Privacy Policy

1. Who this applies to

This Privacy Policy covers SetBook (“SetBook,” “we,” “us”), the creative-operations platform for photographers, videographers, and production teams. It applies to registered SetBook accounts (“members”), and to the clients, collaborators, and other individuals whose information members store inside SetBook (e.g. Network contacts, contract signers, invoice recipients).

2. Information we collect

Account information. When you sign up, our authentication provider (Clerk) collects your name, email address, and profile image. We store a matching record so the rest of SetBook can reference you.

Business Profile information. Your business name, location, professions, bio, logo, and banking details (used only to display on invoices you generate, see Section 7), and any Discovery profile fields you choose to fill in and opt into showing publicly.

Data about your clients and collaborators. When you use SetBook to manage your own business, you provide us with information about third parties, Network contacts, contract and release signers, invoice recipients, including names, emails, and sometimes addresses or signatures. You are responsible for having a lawful basis to share that information with us; see Section 10.

Content you upload. Portfolio images and videos, project files, business logos, signed documents, and invoice PDFs you upload or that SetBook generates on your behalf.

Waitlist. If you join the waitlist before launch, we store your name, email address, profession, the feature you told us you need most, and an approximate city and country worked out from your IP address (we don’t ask for it, and it can be wrong). We use this only to tell you when SetBook launches and to understand who is interested. It is deleted after launch unless you create an account.

Usage information. Basic technical information (device/ browser type, IP address, pages visited) and preference cookies (e.g. your light/dark theme choice, sidebar collapsed state) needed to make the app work correctly across sessions.

3. How we use information

To operate SetBook’s core features: Projects, Network, Contracts and Releases, Deliverables, Invoicing, Files, and Notifications, and Discovery; to authenticate you and keep your account secure; to send transactional emails (e.g. a contract awaiting signature, an invoice, a reminder); if you turn on client follow-ups, to email your client about an overdue invoice on your behalf, using their name and email address from your project; to send you product news and tips, which you can unsubscribe from at any time; if you leave a review, to publish it in our marketing with your name, profession and business name (see our Terms), until you ask us to stop; to send push notifications to devices you turn them on for; to respond to support requests; and to improve the product based on aggregate, non-identifying usage patterns. We do not sell your information or your clients’ information to third parties, and we do not use your content to train third-party AI models.

4. Discovery

Discovery is opt-in and off until you turn it on. While it’s on, your Discovery profile is visible to anyone signed in to SetBook, including people on free accounts: your name or display name, photo, professions, location, website and Instagram, your projects (photos, videos, titles, links, your role and who they were for) and project likes. On Pro it also shows your bio, skills, languages, past clients, travel dates and the members you credit on projects. On a free account those Pro fields stay saved but are not shown, and only your 3 newest projects (one photo or video each) are shown.

Your email and phone are never shown on your profile. They are shared only with a member whose Network request you accept, or whose profile you add to your own Network, and only if you’ve entered them in your Discovery contact details. We also record who views your profile so we can send you a weekly count.

You can turn Discovery off, or remove any project, at any time from Settings. Removing a project deletes its files. Deleting your account deletes your Discovery profile and every file on it.

Reports. If you report a profile or project, we keep the report, your account and what you told us so we can review it. We don’t tell the member who reported them, except that a formal copyright notice may be shared with them so they can respond, or where the law requires us to disclose it.

5. Where your data lives

Account authentication is handled by Clerk. Application data (business profiles, projects, contracts, invoices, uploaded files) is stored in Supabase (PostgreSQL + object storage). Both are reputable, security-focused infrastructure providers; we don’t operate our own servers for this data. Access to your business’s data is enforced at the database level (row-level security) so that other SetBook members cannot read it, with narrow, deliberate exceptions for the public Discovery fields described in Section 4.

Two other processors handle specific things on our behalf: Stripe processes payment card details and billing for your own SetBook subscription (see Section 7), and Resend delivers transactional emails (contracts and releases awaiting signature, invoices, and account/billing notices) on our behalf. Neither uses your data for anything beyond providing that service to SetBook. If we ever engage an additional sub-processor that handles your personal data, we’ll update this list.

If a data breach occurs that’s likely to result in a risk to your rights, we’ll notify affected users and, where legally required, the relevant regulator (e.g. within 72 hours under the GDPR, or as soon as practicable under the Privacy Act’s Notifiable Data Breaches scheme in Australia) without undue delay.

6. Security

Data in transit between your device and SetBook is encrypted (TLS/HTTPS). Data at rest in our database and file storage is encrypted by our infrastructure providers. We never store your password ourselves -- authentication is handled entirely by Clerk, which stores credentials in hashed, salted form.

Access to your business’s data is enforced at the database level (row-level security), so it’s scoped to your account and the team members you’ve added, not just gated in the app’s interface. We limit internal access to personal data to what’s needed to operate and support SetBook. See Section 5 for what happens if a breach occurs despite these safeguards.

7. Banking details and payments

Your clients’ payments to you. SetBook is not a payment processor for the invoices you send your own clients. Banking details you add in Settings are stored only so they can be printed on invoices you send. SetBook never moves that money, never sees a client’s card or bank details, and has no role in settling that payment. Marking an invoice “paid” inside SetBook is a manual record-keeping action you take yourself.

Your payment for SetBook. This is separate: if you subscribe to SetBook, your card details and billing history for that subscription are collected and processed by our payment processor, Stripe, directly, not by SetBook. We store limited billing metadata (your Stripe customer/subscription id, plan, status, and renewal date) so the product can reflect your subscription, but never your full card number.

8. How long we keep information

We retain your account and business data for as long as your account is active. When you delete your account from Settings, deletion is scheduled 14 days ahead so a mistake can be undone; at the end of those 14 days your account, business data and uploaded files are permanently deleted and cannot be recovered, except where we’re required to keep records for legal, tax, or fraud-prevention reasons, or where data has already been shared with a third party (e.g. a signed contract’s counterparty) as an inherent part of using the product.

Discovery. When your trial or subscription ends, Discovery projects, photos and videos beyond the free limits are hidden and then permanently deleted 90 days later, unless you subscribe again first. Content we remove after a report is taken out of public view and kept privately only for as long as we need it to deal with the report, or longer where the law or the authorities require it. Reports are kept for up to two years so we can deal with repeat breaches.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to certain processing. You can exercise most of these directly from Settings (including deleting your account, under Settings, Account), or submit a Data Subject Access Request (DSAR) via the Privacy option on our Help & Support page, and we’ll respond within a reasonable timeframe (and within any shorter period required by law in your jurisdiction, e.g. 30 days under the EU/UK GDPR).

Australia. We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). If you’re unhappy with how we’ve handled a privacy complaint, you can raise it with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

EU/UK (GDPR). Where the GDPR or UK GDPR applies to you, our legal bases for processing are: performance of a contract (running your account and the features you use), our legitimate interests (keeping SetBook secure and improving it), consent (e.g. optional cookies, where used), and compliance with legal obligations (e.g. tax and billing records). You also have the right to lodge a complaint with your local data protection supervisory authority.

California (CCPA/CPRA). California residents have the right to know the categories of personal information we’ve collected (see Section 2), to delete it, to correct it, and to opt out of the “sale” or “sharing” of it. We don’t sell or share your personal information for cross-context behavioral advertising, and we won’t discriminate against you for exercising any of these rights.

10. If you upload someone else’s information

SetBook is a tool for managing your own business relationships. If you add a client, talent, or collaborator’s information to Network, a contract, or an invoice, you’re confirming you have a lawful basis to do so (e.g. an existing business relationship or their consent) and that you’ll handle their data in line with applicable privacy law. SetBook processes that data on your instructions, as your data processor for that content.

11. International data transfers

Our infrastructure providers (Clerk, Supabase, Stripe, Resend) may store or process data outside your own country, including in the United States. Where we transfer personal information covered by the GDPR/UK GDPR or Australia’s APP 8 (cross-border disclosure) outside its home jurisdiction, we rely on those providers’ own standard contractual clauses and security certifications to keep it protected to a comparable standard.

12. Cookies

We use a small number of cookies to make SetBook work (keeping you signed in, remembering your theme and layout), two that remember a referral or affiliate link you arrived through, and Sentry for error monitoring, which records a masked replay of the moments before an error and of a small share of other visits so we can fix problems. We don’t use advertising or analytics cookies; if that changes we’ll ask for your consent first. Every one is listed in our Cookie Policy.

13. Children

SetBook is a business tool and is not directed at, or intended for use by, children. We don’t knowingly collect personal information from anyone under 16. Content that sexualises or endangers a child is removed and reported to the Australian Centre to Counter Child Exploitation and other relevant authorities, and we keep it securely where the law requires.

14. Changes to this policy

If we make material changes to this policy, we’ll update the “Last updated” date above and, where appropriate, notify you directly.

15. Contact us

Questions about this policy or how your data is handled, or anything else: see our Help & Support page.