Legal

Privacy Policy

Last updated: 6 June 2026 · Governing law: England & Wales

Who We Are
Data We Collect
How We Use Your Data
Browser Data & Server-Side Data
Third-Party Services
International Data Transfers
Data Retention
Your Rights
Security
Children
Changes to this Policy
Contact Us

The short version: SetAura stores your set history and preferences in your browser. Some anonymised usage data (such as how many free sets you've used) is also stored server-side so the service works across devices and sessions. We don't sell your data. We don't use your data for advertising. If you contact us or subscribe to a paid plan, we store only what's needed to provide the service.

1. Who We Are

SetAura ("we", "us", "our") is a DJ set planning tool operated by SetAura Ltd, a business trading as SetAura, with a company registration in progress.

For the purposes of UK GDPR, SetAura Ltd is the data controller for personal data processed through setaura.io.

Registered office: To be confirmed upon Companies House registration. Written data requests may be sent to hello@setaura.io in the meantime.

2. Data We Collect

Data	When	Why
Name & email address	When you submit the contact form	To respond to your enquiry
Email address	If you subscribe to our newsletter	To send updates (you can unsubscribe any time)
Email address & subscription status	When you purchase a paid plan	Processed by Lemon Squeezy (our payment provider) — we receive only your email and subscription status, not your full payment card details
Email address & account creation date	When you register for a SetAura account	Stored via Supabase Auth to manage your account and saved sets
Anonymous session identifier (sf-session-id)	Every time you use the set builder, even without an account	Sent with API calls to track your free generation count server-side and prevent abuse
Free generation counter	Each time you generate a set on the free tier	Stored server-side (Supabase) as session_id + count + timestamps to enforce the 3-generation free limit
Track ratings (thumbs up/down)	When you rate a track in a generated set	Stored server-side as session_id + track_id + rating to improve recommendations
Feedback submissions	When you submit feedback via the in-app form	Stored server-side as session_id + message + page to help us improve the service
Saved sets	When you save a set (logged-in users only)	Stored server-side linked to your user account (user_id + genre + title + set data)
IP address & browser info	Every page visit	Automatically logged by our hosting provider for security and uptime monitoring. Not used for tracking or profiling.

We do not collect sensitive personal data (health, financial, biometric, etc.).

3. How We Use Your Data

We use personal data only for the following purposes:

Service delivery — to provide the set-building tool and any features included in your plan
Communication — to respond to support or contact form submissions
Billing — to manage your subscription via Lemon Squeezy
Newsletter — to send updates you have explicitly opted into
Security & abuse prevention — to detect and prevent fraud, scraping, or circumvention of usage limits
Service improvement — to understand how the tool is used and improve recommendations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Our legal bases for processing under UK GDPR are:

Contract (Article 6(1)(b)) — processing necessary to deliver a paid subscription, including billing, access management, and saved sets
Legitimate interests (Article 6(1)(f)) — anonymised analytics (Google Analytics 4) to understand feature usage; server-side session tracking to enforce free-tier limits and prevent abuse; track ratings and feedback to improve recommendations. Our legitimate interests are not overridden by your rights given the limited and anonymised nature of this data
Consent (Article 6(1)(a)) — newsletter subscriptions, which you may withdraw at any time by unsubscribing
Legal obligation (Article 6(1)(c)) — retaining subscription and payment records for 7 years as required by UK tax law

4. Browser Data & Server-Side Data

Stored only in your browser (localStorage): The following data is kept locally in your browser and is not accessible to us unless you are signed in and those details form part of your account:

sf-theme — your dark/light mode preference
soundforge_history — your previously generated sets (browser only)
sf-profile-avatar — your display name and avatar preference
sf_flags — feature states (e.g. whether you've dismissed a notice)

You can clear this data at any time by clearing your browser's local storage or site data.

Sent to our servers: Your anonymous session identifier (sf-session-id) is sent with API calls to our backend. This allows us to track how many free set generations you have used and to store track ratings and feedback submissions server-side. The session ID is randomly generated and not linked to your name or email unless you create an account.

Google Analytics 4 (GA4): We use GA4 (property G-BGSW6CVDRE, loaded via Google Tag Manager) to understand how DJs use SetAura — which features are used most, how long sessions last, and which pages are visited. This data is aggregated; it is not used for advertising. Our legal basis is legitimate interests in improving the service. Google Analytics may set cookies in your browser. You can opt out via Google's opt-out tool.

We do not use your data for advertising or retargeting. Google Analytics is configured for analytics purposes only — we do not enable Google's advertising features, remarketing lists, or data sharing with Google Ads. Google may use anonymised, aggregated signals from GA4 for their own product improvement under their own privacy policy.

5. Third-Party Services

SetAura uses the following third-party services that may process your data:

Service	Purpose	Privacy Policy
Supabase	Database and authentication — stores your account, saved sets, and preferences securely	supabase.com/privacy
Google Analytics 4	Anonymised usage analytics — page views, feature usage, session duration. No advertising.	policies.google.com/privacy
Lemon Squeezy	Payment processing & subscription management	lemonsqueezy.com/privacy
Cloudflare	DNS, CDN, DDoS protection and static file hosting	cloudflare.com/privacypolicy
Railway	Backend application hosting — processes API requests	railway.app/legal/privacy
Google Fonts	Typography (Inter & Space Grotesk typefaces)	policies.google.com/privacy
Beatport	Track metadata and purchase links	beatport.com/privacy-policy — links open Beatport; we do not share your personal data with them
Anthropic	AI language models used to help generate set recommendations from your musical inputs (genre, BPM, energy). We do not send your name, email, or account details.	anthropic.com/legal/privacy
Spotify	Optional only — if you choose "Save to Spotify playlist" or connect Spotify, we use your authorised Spotify account to create a playlist and surface track previews. You can disconnect at any time in your Spotify account settings.	spotify.com/legal/privacy-policy

We use Beatport solely to surface track information and purchase links. We do not share your personal data with them.

6. International Data Transfers

Some of the third-party services we use are based in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place:

Supabase — US company; your data is stored in an EU data region. Supabase participates in data transfer mechanisms compliant with UK GDPR via Standard Contractual Clauses (SCCs).
Google (Analytics & Fonts) — participates in the UK-US Data Bridge and uses SCCs for international transfers.
Railway — US-based hosting provider; SCCs apply for any personal data processed.
Cloudflare — participates in the UK-US Data Bridge and uses SCCs.
Lemon Squeezy — US-based merchant of record; SCCs apply for billing data.
Anthropic — US-based AI provider; processes only your anonymous musical inputs, with SCCs in place for any data transferred.
Spotify — used only if you connect your Spotify account; the transfer is governed by Spotify's own privacy policy and your authorisation.
Beatport — US company; we do not share personal data with Beatport — links open their platform and are governed by their own privacy policy.

You can request more information about the specific transfer mechanisms in place by emailing hello@setaura.io.

7. Data Retention

Contact form messages — retained for up to 12 months, then deleted
Newsletter subscriptions — retained until you unsubscribe
Subscription & payment records — retained for 7 years as required by UK tax law
Account data (email, created_at) — deleted upon your request or after 2 years of account inactivity, whichever comes first
Saved sets — retained while your account is active; deleted on request or on account closure
Track ratings — anonymised (session ID removed) after 12 months
Free generation counters — retained for 30 days after last use, then deleted
Browser / local data — stored on your device until you clear it
Server logs — retained for up to 30 days for security purposes
Google Analytics 4 data — retained for 26 months per Google's default data retention setting

8. Your Rights Under UK GDPR

You have the following rights in relation to any personal data we hold about you:

Right of access — request a copy of the data we hold about you
Right to rectification — ask us to correct inaccurate data
Right to erasure — ask us to delete your data ("right to be forgotten")
Right to restrict processing — ask us to limit how we use your data
Right to data portability — receive your data in a machine-readable format
Right to object — object to processing based on legitimate interests
Right to withdraw consent — withdraw consent (e.g. unsubscribe from newsletter) at any time

To exercise any of these rights, email hello@setaura.io with the subject line "Data Request". We will respond within one calendar month as required by UK GDPR.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

HTTPS encryption on all pages via SSL/TLS
Cloudflare DDoS and security protection
Supabase Row Level Security (RLS) — database policies that restrict access so users can only read and write their own data
Data encrypted at rest within Supabase's database infrastructure
Access to any stored personal data is limited to authorised personnel only

No method of transmission over the internet is 100% secure. In the event of a data breach that is likely to affect your rights, we will notify you and the ICO as required by UK GDPR.

10. Children

SetAura is not directed at anyone under the age of 16. We do not knowingly collect personal data from children or minors under 16. If you believe someone under 16 has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

Continued use of SetAura after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us

For any privacy-related questions, data requests, or complaints:

SetAura — operated by SetAura Ltd

A business trading as SetAura, with a company registration in progress

General & data requests: hello@setaura.io

Support: support@setaura.io

Website: setaura.io