Privacy Policy

Last updated 28 August 2026.

This explains what personal data Set ("we", "us") collects when you use get-set.uk, why, and what rights you have over it. It sits alongside our Terms & Conditions, which cover the wider rules of using Set.

Who we are

For any privacy question, or to exercise any of the rights below, contact us at n.miller.work93@gmail.com.

What we collect

We collect the following categories of data:

• Account — your email address, and your Google account ID if you sign in with Google.
• Identity — first and last name, date of birth, phone number. Your last name and date of birth are never shown publicly; only your first name and age are.
• Profile — profession, postcode (only your general area is ever shown publicly, never the exact postcode), photos, and the activities/sports/hobbies you pick.
• Special category data — gender and sexual orientation, both shown on your profile and used in matching; and, where you choose to add it when booking a specific event, allergy or dietary information shared with that event's organiser. We only collect these with your explicit, separate consent at profile setup, and you can withdraw that consent at any time by editing your profile or deleting your account.
• Event activity — favourites, sign-ups, waitlist status, attendance, and cancellations.
• Payment — the amount paid and Stripe's own payment/refund reference IDs. We never see or store your card details; Stripe holds those directly.
• Safety — reports you make or are named in, and anyone you've blocked.
• Technical — IP address, device/browser information, and login timestamps, used for security and keeping your session working.
• Marketing preference — just the opt-in/opt-out flag itself, and whether you've accepted the Terms.

Our legal basis for using it

• Contract — account data, bookings, and payments: we can't run the service without these.
• Consent — marketing emails, and the special category data above (gender, sexual orientation, allergies), collected only with your explicit agreement and withdrawable at any time.
• Legitimate interests — safety features (reports/blocks), fraud prevention, and improving the service.
• Legal obligation — records we're required to keep, such as for tax and accounting purposes.

Who we share it with

We use a small number of processors, each only for the specific job below. We don't sell your data, and we don't share it for anyone's advertising purposes.

• Stripe — payment processing and refunds. Stripe holds your card details; we never do.
• Supabase — our database and file storage.
• Resend — sending you transactional emails, and marketing emails if you've opted in.
• Vercel — hosting the application.
• Google — only if you choose "Sign in with Google."
• Event organisers — see the full name of anyone confirmed on their event, and allergy notes where relevant.
• Other members — see your first name, photos, general area, and activities. Your exact address and phone number are only ever shared with another member once you've both agreed to it.

We may also disclose data where legally required to — for example, a court order — or to protect the safety of our users.

How long we keep it

We keep your account and profile data for as long as your account is active. If you delete your account using the "Delete profile" option in the app, your data is removed from our systems immediately — that includes your profile, photos, favourites, event history, and safety records. The one exception is payment records: our payment processor, Stripe, keeps its own copy of transaction records independently, as it's legally required to for tax purposes, for up to 6 years — this sits with Stripe, not something we hold or control after your account's gone.

Your rights

Under UK GDPR, you can ask us to:

• Access — a copy of what we hold on you.
• Correct — fix anything inaccurate (most of this you can already edit yourself in your profile).
• Delete — erase your account and data; you can also do this yourself at any time via "Delete profile" in the app.
• Restrict or object — to certain processing.
• Port — get your data in a portable format.
• Withdraw consent — for anything based on consent (marketing, special category data), at any time, without affecting anything already done.

To exercise any of these, email us at the address above. If you're unhappy with our response, you can complain to the UK Information Commissioner's Office (ico.org.uk).

Cookies

We use only what's needed to keep you securely logged in — an authentication session cookie. We don't use advertising or third-party tracking cookies.

Children

Set is for adults only — you must be 18 or over to create an account, consistent with our Terms.

Security

We use industry-standard measures — encrypted connections, access controls, and database-level row security — to protect your data. No system is completely secure, but we take reasonable steps to keep yours safe.

International transfers

Some of our processors (for example, Stripe and Supabase) may process data outside the UK. Where they do, we rely on their standard contractual safeguards for that transfer.

Changes to this policy

We'll update the date at the top when we make changes, and tell you directly if a change is significant.

Questions about this policy? Contact us at n.miller.work93@gmail.com.