> ## Documentation Index
> Fetch the complete documentation index at: https://docs.setor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Privacy at Setor AI: GDPR, EU AI Act, and Your Rights

> Setor AI is GDPR-compliant and an EU AI Act-aware processor. Learn what data is collected, how long it's kept, and how to exercise your rights.

Setor AI is operated by a Polish company — **SETOR AI sp. z o.o.**, based in Lublin, Poland — and is subject to Polish law and EU data protection regulation, including the GDPR and the EU AI Act. Data privacy is built into the product design, not added as an afterthought. This page explains what data is collected, how it is used, how long it is kept, and how you can exercise your rights.

<Note>
  Full details are in the Privacy Policy at [/legal/privacy-policy](/legal/privacy-policy). For data protection enquiries, contact [office@setor.ai](mailto:office@setor.ai).
</Note>

## What Data Setor AI Processes

<CardGroup cols={2}>
  <Card title="Account Data" icon="user">
    Your name, email address, company information, and subscription details — collected when you sign up and updated as your account changes.
  </Card>

  <Card title="Instagram Account Data" icon="instagram">
    Your Instagram profile, account identifiers, and OAuth tokens — obtained via the Meta API when you connect your Instagram account.
  </Card>

  <Card title="Message Content" icon="message">
    The content of DM conversations processed through the service — used to generate responses, qualify leads, and manage conversations on your behalf.
  </Card>

  <Card title="Usage Data" icon="chart-line">
    Features accessed, session timestamps, conversation metrics, and configuration data — used to deliver and improve the service.
  </Card>

  <Card title="Payment Data" icon="credit-card">
    Billing name and address, last 4 card digits, and invoice records — card details are processed exclusively by Stripe and never pass through Setor AI's servers.
  </Card>
</CardGroup>

## How Your Data Is Used

Setor AI processes your data only for defined, legitimate purposes:

* **Service delivery**: Message content is processed to power the DM automation service you subscribed to. This is the core purpose — no data is processed beyond what is necessary.
* **No model training on your data**: Message content is processed transiently in real time. It is **not** used to train or fine-tune AI models. Setor AI's agreements with AI sub-processors contractually prohibit this.
* **Aggregated product improvement**: Anonymized, aggregated metrics (e.g., response quality rates, error rates) may be used to improve the product. No individual or client is identifiable in these datasets.
* **Marketing**: You will only receive marketing emails if you have actively opted in. You can withdraw consent at any time via the unsubscribe link in any message or by emailing [office@setor.ai](mailto:office@setor.ai).

## Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights. To exercise any of them, email [office@setor.ai](mailto:office@setor.ai) — Setor AI aims to respond within 5 business days and resolve requests within 30 calendar days.

<Accordion title="Access — Request a Copy of Your Data">
  You have the right to obtain confirmation of whether Setor AI processes your personal data and to receive a copy of that data in a readable format.
</Accordion>

<Accordion title="Rectification — Correct Inaccurate Data">
  If any personal data Setor AI holds about you is inaccurate or incomplete, you have the right to request correction.
</Accordion>

<Accordion title="Erasure — Request Deletion of Your Data">
  You can request that Setor AI delete your personal data. Deletion is subject to retention obligations (e.g., financial records required by law). See the retention schedule below.
</Accordion>

<Accordion title="Portability — Receive Your Data in a Portable Format">
  Where processing is based on your consent or on contract performance, you can request your data in a structured, commonly used, machine-readable format.
</Accordion>

<Accordion title="Objection — Object to Specific Processing">
  You have the right to object to processing based on legitimate interests. Setor AI will stop that processing unless it can demonstrate compelling legitimate grounds that override your interests.
</Accordion>

## EU AI Act Compliance

The EU AI Act (Regulation 2024/1689) establishes transparency obligations for AI systems that interact directly with individuals. Setor AI treats Article 50 obligations as applicable from August 2, 2026.

<Info>
  Setor AI is classified as a **general-purpose AI system** — it is not a high-risk system under Annex III of the EU AI Act. The service does not perform employment decisions, credit assessments, law enforcement profiling, or real-time biometric identification.
</Info>

Understanding the split of responsibility is important if you deploy Setor AI to your audience:

<Tabs>
  <Tab title="Setor AI's Role (Provider)">
    Setor AI fulfils the **Article 50(1) design obligation** by building in a disclosure capability — a configurable message that can inform your leads they are interacting with an AI system. Setor AI documents that the service uses AI for message generation and conversation classification.
  </Tab>

  <Tab title="Your Role (Deployer)">
    As the business that deploys Setor AI to your Instagram audience, **you are the "Deployer"** under the EU AI Act. You are responsible for actually informing your leads that they are interacting with an AI (at minimum at first contact, per Article 50). Setor AI provides the technical capability — you must ensure it is enabled and used.
  </Tab>
</Tabs>

<Warning>
  If you use Setor AI to contact leads, you are responsible for having the legal basis to do so under GDPR (or your local equivalent). You are also responsible for your leads' right to know they are speaking with an AI. Failure to comply with Article 50 carries fines of up to EUR 15 million or 3% of global annual revenue. Make sure your lead acquisition and disclosure practices are compliant.
</Warning>

## Data Retention

| Data Type                          | Retention Period                                     |
| ---------------------------------- | ---------------------------------------------------- |
| Account data                       | Duration of your contract + 30 days                  |
| Message content (DM conversations) | Duration of your contract + 180 days                 |
| Payment records                    | 5 years (legal requirement under the Accounting Act) |
| Security and access logs           | 12 months                                            |
| Marketing consent records          | 3 years from consent or withdrawal                   |

After the applicable retention period, data is permanently deleted or irreversibly anonymized.

## Sub-processors and International Transfers

Setor AI uses a limited set of sub-processors (third-party providers) to deliver the service — including AI model providers, cloud infrastructure, and payment processing. The full, named list is published at [setor.ai/subprocessors](https://setor.ai/subprocessors).

Where sub-processors are located outside the European Economic Area (EEA), Setor AI applies appropriate GDPR Chapter V transfer safeguards — including Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework (DPF) — supplemented by Transfer Impact Assessments where required.

<Note>
  No sub-processor uses your data to train its own models. This is contractually prohibited in all sub-processor agreements.
</Note>