Setu

by Vantelyx (opens in a new tab)

Privacy Policy

Last updated 15 October 2026

Setu is a software-as-a-service platform operated by Vantelyx ("we", "us"). Shops ("businesses") connect their own Instagram, Facebook Messenger and WhatsApp Business accounts to Setu to answer customer messages and to turn those conversations into orders. This policy explains what information Setu handles, why, and the choices available to businesses and their customers. A short summary of the Meta permissions Setu uses is on How Setu uses Meta Platform Data.

Who is responsible

For a business's own account data, Vantelyx is the controller. For messages a customer sends to a business, the business decides how its conversations are handled and Vantelyx processes that information on the business's behalf.

Information we handle

  • Business accounts: name, email address, sign-in details (through Google or email and password), workspace settings, team members and roles.
  • Connected channels: when a business connects Instagram, a Facebook Page or a WhatsApp Business number, we receive the account or Page identifier, its name or username, phone number (for WhatsApp), the permissions the business granted, and an access token that lets Setu receive and reply to messages. Tokens are encrypted before they are stored.
  • Customer conversations: messages customers send to a connected business, the sender's platform-scoped identifier, and the replies sent by the business or by Setu's assistant. For attachments we keep only the kind of attachment (for example "image"), not the file or its link.
  • Product photos: when a customer sends a photo of a product and asks about it (for example "do you have one like this?"), Setu downloads the photo from Meta for a moment and sends it to an AI model (Google Gemini) to describe the product (type, colours, pattern, cut), then looks for similar products in the business's catalogue. On WhatsApp, Meta gives Setu a short-lived download for the photo, which Setu fetches with the business's access token. Setu does not store the photo or its link, and does not identify or describe people in it. Only the product description and the matching product identifiers are kept, with the message event, for 24 hours. A photo sent on its own while a payment link is open is not read unless the customer's next message asks for products like it.
  • Customer names: for Instagram, Setu looks up the customer's name and username; for Messenger, the customer's first and last name when Meta allows it; for WhatsApp, the profile name and phone number WhatsApp includes with each message. This lets the business see who it is talking to. We do not fetch or store profile photos.
  • Message activity: reactions, read receipts, edits and unsent messages from the customer, and whether each reply was delivered or read (with Meta's error code when it wasn't). When a customer unsends a message, Setu removes its text and attachments.
  • Replies sent outside Setu: when a business replies from the Instagram app, Meta Business Suite or Messenger, or from the WhatsApp Business app on a number that also uses Setu, Meta sends Setu a copy (an "echo"). Setu shows it in the conversation and pauses the assistant for that conversation.
  • WhatsApp templates: outside WhatsApp's 24-hour reply window, a team member can send one of the business's Meta-approved message templates. Setu reads the list of approved templates and stores the template name and the values the team member typed with the message, which are kept as part of the conversation. Setu never creates or submits templates.
  • Earlier conversations: when a business connects Instagram or a Facebook Page, Setu imports its recent conversations: up to the 20 most recent messages in each, which is all Instagram and Messenger provide. Message requests that have been inactive for 30 days are not included. When a business connects a number that already uses the WhatsApp Business app, Setu asks WhatsApp for its chat history; WhatsApp shares it only if the business approves in the app, and then sends up to 6 months of one-to-one chats (no group chats, and photos or files only as a label). WhatsApp also offers the app's contact list, which Setu does not store. Imported messages are shown for context and are never answered by the assistant, and they don't notify anyone.
  • Orders: products, quantities, delivery name, phone number and address, and payment status for orders customers place through a conversation.
  • Operations records: when a reply could not be sent or a message could not be processed, Setu records what failed so the business can retry or resolve it from Settings → Operations.
  • Usage: counts of messages handled and AI model usage, with its estimated cost, so each business can see what it uses. Usage records hold counts, not message content.
  • Technical data: service logs and delivery records needed to run Setu reliably and securely.

How we use it

  • To deliver customer messages to the business's Setu inbox and send the business's replies.
  • To draft and send replies about products, prices, stock and orders using an AI model (Google Gemini). Message content, and a product photo the customer asks about, is sent to the model only to produce a reply. Setu does not use your conversations to train AI models.
  • To record and track orders and payments for the business.
  • To show the business failed replies, usage and an activity log of important changes.
  • To secure the service, prevent abuse, and fix problems.

We do not sell personal information and do not use customer conversations for advertising.

Information from Meta platforms

Data received through Instagram, Messenger and WhatsApp APIs is used only to provide Setu's messaging and order features to the business that connected the account, in line with Meta's Platform Terms and Developer Policies. It is not shared with other businesses or third parties except the service providers listed below. The permissions Setu requests, and what each is used for, are listed on How Setu uses Meta Platform Data.

Service providers

  • Google Cloud and Firebase (hosting, database, authentication, background jobs).
  • Google Gemini API (the AI model that drafts replies and describes product photos).
  • Meta Platforms (Instagram, Messenger and WhatsApp, to receive and send messages).
  • Payment providers the business enables, such as Fonepay, to confirm payments.
  • The business's own online store, when it connects one, to read products and place orders.

Retention

  • Raw webhook delivery records are deleted automatically after 30 days; any product description read from a photo is removed after 24 hours.
  • Operations records of failed replies are deleted automatically after 90 days.
  • Reactions and edits that arrive before the message they belong to are held for up to 10 minutes, then discarded.
  • Usage records are kept while the workspace exists and are deleted with it.
  • Conversations, messages and orders are kept while the business's workspace exists, and are deleted with the workspace or by a data deletion request for that channel (see below).
  • When someone removes Setu in their Meta settings, Setu keeps a note of which workspaces that connection belonged to, under a one-way hash of their Meta id, for 90 days, so a later data deletion request can still find the data.
  • For each data deletion request Setu keeps the confirmation code, its status, a one-way hash of the Meta id and the number of connections removed, so the status link keeps working. It holds no messages or customer details.
  • Access tokens are deleted as soon as a business disconnects a channel, removes Setu from its Meta account, or asks us to delete its data.

Your choices and deletion

  • The workspace owner can disconnect any channel at any time from Connections in Setu. This deletes the access token and stops Setu receiving the channel's messages; existing conversations stay in the workspace until it, or the channel's data, is deleted.
  • A workspace owner can delete the whole workspace from Settings → Business → Danger zone. Setu asks the owner to sign in again first, then deletes the workspace's conversations, orders, products, settings, tokens and records.
  • Removing Setu from a Meta account, or sending Meta's data deletion request, deletes that channel's data as described on our data deletion page.
  • Anyone can also email hello@vantelyx.dev. Customers of a business can contact that business directly.

Security

Data is encrypted in transit. Access tokens are additionally encrypted at rest with a key held separately from the database. Each business's data is isolated to its own workspace, and only its members can view it.

Changes and contact

We will update this page when our practices change. Questions about privacy can be sent to hello@vantelyx.dev.

Vantelyx Technologies Private Limited · Registration No. 400359/83/84