Privacy Policy
This page explains what data Setlyr collects when you join the waitlist, why we collect it, and what your rights are. We've tried to write it in plain English. If anything isn't clear, email hello@setlyr.com and we'll explain.
1. Who we are
"Setlyr" refers to the team building the Setlyr app for people settling in the UK. For the purposes of UK GDPR, we are the data controller for the information you give us on this website. You can reach us at hello@setlyr.com.
2. What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Your email address | So we can tell you when Setlyr launches and apply your 3-months-free credit. | Consent (you typed it in and clicked join). |
| A referral code we generate for you, plus a count of friends who signed up using it | To make the "skip the queue" referral mechanic work. | Legitimate interest (running the waitlist as advertised). |
| A one-way hash of your IP address and your browser's user-agent string | Soft anti-abuse — to stop someone scripting thousands of fake signups. We do not store your raw IP. | Legitimate interest (preventing abuse of the service). |
| The time you joined | To assign your position in the queue. | Legitimate interest. |
That's it. We don't ask for your name, phone number, address, or any other personal information at this stage.
3. Who we share it with
We use the following companies as data processors — they handle data on our behalf, under contract, and are not allowed to use it for their own purposes:
- Supabase Inc. — stores the waitlist database. (Supabase privacy notice)
- Resend Inc. — sends transactional emails such as your signup confirmation and the launch announcement. (Resend privacy notice)
- Cloudflare Inc. — hosts this website and processes traffic. (Cloudflare privacy notice)
We never sell or rent your email to anyone.
4. Where the data is stored
Our Supabase project is hosted in an EU region. Resend and Cloudflare are US-headquartered and may process data in the US and other countries; both rely on standard contractual clauses for international transfers, as permitted under UK GDPR.
5. How long we keep it
- If you join the waitlist, we keep your email until you ask us to delete it, or until 6 months after launch (whichever is sooner), at which point we remove waitlist signups that didn't convert into an account.
- The hashed IP and user-agent are kept for up to 90 days for abuse review, then deleted.
6. Cookies and tracking
This page sets no cookies and uses no third-party analytics or tracking pixels. The only network requests we make are to load fonts from Google Fonts, to load our own stylesheet and script, and — when you submit the form — to our own signup endpoint at /api/waitlist.
7. Your rights
Under UK GDPR you have the right to:
- Ask what data we hold about you ("subject access request")
- Ask us to correct anything that's wrong
- Ask us to delete your data ("right to be forgotten")
- Ask us to stop using it or to give you a copy ("portability")
- Object to how we're using it
- Withdraw your consent at any time — replying "unsubscribe" to any email from us, or emailing hello@setlyr.com, is enough
We aim to respond within 7 days, and never longer than the 30 days required by law.
8. Complaints
If you think we've handled your data badly, please tell us first so we can fix it. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. Changes to this policy
We'll update this page if we ever start collecting different data or using new processors. If the changes are material we'll email everyone on the waitlist before they take effect.
10. Contact
Questions about this policy? Email hello@setlyr.com.