Setlo Privacy Policy

Setlo provides non-custodial checkout software for supported crypto assets and networks, with Merchant settlement in official USDC on Base. Customer choices may include USDC, USDT, or ETH on Base, Ethereum, Arbitrum, and Optimism; Polygon USDC is processed only when separately enabled. For data protection purposes we are the controller of merchant account and platform operation data described below. Where we process customer personal data solely on a merchant’s instructions at their till, the merchant is typically the controller and we act as a processor / service provider for that limited processing.

We are based in the United Kingdom. This Policy is designed around UK GDPR and the Data Protection Act 2018. Privacy requests: support@setlo.co.uk (mark the subject Privacy where possible).

Account and profile data: name, email, phone (if provided), password hashes (we do not store plain passwords), shop name, business type, city, country, and similar onboarding fields.

Wallet and payment configuration: payout addresses you supply, splitter / contract addresses provisioned for your shop, and related technical identifiers.

Transaction and checkout data: payment IDs, wallet addresses, amounts, currencies, source and destination networks, route and provider status, transaction hashes, timestamps, quote metadata, error diagnostics, and settlement / sweep references needed to operate automation and support payment investigations.

Terms acceptance records: Terms version, acceptance time, IP address, and user agent when you accept our Merchant Terms.

Technical and usage data: IP address, browser / device information, logs, cookies or similar technologies needed for security, sessions, and reliability.

Support communications: messages you send us about the Service.

We do not ask for your private keys or seed phrases. Do not send them to us.

Merchants control what they show customers and any personal data they collect offline or in their own systems (receipts, loyalty, CCTV, etc.).

Setlo’s checkout flow is designed around payment amounts and on-chain settlement. We may process limited technical data (for example session or payment status) to make checkout work. Merchants must not use Setlo to dump unnecessary sensitive customer data into our forms or notes.

If a customer has a privacy request about the merchant’s sale, they should usually contact the merchant first. Card / bank / exchange disputes about how a customer obtained crypto should go to that issuer or provider.

To create and manage accounts, authenticate users, and provide the Service (contract / legitimate interests).

To record Terms acceptance and enforce our agreement (contract / legitimate interests / legal claims).

To detect payments, run settlement automation, prevent abuse, and keep systems secure (legitimate interests / contract).

To meet legal obligations where they apply (legal obligation).

To communicate service notices and respond to support (contract / legitimate interests).

We do not sell your personal data.

Payments and customer-authorised routes on supported networks, including Base and supported EVM source networks, are recorded on public ledgers. Wallet addresses, transaction links, and transfer amounts can be visible to anyone. Setlo cannot delete data from a public blockchain.

Operational partners (for example RPC, route, swap, bridge, database, and hosting providers) may process wallet addresses, transaction details, IP addresses, or other technical data needed to quote, execute, monitor, and support those routes. Their own privacy terms may also apply when a customer uses them through their wallet.

We may share data with: infrastructure providers (hosting, databases, email, analytics if enabled); blockchain / API providers required for the Service; professional advisers; and authorities when required by law.

If we sell or reorganise the business, data may transfer to a successor under appropriate protections.

Founders / co-founders acting for Setlo may access data as needed to operate and protect the Service, subject to confidentiality.

Some providers may process data outside the UK. Where required, we use appropriate safeguards (for example standard contractual clauses or provider mechanisms recognised under UK data protection law).

We keep account and shop data while your account is active and for a reasonable period afterward for security, disputes, and legal compliance.

Transaction and Terms-acceptance records may be retained longer where needed for audit, fraud prevention, or legal claims.

Logs are kept for operational periods then deleted or anonymised where practicable.

We use reasonable technical and organisational measures (access controls, service-role restrictions, HTTPS in transit where applicable). No method of transmission or storage is 100% secure.

You must keep your passwords and wallet credentials safe. Compromised wallets are outside Setlo’s control.

We use cookies or similar storage for sign-in sessions and essential site function. If we add non-essential analytics or marketing cookies, we will provide appropriate notice / controls where required.

Under UK data protection law you may have rights to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing is consent-based.

Some rights are limited (for example we may retain data needed for legal claims or security, and we cannot erase public blockchain records).

You may complain to the UK Information Commissioner’s Office (ICO). We encourage you to contact us first so we can try to resolve the issue.

The Service is not directed at children under 18. We do not knowingly collect personal data from children.

We may update this Policy and will post the new version with an updated version identifier (currently 2026-08-27). Continued use of the Service after changes means you should review the updated Policy.

For privacy questions or requests, email support@setlo.co.uk and mark the subject Privacy where possible.