SetToRunLegal

Privacy Policy

Last updated September 21, 2026

SetToRun (“SetToRun”, “we”, “us”) runs everyday parts of your business — replies, follow-ups, contacts, invoices, email and stock — through named automations called Runners that you connect and configure. This page explains what data we collect to do that, why, how long we keep it, who else processes it, and how to get it back or have it deleted.

This policy is written for a United States product and audience. We do not currently make GDPR-specific disclosures, state a lawful basis under EU law, or offer an EU–US data transfer mechanism, because we do not yet market to or knowingly serve EU-resident customers. If that changes, this policy will be rewritten before it does.

Who is responsible for your data

The data controller for SetToRun is:

[LEGAL ENTITY NOT YET REGISTERED — TODO(entity)]
[TODO(entity): jurisdiction of incorporation]
[TODO(entity): registered business address]
[email protected]

The registered entity above is not yet finalized. This section will be updated with the incorporated entity’s legal name, address and jurisdiction before this policy is relied on for a live account.

What we collect

We collect three kinds of data:

  • Account data. Your name, email address, and password or sign-in credential, plus billing information once billing is live.
  • Connected-channel content. When you connect an Instagram or Facebook account, SetToRun processes the comments and direct messages sent to that account so your Runners can classify them and reply on your behalf. This includes the message or comment text, sender identifiers Meta provides to us, timestamps, and any attached media URLs. We only access what the Meta permissions you grant allow, and only for accounts you connect.
  • Data your Runners create. Contacts, conversation history, saved replies, invoices and stock records you or your Runners create while using SetToRun.
  • Usage and log data. Pages visited, actions taken in the product, IP address, browser and device information, and error reports.

Why we collect it

  • To operate the Runners you turn on — replying to comments and direct messages, tracking contacts, generating invoices, sending email, and tracking stock.
  • To show you what your Runners did, in the night log and the dashboard.
  • To secure your account and investigate abuse or platform-policy violations.
  • To bill you, once billing is live.
  • To improve the product — in aggregate, and never by selling your data or your customers’ data.

We do not use the content of your Instagram or Facebook messages to train third-party models beyond the AI processing described below, and we do not sell your data or your contacts’ data to anyone.

Where your data is hosted

Our database and application servers run in the United States (us-east-1, Northern Virginia, and iad1). We do not currently operate infrastructure outside the United States.

Who else processes your data

We use the following third-party processors to run SetToRun. Each only receives the data it needs to perform its function.

  • Meta Platforms, Inc. — the Instagram and Facebook APIs your connected accounts use, and the source of the comment and message content Runners act on.
  • Anthropic. — processes message and comment text to classify intent and draft replies. We send only what a Runner needs to do its job, not your full conversation history, unless a feature explicitly requires it.
  • Supabase, Inc. — our database, authentication and file storage provider. All application data is stored here.
  • Vercel Inc. — hosts the SetToRun application and webhook infrastructure.
  • Resend. — sends transactional and, if you enable it, outbound email on your behalf.
  • Stripe, Inc. — processes payments once billing is live. We do not store full card numbers.
  • Sentry. — receives error reports so we can fix bugs. Error reports are scrubbed of message content where possible.

How long we keep it

  • Account data and Runner-created records (contacts, invoices, stock) are kept for as long as your account is active.
  • Raw inbound webhook payloads from Meta — the exact request bodies containing message text — are retained for a limited window needed for processing and debugging, then their content is purged on a rolling basis. The structured record of what happened (who contacted you, what a Runner did) is kept separately, for as long as your account is active.
  • If you delete your account, we delete or anonymize your data on the timeline described in our data deletion page, including revoking and deleting any stored access tokens for your connected accounts.

Your rights: export and deletion

You can request a copy of your data or request that it be deleted at any time, whether or not you are in a region that legally requires it. See Data Deletion for the exact steps. Export requests are handled the same way: email [email protected].

Children

SetToRun is a business tool. It is not directed at children, and we do not knowingly collect data from anyone under 16.

Changes to this policy

If we make a material change to this policy, we will update the date at the top of this page and, where required, notify you directly.

Contact

Questions about this policy: [email protected].