Effective date: 13 October 2026
This Privacy Policy explains what personal data Setkin collects, why we collect it, how we protect it, how long we keep it, who we share it with, and the rights you have over it. It applies to the Setkin website, user panel, admin panel, and mobile application (together, "the Platform"). Setkin is a reputation platform that helps service businesses collect, manage, and display verified customer reviews. If you are a business ("Contractor") we are the controller of your account and business data. If you are a customer submitting a review ("Reviewer"), we are the controller of the data you give us to verify your review. Where the Platform is used by a business to collect reviews from its own customers, the business and Setkin may act as joint or independent controllers for different parts of the processing — this Policy describes what Setkin does with that data.
1. Who we are
Setkin ("we", "our", "us") operates the Setkin platform. Our registered office and data protection contact are available on request. Where the GDPR, UK GDPR, or another applicable law requires a Data Protection Officer, contact details will be published on this page. Our representative details (if required by Article 27 GDPR / UK GDPR or the EU) are available on request.
2. Summary of key points
We collect only what we need to run the service, verify reviews, calculate TrustScore, and manage your subscription. We do not sell your personal data. We do not use your review content to build advertising profiles. You have the right to access, correct, delete, and port your data, and to object to or restrict certain processing. We use cookies and similar technologies; you can control them. Reviews are public by design — that is the product. We keep data only as long as necessary. We use industry-standard encryption and access controls. We comply with UK GDPR, EU GDPR, CCPA/CPRA, other US state privacy laws, LGPD, PIPEDA, and the Australian Privacy Act. You can contact us at [email protected] for any privacy question.
3. Information we collect
Account information: name, email address, password hash, preferred language, timezone, and (optionally) a profile photo. Business information: business name, owner name, service area, trades or categories, years of experience, licence and insurance details, profile photo, banner image, and gallery images. Review content: reviews you receive, reply to, or submit, including any photographs attached. Reviewer information: the display name chosen by the reviewer (usually a first name), the email address used to verify the review (hashed where possible and never displayed publicly), and the review text, rating, and any photographs. Payment information: handled by our payment processor (Stripe). We do not store card numbers. Technical information: IP address (hashed where possible), browser type, device type, pages visited, and time on page. Communications: support tickets, replies, and any attachments you send us. Marketing information: your preferences for receiving product updates and marketing, and whether you have opted in or out.
4. Reviews are public by design
When a customer submits a review through a Setkin link or QR code, the review is displayed on the business's public profile page so other customers can read it. The reviewer's display name and the content of the review are public. Reviewer email addresses are never displayed. Businesses cannot edit or delete reviews — only reply. If a review is removed following a dispute, the content is retained in our records for audit and legal purposes but is no longer publicly displayed.
5. How we use your information
To provide and operate the Platform, verify reviews, calculate TrustScore, manage your account and subscription, deliver notifications, detect fraud and abuse, comply with legal obligations, respond to lawful requests from authorities, enforce our Terms of Service, and improve the Platform through aggregated, non-identifiable data. We also use your information to communicate with you about service updates, security incidents, and — where you have opted in — marketing. We do not use your review content to train external AI models.
6. Legal bases for processing (UK GDPR and EU GDPR)
We rely on: performance of a contract (to provide the service you signed up for); legitimate interests (security, fraud prevention, product improvement, and enforcing our Terms); consent (marketing communications, optional cookies, and any sensitive data you choose to provide); legal obligation (tax, accounting, lawful requests from authorities); and, where applicable, vital interests (to protect someone's life). Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
7. Sharing your information
We share data with a small number of carefully selected service providers who help us run the Platform: cloud hosting; transactional email (Amazon SES, Resend); SMS (Twilio); WhatsApp Business (Meta Cloud API); push notifications (Firebase Cloud Messaging); payment processing (Stripe); analytics. Each provider is bound by a data processing agreement and may only process your data on our instructions. We do not sell your personal data. We may disclose information where required by law, to protect our rights or those of our users or the public, or in connection with a corporate transaction such as a merger or acquisition (in which case we will notify you before your data is transferred and becomes subject to a different privacy policy).
8. International data transfers
Some of our service providers operate outside the UK and the EEA. Where we transfer personal data internationally, we rely on approved safeguards: the UK International Data Transfer Agreement (IDTA) and the UK Addendum to the EU Standard Contractual Clauses (SCCs); the EU Standard Contractual Clauses where the transfer originates from the EEA; and adequacy decisions where available. We also carry out transfer risk assessments as required by the ICO's International Transfers Guidance (updated January 2026). You can request a copy of the relevant safeguards by contacting [email protected].
9. How long we keep your information
Account and business data: for as long as your account is active, plus a short period afterwards for backup and legal compliance. Reviews: retained while the business profile is active and for a reasonable period afterwards for audit and dispute resolution. Payment records: kept for the period required by tax and accounting law. Security and audit logs: retained for a limited period for security and incident response. Marketing preferences: retained until you change them or request deletion. When you request deletion, we remove or irreversibly anonymise your data within 30 days, except where we are legally required to keep it longer. If we cannot delete data immediately because of a legal hold or backup cycle, we will restrict processing to the minimum necessary for the required period.
10. Your rights under the UK GDPR and EU GDPR
You have the right to: access a copy of your personal data; correct inaccurate or incomplete data; erase your data (the "right to be forgotten"); restrict or object to certain processing; port your data to another provider; withdraw consent at any time; lodge a complaint with your local supervisory authority; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except in the limited cases permitted by Article 22 of the GDPR. To exercise any of these rights, use the Settings screen of your account or email [email protected]. We will respond within 30 days, or within any shorter period required by applicable law. We may ask you to verify your identity before we act on your request.
11. Your rights under the CCPA and CPRA (California)
If you are a California resident, you have the right to: know what categories of personal information we have collected about you and for what purposes; know the categories of sources and third parties we have shared it with; delete your personal information; correct inaccurate personal information; opt out of the sale or sharing of your personal information (we do not sell or share your personal information for cross-context behavioural advertising); limit the use and disclosure of sensitive personal information (we do not use sensitive personal information for purposes beyond providing the service); and not be discriminated against for exercising your privacy rights. We do not have actual knowledge that we sell or share the personal information of consumers under 16. To exercise your rights, email [email protected] or use the Settings screen. You may use an authorised agent to submit a request on your behalf, subject to verification.
12. Your rights under other US state privacy laws
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and the other states with comprehensive consumer privacy laws in 2026 have broadly similar rights: to confirm whether we process your personal data; to access, correct, and delete it; to obtain a copy in a portable format; to opt out of targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects; and to appeal a decision we make about your request. To appeal, email [email protected] with the subject line "Privacy Appeal". We will respond within the time required by your state's law.
13. Your rights under the LGPD (Brazil)
If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you the right to: confirm whether we process your data; access your data; correct incomplete, inaccurate, or out-of-date data; anonymise, block, or delete unnecessary or excessive data; port your data to another provider; delete data processed with your consent; obtain information about the entities with which we have shared your data; obtain information about the possibility of not providing consent and the consequences of refusal; and withdraw consent at any time. You also have the right to petition the Autoridade Nacional de Proteção de Dados (ANPD). To exercise any of these rights, email [email protected].
14. Your rights under PIPEDA (Canada)
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) — and, in Québec, Law 25 — gives you the right to: know why we collect, use, and disclose your personal information; access the personal information we hold about you; challenge the accuracy and completeness of that information and have it amended as appropriate; withdraw consent, subject to legal or contractual restrictions; and lodge a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial authority. To exercise any of these rights, email [email protected].
15. Your rights under the Australian Privacy Act
If you are in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) give you the right to: know why we collect your personal information and how we handle it; access your personal information; ask us to correct it; make a complaint about a breach of the APPs; and, from 10 December 2026, be told in our privacy policy about any automated decision-making that uses your personal information to make or support decisions that could reasonably be expected to significantly affect your rights or interests. To exercise any of these rights, email [email protected]. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).
16. Automated decision-making and AI
Setkin uses automated systems to calculate TrustScore, detect potential fraud or abuse, and — in the AI-assisted review workflow — to help structure and summarise user content. TrustScore is a proprietary reputation metric calculated from the reviews a business receives. It does not produce legal or similarly significant effects on any individual. AI-assisted content is used only to improve the clarity of what the user has already written, and a human can always override or delete it. Where automated decision-making is used in a way that produces legal or similarly significant effects, we will disclose it as required by Article 22 of the GDPR, the CCPA/CPRA regulations, and — from 10 December 2026 — the amended APPs in Australia. You have the right to request human review of any automated decision that significantly affects you.
17. Cookies and similar technologies
We use cookies, localStorage, sessionStorage, and similar technologies to keep you signed in, protect your session, remember your language and theme preferences, and measure how the Platform is used. Non-essential cookies require your consent in the EU, UK, and other opt-in jurisdictions. In the US, you can opt out of the sale or sharing of your personal information. See our Cookie Policy for the full list of cookies we use, their purposes, and how to control them.
18. Children's privacy
Setkin is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it. We do not sell or share the personal information of consumers we know to be under 16.
19. Security
We protect your data with industry-standard measures: TLS 1.2+ in transit, encryption at rest, AES-256-GCM for stored secrets, role-based access controls, multi-factor authentication for administrative access, and continuous monitoring. No system is perfectly secure. If you suspect a security issue, contact [email protected]. See our Security page for the full detail.
20. Data breaches
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (where required by the GDPR or UK GDPR) and, where the breach is likely to result in a high risk to you, we will notify you without undue delay. We will also notify the relevant authorities under CCPA/CPRA, LGPD, PIPEDA, and the Australian Privacy Act where those laws require it.
21. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or by a prominent notice on the Platform before they take effect. The "Effective date" shown above reflects the most recent version. Continued use of the Platform after the effective date means you accept the updated Policy.
22. How to contact us
For privacy questions, requests, or complaints: [email protected]. For postal enquiries, use the address on our public profile page. If you are in the EU or UK and wish to escalate, you can contact your national data protection authority. If you are in Brazil, the ANPD. If you are in Canada, the OPC. If you are in Australia, the OAIC. If you are in California, the California Privacy Protection Agency (CPPA).
