Privacy policy

1. Who we are

Setsy is run by Martin Joseph Freer, a sole trader in Western Australia trading as Setsy (ABN 50 217 799 518) (“Setsy”, “we”, “us”). This policy explains what personal information we handle when you visit setsy.io or use the Setsy app, why we handle it, who we share it with, and the choices and rights you have.

We follow the Australian Privacy Act 1988 and the Australian Privacy Principles. Where they apply to you, we also follow the New Zealand Privacy Act 2020 and the UK and EU General Data Protection Regulation (GDPR).

2. Two kinds of data: yours and your club’s players

Team members. These are the people who log in to manage a club. For their account details, and for how visitors use our website, we decide how the data is used. Under the GDPR, that makes us the “controller”.

Players. Players don’t log in to Setsy. A club adds them to its roster so it can organise sessions. The club decides which players to add and what to record about them, and we only handle that information to run Setsy for the club. Under the GDPR, the club is the “controller” of its player data and Setsy is its “processor”. If you are a player and want to see, correct or remove your details, please contact your club first. If you can’t reach them, contact us and we’ll pass your request on and help where we can.

3. What we collect

When you create and use an account

• Your name and email address.
• Your password, which we store only as a one-way hash. We can’t read it.
• Your role in the club (Owner, Admin or Viewer) and when you last logged in.
• Your club’s name, sports, courts and settings, and its location (suburb, state, postcode and country).

Player details a club enters

• The player’s name, which can be a nickname or first name only.
• The player’s gender, used only to set up mixed matches if the club turns that on.
• A playing level (Beginner to Advanced), and whether they play singles only.
• Session history: who played, with whom, on which court and when they rested.

Setsy doesn’t ask for players’ contact details, dates of birth or addresses, and clubs shouldn’t enter them. We don’t knowingly collect sensitive information such as health details.

Billing

If your club subscribes, Stripe collects your card details directly. We never see or store your full card number. We keep the plan, billing dates, payment status and invoices.

Automatically, when you use the site

• Technical information such as your IP address, browser, device and the pages you visit, which our hosting, analytics and error-monitoring providers collect.
• Recordings of how some visitors move around and click on the site (session replays). See our cookie policy.
• Cookies and similar storage in your browser, also covered in the cookie policy.

When you contact us

The content of your message and any details you choose to give us.

4. Why we use it

We only use personal information for the purposes below. For UK and EU users, we’ve noted the GDPR lawful basis for each.

• To run Setsy for your club: logins, player rosters, generating rounds and sharing sessions. Basis: performing our contract with you.
• To bill you and keep the financial records the law requires. Basis: contract, and legal obligation.
• To email you about your account, such as verification, password resets, trial and billing reminders, and important changes to the service. Basis: contract.
• To send you product news and tips. You can unsubscribe from these at any time using the link in each email. Basis: legitimate interests, or your consent where the law requires it.
• To keep Setsy secure and working, including finding and fixing errors. Basis: legitimate interests.
• To understand how Setsy is used so we can improve it, and to measure whether our advertising works. Basis: legitimate interests.
• To comply with the law and to deal with disputes. Basis: legal obligation and legitimate interests.

Setsy uses an algorithm to decide who plays with whom in each round. That decision is about a social game and has no legal or similarly significant effect on anyone.

5. Who we share it with

We don’t sell personal information. We share it only with the service providers who help us run Setsy, under contracts that require them to protect it, and only as much as each one needs:

• Vercel (USA): hosts the website and app, and provides cookieless usage analytics.
• Neon (database hosted in Sydney, Australia): stores Setsy’s data.
• Stripe (USA and Ireland): payment processing.
• Resend (USA): sends account emails.
• Brevo (France, EU): our email list for product news. It holds your name, email, club name, country, plan and usage counts.
• Sentry (USA): error monitoring, including replays of some sessions.
• Smartlook (EU data storage): session recordings and usage analytics.
• Google (USA): Google Ads conversion tracking, Google Maps address lookup on the sign-up form, and YouTube videos if you choose to play one.
• Slack (USA): internal alerts to our team, for example when a club signs up or reaches a plan limit. These can include your name, email and club name.

Session share links are public. Anyone who has a link to a shared session can see the names of the players in it. Club team members choose when to share a link, and can turn sharing off.

We may also disclose information if the law requires it, to protect someone’s safety, or as part of selling or transferring the Setsy business, in which case this policy will continue to apply to your information.

6. Overseas transfers

Setsy’s main database is in Australia, but some of the providers above process data in the USA, the EU and other countries where they or their sub-processors operate. We use providers with established security and privacy programmes. For data from the UK and EU, transfers rely on adequacy decisions or the standard contractual clauses in each provider’s data processing terms.

7. How long we keep it

• Account, club and player data: while your club’s account is open. If you ask us to delete your account, we delete it within 30 days.
• Billing records: 5 years after the transaction, as Australian tax law requires.
• Backups: deleted data can remain in backups until they are overwritten, usually within 30 days.
• Error reports and session recordings: kept for the limited period set by Sentry and Smartlook, then deleted automatically.
• Email list: until you unsubscribe or your account is deleted.

8. How we protect it

Data is encrypted in transit (HTTPS), passwords are hashed, and access to production systems is limited to the people who need it to run Setsy. No system is perfectly secure, but if a data breach is likely to cause serious harm, we’ll notify the people affected and the relevant regulator as the law requires.

9. Your rights

You can ask us to:

• give you a copy of the personal information we hold about you
• correct anything that’s wrong
• delete your account and personal information
• stop sending you product news, which you can also do from any of those emails.

If you’re in the UK or EU, you can also ask us to restrict or object to how we use your data, ask for it in a portable format, and withdraw any consent you’ve given.

Email support@setsy.io to make a request. We may need to confirm who you are first. We’ll respond within 30 days, and there’s no charge.

10. Children

Team member accounts are for adults (18 or over). Clubs sometimes add junior players to a roster. If a club does, it is responsible for having permission from a parent or guardian where that’s needed. We recommend clubs use first names only for juniors.

11. Complaints

If you’re unhappy with how we’ve handled your information, please email us first and we’ll try to sort it out within 30 days. If you’re still not satisfied, you can complain to:

• Australia: the Office of the Australian Information Commissioner (oaic.gov.au)
• New Zealand: the Office of the Privacy Commissioner (privacy.org.nz)
• UK: the Information Commissioner’s Office (ico.org.uk)
• EU: the data protection authority in your country

12. Changes to this policy

We’ll update this policy when the way we handle personal information changes. The date at the top shows when it last changed. If a change is significant, we’ll email account owners before it takes effect.

13. Contact us

Email: support@setsy.io
Mail: Privacy, Setsy, PO Box 159, Victoria Park WA 6979, Australia