What we hold about you, who else sees it, and how long we keep it.
Version 2026-08-16
This is an in-house draft under review by our lawyers. It is complete and accurate about how Setu works, and it is what we will operate by. If a reviewed version differs, we will publish it and tell you what changed.
Devalok Design and Strategy Studio Pvt. Ltd., at FF-91, Sector-K, Khajana Complex, Aashiana, Lucknow 226012, Uttar Pradesh, India. For questions about your data, or to exercise any right below, write to grievance@devalok.in.
We are based in India and have not appointed a representative in the European Union. If you are in the EU and want to raise something, write to us directly at that address and we will deal with it.
Your email address and name. Your email is also how we count seats.
Sign-in records: one-time codes, and your Google account identity if you sign in that way.
The country you told us, and your role in each workspace. A department, if you gave one.
A record of which AI tool was used against which brand, which Setu features it called, and each time you dictated a report rather than typing it. This is per person, not anonymous, because it is how we know whether Setu is actually working. For a dictated report we keep when it happened, roughly how long it was and what it cost us to write down. We never keep the recording or link it to the words.
Feedback your AI tool sends us when something was off-brand, including any note it wrote.
Your brand content and files. This is the thing you came here to protect, and we treat it that way.
Billing records: what you were charged and when. Your card details go straight to our payment provider and are not stored on our systems.
When you report a problem: what you wrote, any screenshots you attach, and what the page could see when you reported it — the page address you were on, your browser and window size, the last few error messages in the browser console, the addresses of requests to Setu that failed, and if you are reporting from an error screen, the reference code shown on it, which is a short code that means nothing on its own and only lets us find the matching entry in our own logs. It never includes what you typed into other fields, and it only leaves your browser when you press send.
We do not store your date of birth. We ask you to confirm you are over 18 and keep only that confirmation.
We do not store your card details. We do not build advertising profiles, and we do not sell your data. There is nothing to sell it to.
Running Setu means other companies handle some of your data on our instructions:
Railway: hosting and our database
Cloudflare R2: your brand files and fonts
Anthropic: when Setu itself uses AI to help draft a brand from material you supply, that material is sent to Anthropic. This is the one place your content goes to an AI company because of something we do rather than something you do.
Jina: if you give us a website address that our own reader cannot make sense of, we pass that address to Jina to fetch the page text. Only the address is sent, only when the first attempt has already failed, and never for a file you upload or text you paste.
OpenAI: if you choose to speak a problem report instead of typing it, the recording is sent to OpenAI to be written down. We do not keep the recording — it is dropped as soon as the text comes back, and we never keep it if you discard the recording before sending.
ZeptoMail: the emails we send you
Google: if you sign in with Google
PostHog: product analytics. Sentry: error reports
Stripe and Razorpay: payments
These providers are in several countries, including outside India and outside the EU. Where the law requires safeguards for those transfers, we use the standard contractual clauses.
An agency you have hired is not on this list, because they are not working on our instructions. If you have approved one as a partner and agreed to it, they can see your account — see “When we can see your account”.
Some people at Devalok can open your brand and your workspace to support you. That is how we answer a question about your own account without asking you for a password, and we never ask for your password.
A smaller number of us can also use a feature called “view as”, which shows us Setu exactly as you see it, for thirty minutes at a time. Every use records who did it, when, and why, and that record is kept.
While viewing as you we cannot pay for anything, publish or unpublish your brand book, delete anything, change who owns your workspace, or create an API key. Those need you. Most of us can only look and not change anything at all.
You can ask us at any time whether anyone has viewed your account, and we will tell you who and when. Write to grievance@devalok.in.
We do not read your brand content for any other purpose.
One kind of person outside Devalok can also see your account: an agency you have hired and approved as a partner. This only happens if you have agreed to it for that agency, they see Setu as the person who owns your workspace, they can look and change nothing at all, each session lasts thirty minutes, and every one is recorded. You can withdraw that agreement at any time, and it stops immediately.
Records of AI tool use, and feedback notes, stop being linked to you after 90 days. After that we keep only counts, which we keep indefinitely to understand how Setu is used.
Your account and brand content stay until you delete them.
Deleting a brand removes it. Deleting a whole workspace keeps it recoverable for 30 days, in case you did not mean to, and it is then removed permanently. Either way the public books come down, AI access stops, and the brand stops being served the same second you delete it.
One thing survives deletion: the record that you gave permission to publish something. That is evidence, and we would need it if someone ever disputed rights to your material.
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Write to grievance@devalok.in and we will respond within 30 days.
You can download your brand file at any time without asking, including while your workspace is paused.
If you consented to marketing email, you can withdraw that at any time and every marketing email has an unsubscribe link. Emails about your account, your trial, and your payments are part of the service and are not marketing.
We use a cookie to keep you signed in. That is necessary for the product to work.
Our analytics do not store anything on your device between visits.
Published brand books set no cookies at all.
Setu is for businesses and is not for anyone under 18. We ask you to confirm your age when you set up, and we will close an account we learn belongs to a child.