Setu

by Vantelyx (opens in a new tab)

How Setu uses Meta Platform Data

Last updated 15 October 2026

Setu is a SaaS platform operated by Vantelyx. Businesses connect their own Instagram, Facebook Messenger and WhatsApp Business accounts to Setu. Data Setu receives from Meta for a connected account ("Platform Data") is used only to provide Setu to the business that connected it, in line with Meta's Platform Terms and Developer Policies. This page summarises the details; the Privacy Policy is the full statement.

How a business authorises Setu

  • The workspace owner signs in to Setu and chooses Connect for a channel. Only the owner can connect or disconnect channels.
  • Meta's own login opens: Instagram Login for Instagram, Facebook Login for Business for Messenger (the business then picks one of its Pages), and WhatsApp Embedded Signup for WhatsApp. The business sees the permissions below and agrees to them there.
  • Meta gives Setu an access token for that account. Setu encrypts it before storing it and subscribes the account to the message webhooks Setu needs.
  • The business can disconnect the account in Setu, or remove Setu in its Meta settings, at any time.

Permissions and what they are used for

Instagram

  • instagram_business_basic: the connected professional account's id and username, so Setu can show which account is connected and route its messages to the right workspace.
  • instagram_business_manage_messages: receive the account's direct messages and message events, send the business's replies, look up a customer's name and username, and import recent conversations for context when the account is first connected.

Facebook Messenger

  • pages_show_list: list the Pages the person manages, so they can choose which Page to connect.
  • pages_manage_metadata: subscribe the chosen Page to Setu's message webhooks, and unsubscribe it on disconnect.
  • pages_read_engagement: read the chosen Page's name, profile picture and Page access token, so Setu can connect it and show it in Connections, and list the Page's Messenger conversations when it is first connected, so recent conversations (up to the 20 most recent messages in each) can be imported for context. Setu does not read the Page's posts, comments or insights.
  • pages_messaging: receive messages, postbacks and message events sent to the Page, and send the business's replies, product cards and typing indicators.
  • Business Asset User Profile Access: the customer's first and last name, so the business can see who it is talking to. Profile photos are not requested.

WhatsApp Business

  • whatsapp_business_management: read the connected WhatsApp Business account and phone number, subscribe it to Setu's webhooks (and unsubscribe it on disconnect), list the business's approved message templates, and check the number's health once a day.
  • whatsapp_business_messaging: receive messages and delivery statuses, send the business's replies, product links and approved templates, mark messages as read, and download a photo a customer sends when they ask for similar products.

For a number connected from the WhatsApp Business app (WhatsApp "coexistence"), Setu asks WhatsApp once, within 24 hours of connecting, to share the app's chat history. WhatsApp sends it only after the business approves in the app: up to 6 months of one-to-one chats, without group chats, with photos and files only as a label. Setu imports these messages for context. The contact list WhatsApp sends alongside is not stored.

Setu never creates or submits WhatsApp templates, never messages people who have not contacted the business, and sends replies only inside each channel's messaging window (or, on WhatsApp, with the business's approved templates).

What Setu stores

  • Messages, their delivery and read state, reactions and edits, in the business's workspace.
  • The customer's platform-scoped id, name or username, and for WhatsApp the phone number. No profile photos.
  • Attachments: only the kind of attachment, never the file or its link. A product photo is downloaded for a moment to describe the product with Google Gemini and is not stored; the description is removed after 24 hours.
  • Orders a customer places in a conversation, with the delivery details they give.
  • The encrypted access token and the account id, so Setu can receive and reply for the business.

What Setu does not do

  • Sell Platform Data, or share it with anyone except the service providers listed in the Privacy Policy.
  • Use it for advertising, profiling, or to train AI models.
  • Use one business's data for another business, or show it to anyone outside that business's team.

Security

Data is encrypted in transit. Access tokens are also encrypted at rest (AES-256-GCM) with a key kept in a secret manager, separate from the database. Webhooks and Meta's deauthorize and data deletion callbacks are accepted only with a valid Meta signature. Each workspace's data is visible only to its members, according to their role.

Disconnecting and deleting

  • Disconnect in Setu: Connections → Disconnect deletes the access token and the link that routes the account's messages straight away. Existing conversations stay in the workspace until they are deleted.
  • Remove Setu in Meta settings: for Instagram and Facebook logins, Meta tells Setu through its deauthorize callback and Setu deletes the token in the same way. For WhatsApp, also choose Disconnect in Setu.
  • Data deletion request: sent through Meta, it also deletes that channel's stored conversations; the person gets a confirmation code and a status link. See the data deletion page.
  • Delete the workspace: the owner can delete everything from Settings → Business → Danger zone, or email hello@vantelyx.dev.

Channel availability

Instagram is in Meta App Review. Messenger and WhatsApp support is built and awaiting Meta App Review. Each channel becomes available to businesses outside Setu's own test accounts only after Meta approves it.