults. Setu does not knowingly collect personal information from individuals under the age of 18. If we become aware that we have inadvertently collected such information, we will take steps to delete it.
11. International Data Transfers
Setu’s infrastructure and service providers operate primarily within the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy with a revised Effective Date. Material changes will be communicated via email or prominent notice on the Platform. Your continued use of the Platform after changes take effect constitutes acceptance of the revised policy.
13. Contact Us
Questions about this Privacy Policy or our data practices can be directed to JMSP 3 LLC, d/b/a Setu at setuoperations@gmail.com or www.setuop.com.