Privacy Policy
This page explains what data Setlyr collects — on this website (including the waitlist) and in the Setlyr app — why we collect it, and what your rights are. We have tried to write it in plain English. If anything is not clear, email hello@setlyr.com and we will explain.
1. Who we are
Setlyr Limited (company number 17305710, registered in England and Wales) builds the Setlyr app for people settling in the UK. Our registered office is at 238 Wednesbury Road, Walsall, WS2 9QN, England. For the purposes of the UK GDPR and the EU GDPR, we are the data controller for the information described on this page. We are registered with the Information Commissioner's Office. You can reach us at hello@setlyr.com.
2. The short version
- The Setlyr app contains no advertising, no tracking and no third-party analytics SDKs.
- Your account data is stored with Supabase in the EU (Frankfurt, Germany).
- We never sell or rent your data.
- Subscriptions are bought through the App Store or Google Play — Apple or Google handles the payment, and we never see your payment details.
- The app only knows what you type into it — it requests no access to your location, contacts, photos, camera or microphone, and it sends you no push notifications.
- You can delete your account and its data at any time, from inside the app, in a couple of taps.
3. What we collect on this website
If you just browse, we see only anonymous, aggregated page-view counts — no cookies, no personal data (see section 9). If you join the waitlist, we collect:
- Your email address — so we can tell you when Setlyr launches, invite you to test it, and apply any credit we have promised you. Legal basis: your consent.
- A referral code we generate for you, plus a count of friends who signed up using it — to make the "skip the queue" referral mechanic work. Legal basis: our legitimate interest in running the waitlist as advertised.
- The time you joined — to assign your position in the queue. Legal basis: our legitimate interest.
- Basic technical information that any web server receives when you submit the form, such as your IP address and browser user-agent. We use it only to stop automated abuse of the signup form, and we do not use it to build any profile of you. Legal basis: our legitimate interest in preventing abuse.
That is it. We do not ask for your name, phone number, address, or any other personal information on this website.
Where we rely on legitimate interests, you have the right to object — see section 12.
4. What we collect in the Setlyr app
The app is built around information you choose to enter.
Your account
Your email address and password — the password is stored only as a cryptographic hash, so we can never read it. We use these to create your account, confirm your email address, sign you in and reset your password. Legal basis: performing the contract you signed up for.
Your profile
The profile you enter during onboarding: your first name, the country you are moving from, the stage of your move, your (planned) arrival date, your UK city, your visa category, your interests, and whether you are moving with children (a simple yes or no — we do not collect their names, ages or anything else about them). We use this to personalise your guides, your plan and everything else the app shows you. It is the whole point of Setlyr. Legal basis: contract.
Your visa category is one of a small set of broad routes — Skilled Worker, Health & Care Worker, Student, EU Settlement, Spouse or Family, or Other. We use it only to decide which general steps to show you.
Your progress
Which tasks and steps you have ticked off, which guides you have saved, liked or recently opened, and how far you have read — so the app can pick up exactly where you left off, including on a new phone. Legal basis: contract.
Setlyr covers a wide range of subjects, and some of them are personal — mental health, abuse, bereavement, faith, LGBTQIA+ life. Which of those you open or save could say something about you, so we want to be clear about what we do with it: nothing beyond running the app. We store it only to keep your place, show you your saved items and sync across your devices. We do not analyse it, build a profile from it, score you, share it, or use it for advertising or recommendations of any other kind. It is deleted with your account.
Cost Planner entries (optional)
Income and pension contribution, household make-up, housing type and rent, utilities, transport and other monthly spending estimates, plus one-off moving costs. We use these to estimate what your life in the UK will cost. They are only stored if you use the planner — you can skip it entirely. Legal basis: contract.
Your subscription
Which plan you are on, whether it is active, when it renews or expires, and the App Store or Google Play purchase token that proves the purchase — so we can unlock the paid parts of the app for you and keep them unlocked, including on a new phone. If you use an access code instead, we record which code your account redeemed and when. Legal basis: contract.
The payment itself is handled entirely by Apple (App Store) or Google (Google Play). They are the merchant of record: your payment card, billing address and invoices are processed by them under their own privacy policies (Apple · Google), and none of that ever reaches us. All we learn is whether your account has an active subscription.
James AI
James AI searches Setlyr's own content and points you to the right guide. What you type is used to return your results. We do not currently send it to any third-party AI service. If that changes, we will update this policy and tell you in the app before we make the change.
On your device
A copy of your profile, progress and planner data is kept on your phone so the app works offline, and is synced to your account so you do not lose it if you switch phones. The app requests no device permissions beyond internet access — no location, no contacts, no photos, no camera, no microphone, and no push notifications.
We review the list above every six months to make sure it still matches what the app does.
5. What we do not do
- No advertising and no ad networks.
- No third-party analytics, crash-reporting or tracking SDKs in the app — we cannot watch how you use it, and we are fine with that.
- No selling, renting or "sharing for value" of your data.
- No automated decisions about you with legal or similarly significant effects.
- No push notifications, and no marketing you have not been given a way out of.
6. Who processes your data, and where it lives
We use a small number of companies as data processors — they handle data on our behalf, under their standard data processing terms, and are not permitted to use it for their own purposes:
- Supabase — runs our database and the app's sign-in. Your app account data and the waitlist database live in Supabase's Frankfurt (EU) region. (Supabase privacy notice)
- Cloudflare, Inc. — hosts this website, processes traffic, and provides cookieless visitor analytics (Cloudflare Web Analytics). (Cloudflare privacy notice)
- Resend, Inc. — sends our emails, including account emails such as address confirmation and password reset, and waitlist emails. (Resend privacy notice)
Apple and Google are not processors for us: when you buy a subscription, the store acts as the seller (merchant of record) and processes your payment data as an independent controller under its own privacy policy (Apple · Google).
Supabase, Cloudflare and Resend are US-headquartered and may process data in the US and other countries. Where personal data is transferred outside the UK or the EEA, those transfers are made under the standard contractual clauses and, for UK data, the UK International Data Transfer Addendum. Your account data itself is stored in Frankfurt.
If we ever add a processor, we will update this list before we start using them.
7. How long we keep it
- App account data (profile, progress, planner entries): for as long as you have an account. Delete your account and it is gone — see section 8.
- Subscription state and access-code redemptions: for as long as you have an account — they are deleted with it. Apple and Google keep their own record of your purchases under their own policies.
- The copy on your device: removed when you sign out; uninstalling the app removes it too.
- Waitlist signups: until you ask us to delete them, or until we no longer need the list for launch, testing and onboarding — whichever comes first. You can leave the list at any time by using the unsubscribe link in any email or by emailing us.
- Backups: our database backups are kept on a rolling 90-day basis. See section 8 for what that means for deletion.
8. Delete your account
In the app — open Settings and tap Delete my account. You will be asked to type DELETE to confirm. Your account and everything attached to it — profile, progress, Cost Planner data, subscription state and access-code records — is then permanently deleted from our live systems straight away. There is nothing to wait for and nobody to email.
Or ask us — if you would rather not, or you can no longer sign in, email hello@setlyr.com with the subject "Delete my account" from the address you signed up with. We will confirm and delete everything within one month.
One honest caveat about backups. We keep rolling backups of our database so we can recover from a failure. A copy of your data may remain in those backups for up to 90 days after you delete your account, after which it is overwritten. We never restore from a backup except to recover from a failure, and if we ever had to, we would re-apply your deletion.
One thing we cannot do for you either way: cancel your subscription. If you have one, cancel it yourself before deleting your account — on iPhone in Settings → your name → Subscriptions, on Android in Google Play → Profile → Payments & subscriptions → Subscriptions. Deleting your Setlyr account does not stop the store from billing you.
Two things that are not the same as deletion: "Clear all progress" in the app's settings resets your checklists and saved items but keeps your account, and uninstalling the app removes the copy on your phone but not the copy in your account.
9. Cookies and analytics
This site sets no cookies. To understand how many people visit, we use Cloudflare Web Analytics — a cookieless, privacy-first tool that does not set cookies, use cross-site identifiers, or fingerprint your device. It records only aggregated page-view metrics and the standard request headers any website receives. Because no personal data is processed for this purpose, it falls outside the UK PECR consent requirement, so we do not ask you to accept any cookies.
The only other network requests this page makes are to load our own self-hosted fonts, stylesheet and script, and — when you submit the form — to our own signup endpoint. We do not load fonts, scripts or anything else from Google or any other third party.
The app sets no cookies and contains no analytics. It stores your data locally on your device so it can work offline, plus a session token that keeps you signed in.
10. Sensitive information
Some of what Setlyr covers — the NHS, prescriptions, money worries, family circumstances — touches on personal ground. We have deliberately built Setlyr so that we do not need any of it.
We do not ask for information about your health, religion, ethnicity, sexuality, political views or immigration case history, and there is no field in the app for any of it. Please do not type that kind of detail into Setlyr — including into James AI. You do not need to, and it will not improve what the app shows you.
The closest we come is your broad visa category, which we collect solely to decide which general steps to show you, and whether you are moving with children, which we store as a simple yes or no.
We are equally careful about what your reading could imply. Opening a guide on mental health, abuse or faith tells us nothing we act on — see section 4. We never treat what you read as a signal about you.
If you do send us sensitive information — in an email to us, for example — we will use it only to answer you, and we will not keep it for longer than we need to.
11. Emails we send you
If you have a Setlyr account, we may send you two kinds of email:
- Service emails — address confirmation, password resets, and important notices about your account or these policies. You cannot opt out of these, because they are part of running the service.
- Occasional updates about Setlyr — new features, tips and offers. Every one carries an unsubscribe link, and you can opt out at any time, either from that link or by emailing us. Legal basis: our legitimate interest in telling our own customers about our own service, in line with the UK PECR "soft opt-in".
We never pass your email address to anyone else for their marketing.
12. Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- Ask what data we hold about you (a "subject access request")
- Ask us to correct anything that is wrong
- Ask us to delete your data (the "right to be forgotten")
- Ask us to restrict how we use it, or to give you a copy in a portable format
- Object to processing we carry out on the basis of legitimate interests
- Withdraw your consent at any time — clicking unsubscribe in any email from us, or emailing hello@setlyr.com, is enough
Email hello@setlyr.com and we will deal with it. We will respond within one month. If a request is particularly complex we may need up to two further months, in which case we will tell you within the first month and explain why.
13. Children
Setlyr is made for adults organising a move to the UK and is not directed at children. You must be at least 16 to create an account, and we do not knowingly collect data from anyone younger. If you believe a child has created an account, email hello@setlyr.com and we will remove it.
If you tell us you are moving with children, we store a simple yes or no. We do not collect their names, ages, or any other information about them, and the Cost Planner does not ask about childcare.
14. Security
All traffic between the app or this website and our servers is encrypted in transit (TLS). Passwords are stored only as cryptographic hashes. Database access is protected by row-level security, meaning your account can only ever read its own data. Our database runs in the EU (Frankfurt).
The copy of your data held on your phone is protected by your device's own security — your passcode, Face ID or fingerprint — so please keep those switched on. Signing out or uninstalling removes that local copy.
If a data breach ever occurred that put your rights at risk, we would report it to the Information Commissioner's Office within 72 hours and tell you without undue delay.
15. Complaints
If you think we have handled your data badly, you have the right to complain to us, and we would much rather hear about it first so we can put it right.
How to complain: email hello@setlyr.com with "Data protection complaint" in the subject line, or write to us at Setlyr Limited, 238 Wednesbury Road, Walsall, WS2 9QN, England. Tell us what happened and what you would like us to do. We will acknowledge your complaint within 30 days, look into it properly, and tell you the outcome as soon as we can.
You also have the right to complain to a supervisory authority at any time — you do not have to come to us first. In the UK that is the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. In the EU it is the data protection authority of the country you live in.
16. Changes to this policy
We will update this page if we start collecting different data or using new processors. The "last updated" date at the top always tells you the current version. If the changes are material we will tell you by email or in the app before they take effect.
17. Contact
Questions about this policy? Email hello@setlyr.com.
Setlyr Limited · 238 Wednesbury Road, Walsall, WS2 9QN, England · Company number 17305710