Privacy policy

Who we are

The service is published and operated by Vincent Acard, sole proprietor trading as SetScale (SIREN 502 384 027, RCS Nanterre, 21 rue d'Arcueil, 92120 Montrouge, France; full details in the legal notice). Contact: privacy@setscale.io. Application hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States.

SetScale is an AI setter: it answers the direct messages your prospects send you on Instagram, WhatsApp and Messenger, asks the qualifying questions you wrote, and books calls in your calendar. This policy covers both the public website and the application.

Two kinds of data, two different roles

This distinction decides everything else, so it comes first.

• Your data, as a SetScale customer. We are the data controller. This is your account, your subscription and how you use the product.
• Your prospects' data. You are the data controller, we are your processor. We process those conversations on your instructions, to deliver the service you configured. We never use them to contact your prospects for our own purposes, and we do not sell or rent them.

What we collect about you

• Account: email address, name if you give one, password hash, sign-in events.
• Organisation and workspaces: the name you choose, your team members and their roles, the channels you connect.
• Billing: plan, subscription status, invoices. Payment is handled entirely by Stripe. We never see, hold or store your card number.
• Product usage: AI messages consumed against your monthly allowance, errors, and technical logs needed to keep the service running.

What your AI setter processes about your prospects

When you connect a channel, we receive from Meta the messages your prospects send you and the replies sent back. Concretely, we store:

• the content of the conversation, in both directions, and its timestamps;
• the messaging identifier and the public display name or handle the platform gives us;
• the profile your setter fills in from what the prospect actually said: goal, situation, budget, objections, whatever your script asks for;
• the calls booked, their slot, their owner, and whether they were held.

Voice notes and images sent by a prospect are read once by an AI model, then dropped. They are never written to our storage, and we do not keep a copy of the media hosted on Meta's content network.

AI disclosure and opt-out

Your prospects are told they are talking to an AI assistant in the first reply they receive. That disclosure is part of the product and cannot be switched off.

If a prospect writes STOP, or any opt-out word configured on your workspace, the setter sends one acknowledgement and the contact is flagged do-not-contact: no further replies, no follow-ups, no campaigns. A prospect can also ask for a human, and you take the conversation back.

Why we process this data

• To perform our contract with you: running your account, your setters and your subscription.
• On your instructions, as your processor: answering and qualifying the conversations in your connected channels.
• Legitimate interest: securing the service, preventing abuse, and measuring how the public website is visited.
• Legal obligation: keeping invoices for the period French law requires.

Subprocessors

We use a small number of providers, and each one does exactly one job:

• Supabase: database, authentication and file storage. Our project runs in the Paris region (eu-west-3), inside the EU.
• Vercel: hosting of the website and the application. Our server functions run in the Paris region.
• OpenRouter and the model providers it routes to: processing of the conversation so the setter can reply. This involves a transfer to the United States, covered by the standard contractual clauses of the providers concerned.
• Stripe: payment, subscriptions and invoices.
• Meta: the official Instagram, Messenger and WhatsApp Business APIs. Messages travel through Meta under their own policies, which apply to you as the account holder.
• Resend: transactional emails (welcome, invitations, daily recap).
• Google Analytics 4, on the public website only. It never runs inside the application, so it never sees a conversation.

Cookies

The application sets the cookies needed to keep you signed in. There is no advertising cookie anywhere on this domain.

On the public website, Google Analytics 4 relies on cookies to measure pages viewed, traffic sources and approximate location. You can block or delete cookies at any time in your browser settings; the site works without them.

How long we keep it

Conversations, contacts and bookings are kept for as long as your account exists, because that history is the product: it is what lets you read what your setter said and correct it.

When you delete your organisation from the settings, its workspaces, conversations, contacts and bookings are deleted with it. Invoices are kept separately for the period French accounting law requires. You can ask for an export of your data at any time.

Requests from public authorities

If a public authority asks us for personal data, we check that the request is lawful and properly addressed to us, we challenge it when we consider it unlawful, we disclose only the minimum data strictly required, and we keep a record of each request, of our answer and of the legal reasoning behind it. We have received no such request to date.

Your rights

Under the GDPR you can ask us to access, correct, export or delete the data we hold about you, to restrict or object to a processing, and to withdraw a consent. Write to privacy@setscale.io from the address on your account and we will answer within one month.

If a request concerns a prospect rather than a SetScale customer, we forward it to the customer whose workspace holds the conversation: they are the controller for that data, and we act on their instructions. You can also lodge a complaint with the CNIL.

Automated decision-making

The setter writes replies and qualifies a conversation according to the script you wrote. It produces no decision with a legal or similarly significant effect on a person, and it only ever proposes time slots your calendar actually returned. You can read every conversation in full and take any of them back in one click.

Security

Data is isolated per organisation at the database level. Channel access tokens are encrypted before storage. Access by us is limited to what operating and supporting the service requires. If a breach affects your data, we will tell you.

Changes

We will update this page when the product changes, and the date at the top is the one that counts. A change that materially affects how your data is processed will be announced by email.