Privacy Policy

Effective date: [[TO FILL: effective date]]

This Privacy Policy explains how Setl Solutions ("we", "us") collects, uses, stores and shares information when you use the Setlfi web application at https://www.setlfi.com and its related services (the "Service").

1. Who we are

The Service is operated by Setl Solutions, registered at [[TO FILL: registered address]], company registration number [[TO FILL: registration number]]. For any question about this policy or your data, contact us at [[TO FILL: contact e-mail]].

2. Information we collect

Account information. Your name, e-mail address, the project and organization you belong to, your roles and permissions, and your password (stored only as a one-way hash). If you turn on two-factor authentication or register a passkey, we store what is needed to verify it.

Google account information. If you choose to link a Google account and sign in with it, we receive the limited information described in section 3.

Content you provide. The financial and business data you or your organization upload to or create in the Service: files, data collections, reconciliation jobs, reports, forms, dashboards, messages in team chat, conversations with the in-app assistant, voice messages and call media, support requests and their attachments.

Usage and technical information. Log records of requests made to the Service (time, IP address, browser user agent, the action performed), an audit log of changes made within a project, and the cookies described in section 9.

3. Google user data

You can link a Google account to your existing Setlfi account and then use "Sign in with Google". Signing in with Google is optional; a password or a passkey works as well. A Google account can only be used to sign in to a Setlfi account it has been linked to — it does not create a Setlfi account by itself.

Scopes we request. When you sign in with or link a Google account, Setlfi requests only these OAuth scopes:

• openid — to confirm your identity with Google and receive your Google account's unique identifier;
• email — to receive your Google account's e-mail address and whether Google has verified it.

We do not request the profile scope or any other Google scope, and we do not access your Gmail, Google Drive, Calendar, Contacts or any other Google service.

What we store. We store your Google account's unique identifier, its e-mail address at the time you linked it, and the dates you linked it and last used it to sign in. We do not store Google access tokens or refresh tokens.

How we use it. The Google account identifier is used only to recognise you when you sign in with Google. The Google e-mail address is used only to show you, on your Account page, which Google account is linked, and to record in the audit log (section 2) which Google account was linked, used to sign in or unlinked. We do not use Google user data for any other purpose.

What we do not do. We do not sell Google user data. We do not share or transfer it to third parties, except where required by law. We do not use it for advertising, including personalized, retargeted or interest-based advertising, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models. No person at Setl Solutions reads it, except with your explicit consent, for security purposes, or where required by law.

Limited Use. Setlfi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing it. You can unlink your Google account at any time on your Account page in Setlfi; unlinking deletes the stored Google account identifier and e-mail address. The audit log entries that name the Google e-mail address — when it was linked, used to sign in and unlinked — are not deleted by unlinking; they are kept for the period described in section 7. You can also revoke Setlfi's access from your Google Account settings at myaccount.google.com/permissions.

4. How we use information

We use the information described above to:

• provide, operate and maintain the Service, including signing you in and keeping your session secure;
• process the data you ask the Service to process — reconciliation, reporting, analytics and the in-app assistant;
• send you service messages you have asked for or that are necessary, such as password-reset e-mails, alerts and notifications;
• provide support and respond to your requests;
• detect, prevent and investigate security incidents, fraud and abuse, and keep an audit trail of changes;
• comply with legal obligations.

We do not sell your personal information and we do not use your content for advertising.

5. Where we store information

Your information is stored on servers operated by or for Setl Solutions, located in [[TO FILL: hosting provider(s) and country / region of the servers]]. Backups are stored in [[TO FILL: backup storage provider and region]].

6. Who we share information with

We share information only with:

• service providers that process it on our behalf to run the Service — hosting and backup storage, e-mail delivery, real-time audio and video infrastructure, speech-to-text and text-to-speech, and AI model providers that power the in-app assistant. They may use the information only to provide their service to us. The current list is: [[TO FILL: list of sub-processors and what each one does]];
• members of your organization within the Setlfi projects you belong to, according to the roles and permissions your organization's administrators assign;
• authorities, when required by law or to protect the rights, property or safety of Setl Solutions, our users or others;
• a successor, in connection with a merger, acquisition or sale of assets, under the terms of this policy.

Google user data described in section 3 is not shared with any of these parties.

7. How long we keep information

We keep account information and content for as long as your account or your organization's subscription is active, and for as long as necessary to provide the Service, comply with legal obligations, resolve disputes and enforce our agreements. Some records — audit logs, closed support requests, backups — are kept for a limited further period. [[TO FILL: specific retention periods, if they are to be stated]]

8. Your choices and rights

Access and correction. You can view and update your account details on your Account page.

Deleting your account or data. Your organization's administrator can remove your account from a project. To request deletion of your account and the personal data associated with it, contact us at [[TO FILL: contact e-mail]]. We will delete or anonymise it within [[TO FILL: deletion time frame]], except where we must keep it to comply with law. Data your organization uploaded to the Service is controlled by your organization; requests about it should be made to your organization as well as to us.

Depending on where you live, you may also have the right to object to or restrict processing, to data portability, and to lodge a complaint with a data-protection authority.

9. Cookies

The Service uses only the cookies needed for it to work: session cookies that keep you signed in (the session tokens themselves are HTTP-only and cannot be read by scripts), a short-lived cookie that binds a "Sign in with Google" attempt to your browser, and preference cookies such as your interface language. We do not use advertising or third-party tracking cookies.

10. Security

We protect information with encryption in transit (HTTPS), hashed passwords, optional two-factor authentication and passkeys, role-based access control and audit logging. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of a breach where the law requires it.

11. Children

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the effective date above; if the changes are significant we will let you know through the Service or by e-mail.

13. Contact

Setl Solutions [[TO FILL: registered address]] E-mail: [[TO FILL: contact e-mail]]