Privacy Policy
SetpointHQ Privacy Policy: how we collect, use and protect your personal data under UK GDPR.
This notice explains what personal data SetpointHQ collects through setpointhq.com, why we collect it, who we share it with, and what rights you have over it. It covers our website, our Studio product and our services.
Who We Are
SetpointHQ Limited is the data controller for the personal data described in this notice. SetpointHQ Limited is registered in England and Wales, company number 17124602, incorporated on 30 March 2026. Our registered office is 22 Heath Road, Ipswich IP4 5SA.
We are registered with the Information Commissioner’s Office under registration number ZC165802.
For anything in this notice, email privacy@setpointhq.com or use our contact form.
What We Collect and Why
When you contact us
Our contact form collects your first name, last name, email address and your message, together with which page or campaign you arrived from. We use this to reply to you and to keep a record of the conversation.
Lawful basis: legitimate interests, specifically responding to an enquiry you chose to send us.
When you subscribe to our email
We collect your name and email address. You can unsubscribe from any email we send using the link in its footer, and we act on that immediately.
Lawful basis: consent, which you give at the point of subscribing and can withdraw at any time.
When you buy a Studio subscription
We collect your name, email address and the details needed to run your account and your subscription. Card details are entered directly into Stripe’s payment form and are never seen or stored by us.
Lawful basis: performance of a contract, and legal obligation for the billing records we are required to keep.
When you use Studio
Studio stores the content you put into it so the product can work: job details, candidate records and any files you upload, including CVs. Uploaded CVs are deleted automatically after 90 days. Anything you delete goes to a recycle bin and is removed permanently after 30 days.
Where you upload information about other people, most often candidates, the position is different. For that data you are the controller and we are your processor. You decide what to collect, why, and how long to keep it. We only handle it to provide Studio to you, on your instructions.
That means you are responsible for having a lawful basis to share candidate data with us, and for telling those candidates how their data is used. We are responsible for keeping it secure, for not using it for our own purposes, for not moving it outside the arrangements described here, for helping you respond if a candidate exercises their rights, and for returning or deleting it when you stop using Studio. The full terms of that arrangement, including our use of sub-processors and what happens on termination, are set out in the data processing agreement that forms part of our terms.
We do not use candidate data uploaded by one customer to train models, to build our own database, or for any purpose other than running Studio for that customer.
When you visit the site
Our hosting provider records standard technical information including your IP address, browser type and the pages you request. We use analytics tools to understand how the site is used, but only after you agree to them through the cookie banner.
Lawful basis: legitimate interests for security and for keeping the site running; consent for analytics and marketing cookies.
Cookies and Analytics
We set only strictly necessary cookies until you tell us otherwise. Analytics and marketing cookies are set only if you accept them, and you can change your choice at any time using the Cookie settings link in the footer.
We load Google Tag Manager, which loads the measurement tools we have configured. As at the date at the top of this page those are:
- Google Analytics 4: how the site is used, which pages and tools people reach, and which enquiries and sign-ups result.
- Microsoft Clarity: aggregated session measurement, including heatmaps and recordings of how pages are used.
- Ahrefs Analytics: traffic and search performance measurement.
- Apollo: identifies the organisation a business visitor is browsing from, for business development.
- Lemlist: measures whether someone who received an outreach email later visited the site.
Google Analytics, Microsoft Clarity, Ahrefs, Apollo and Lemlist are all non-essential. They run only if you accept analytics or marketing cookies, and you can withdraw that at any time using the Cookie settings link in the footer.
The full inventory of cookies, what each one does and how long it lasts, is in our Cookie Policy.
Who We Share It With
We do not sell your personal data and we do not share it for anyone else’s marketing. We use the following providers, who process data on our behalf under contract:
| Provider | What they handle | Where |
|---|---|---|
| IONOS | Website and application hosting | Germany |
| Stripe Payments Europe Limited | Payment processing and fraud prevention | EU and US |
| Google LLC | Tag management and website analytics | US and global |
| Microsoft Corporation | Clarity session measurement | US and global |
| Twilio SendGrid | Email delivery | US and global |
| Ahrefs | Traffic and search performance measurement | Singapore |
| Apollo | Business visitor identification and outreach | US |
| Lemlist | Outreach email and visit measurement | European Union |
| Caseproof, LLC (MemberPress) | Membership, checkout and subscription software, including an IP address lookup to determine your country for VAT | US |
We also disclose personal data where we are required to by law, or to establish or defend legal claims.
Apollo and Lemlist also hold contact details of business prospects we approach directly, separately from anything the website collects. Where we contact you that way, you can ask us to stop at any time and we will remove you.
International Transfers
Some of the providers above process personal data outside the UK. Every transfer is covered by one of the safeguards UK law recognises:
| Destination | Providers | Safeguard |
|---|---|---|
| European Economic Area | IONOS (Germany), Lemlist (France), Stripe Payments Europe (Ireland) | UK adequacy regulations, which permit transfers to the EEA without further measures |
| United States | Google, Microsoft, Twilio SendGrid, Apollo, Caseproof (MemberPress), and Stripe’s US entity | The EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, under each provider’s data processing terms |
| Singapore | Ahrefs | The EU Standard Contractual Clauses together with the UK International Data Transfer Addendum |
We keep a copy of the relevant terms for each provider and review them when a provider changes them. If you want to see the safeguard that applies to a particular provider, ask us and we will point you to it.
How Long We Keep It
| Data | Retained for |
|---|---|
| Cookie consent records | 12 months |
| CVs uploaded to Studio | 90 days, then deleted automatically |
| Items in the Studio recycle bin | 30 days, then deleted permanently |
| Enquiries and email marketing contacts | 36 months from your last interaction with us |
| Customer account and billing records | 6 years, as required for tax |
Your Rights
Under UK GDPR you have the right to:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct anything inaccurate or incomplete.
- Erasure: ask us to delete your data where we have no continuing reason to keep it.
- Restriction: ask us to pause how we use your data while a question about it is resolved.
- Objection: object to processing we carry out on the basis of legitimate interests, including profiling.
- Portability: receive the data you gave us in a structured, commonly used format.
- Withdraw consent: where we rely on consent, withdraw it at any time. That does not affect anything we did before you withdrew it.
To exercise any of these, email privacy@setpointhq.com. We will respond within one month.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to This Notice
We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will tell you directly.
Contact
Questions about this notice, or about your data, go to privacy@setpointhq.com, or use our contact form.