Privacy Policy

Effective Date: 26 March 2026 | Version: 1.0

Parent Company Studio (ABN: 96 900 902 387) Studio H13, Balam Balam Place, 15 Phoenix St, Brunswick VIC 3056 hey@set.space | set.space

1. Introduction

This Privacy Policy (‘Policy’) describes how Parent Company Studio (ABN: 96 900 902 387), a partnership (‘we’, ‘us’, ‘our’), collects, uses, stores, discloses, and protects personal information in connection with the Set Space platform (‘Platform’) and our services at set.space.

We are committed to complying with the Privacy Act 1988 (Cth) (‘Privacy Act’) and the Australian Privacy Principles (‘APPs’) contained in Schedule 1 of that Act. Where we collect personal information from individuals located outside Australia, we endeavour to handle that information consistently with the standards set out in this Policy.

By using the Platform, you consent to the collection and use of your personal information as described in this Policy. If you do not agree with this Policy, please do not use the Platform.

2. About This Policy

2.1 Scope

This Policy applies to personal information collected through the Platform, including via our website, web application, APIs, and any communications with us. It applies to registered users, collaborators, and visitors to our website at set.space.

2.2 Definitions

‘Personal information’ has the meaning given to it in the Privacy Act, and generally includes any information or opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in material form or not.

‘Sensitive information’ includes health information and other categories given special protection under the Privacy Act.

2.3 Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by email and/or by posting an updated version on the Platform. The updated Policy will take effect 14 days after notice is given. Continued use of the Platform after that date constitutes acceptance of the updated Policy.

The current version of this Policy is always available at set.space/privacy.

3. What Personal Information We Collect

3.1 Account and Identity Information

When you register for an Account, we collect:

Full name;
Email address;
Password (stored in hashed, non-recoverable form);
Account creation date and time;
Subscription plan and billing information (managed via Stripe — we do not store full payment card details).

3.2 Usage and Technical Data

When you use the Platform, we automatically collect:

IP address and device information (browser type, operating system);
Login timestamps, sign-in history, and sign-in count;
Session data and authentication tokens;
Platform activity logs, including actions performed on Locations, Collections, and Projects;
Error reports and diagnostic data (via Appsignal).

3.3 User-Generated Content

Through the Platform, you may provide or create:

Location names, descriptions, addresses, and geographic coordinates (latitude and longitude);
Images (PNG, JPEG, GIF, HEIC/HEIF files up to 500 MB each);
Rich text notes, comments, and annotations;
Project and Collection names, descriptions, and organisational data;
File attachments associated with Locations or Projects.

3.4 Image Metadata (EXIF Data)

Images uploaded to the Platform may contain embedded EXIF (Exchangeable Image File Format) metadata, which can include:

GPS coordinates and altitude (the precise location where the photo was taken)
Date and time the image was captured
Camera make, model, and lens information
Camera settings (aperture, shutter speed, ISO)
Software used to process the image

We extract and store EXIF data, including GPS coordinates, to power mapping and location-based features. If you share content publicly via Share Links, any extracted EXIF metadata — including GPS location — may be accessible to anyone with that link.

We recommend reviewing images for sensitive embedded metadata before uploading, particularly if you intend to share content publicly.

3.5 Geographic and Location Data

We collect and store:

Geographic coordinates (latitude and longitude) that you manually enter or that are extracted from image EXIF data;
Addresses you enter, which may be geocoded (converted to coordinates) using third-party geocoding services;
Distance and proximity calculations between stored Locations.

3.6 Collaboration Data

When you collaborate with other users, we collect:

The email addresses of individuals you invite to Collections or Projects;
Invitation status and response history;
Comments and notifications associated with shared content.

3.7 Information About Third Parties in Your Content

If you upload images or notes containing information about third parties (for example, photographs of individuals), you are responsible for ensuring you have obtained any necessary consents from those individuals and that such collection and storage is lawful.

4. How We Collect Personal Information

We collect personal information:

Directly from you when you create an Account, upload content, or communicate with us;
Automatically when you use the Platform (technical and usage data);
From third parties when you accept an invitation to a shared Collection or Project;
From images you upload that contain embedded metadata;
From third-party payment processors when you subscribe to a paid plan.

We collect personal information only by lawful and fair means and only where it is reasonably necessary for our functions and activities.

5. How We Use Personal Information

5.1 Primary Purposes

We use personal information to:

Create and manage your Account;
Provide, operate, and improve the Platform and Services;
Process payments and manage your subscription;
Send transactional and account-related emails (via Postmark), including account verification, password reset, and notifications;
Enable collaboration and sharing features;
Provide customer support and respond to enquiries;
Monitor, detect, and prevent fraudulent or unauthorised activity;
Comply with legal obligations.

5.2 AI-Powered Image Processing

When you upload images to the Platform, we use AI Features to automatically process those images. This processing involves:

Sending image data to third-party AI and Large Language Model (LLM) API providers;
Generating descriptions, spatial features, colour palettes, mood classifications, and space-type labels for each image;
Creating vector embeddings from images to enable visual similarity search;
Tracking token usage against your monthly AI processing budget.

AI-generated outputs are stored alongside your images within your Account. This automated processing occurs each time an eligible image is uploaded. You consent to this processing by uploading images to the Platform.

5.3 Geocoding and Location Processing

Addresses you enter may be automatically processed using third-party geocoding services to generate geographic coordinates. These coordinates are stored and used to provide mapping, distance calculations, and location-based features.

5.4 Your Choices

Where technically feasible, we will provide options to disable automatic AI processing for specific uploads. Contact hey@set.space to discuss your available options.

5.5 Secondary Purposes

We may also use your personal information for secondary purposes that are directly related to the primary purpose for which it was collected, where you would reasonably expect us to do so, including:

Analysing aggregated, de-identified usage data to improve the Platform;
Sending you product updates, new feature announcements, and marketing communications (where you have provided consent, and subject to your opt-out rights);
Conducting internal research and development.

6. Disclosure of Personal Information

6.1 Third-Party Service Providers

We disclose personal information to the following categories of third-party service providers who assist us in operating the Platform. These providers are required to handle your information in accordance with our instructions and applicable privacy laws.

Stripe

Payment processing. Billing name, email, and payment card details are processed directly by Stripe. We do not store full card numbers.

Cloudflare R2

Secure file and image storage. Your uploaded images and attachments are stored on Cloudflare R2 infrastructure.

Postmark

Transactional email delivery. Your email address and name are used to send account and notification emails.

AI / LLM API Providers

Image analysis and vector embedding generation. Images you upload are transmitted to AI providers for processing.

Geocoding Services

Address-to-coordinate conversion. Addresses you enter may be sent to geocoding APIs.

Appsignal

Application error monitoring and performance tracking. May include anonymised usage data and error context.

6.2 Public Sharing

If you generate a public Share Link for a Location, Collection, or Project:

The linked content — including images, descriptions, geographic data, and any AI-generated metadata — becomes accessible to any person who obtains the link;
We cannot control who accesses Share Links once they are distributed;
You should carefully review content before enabling public sharing, particularly for any sensitive location data or personally identifiable information within images.

6.3 Other Disclosures

We may also disclose personal information:

To comply with a legal obligation, court order, or lawful request by a government authority;
To enforce our Terms and Conditions or protect our rights;
In connection with a change in the Partnership’s composition or a sale of substantially all of our assets, where the successor agrees to handle personal information in accordance with this Policy;
With your explicit consent.

6.4 Overseas Disclosures

Some of our third-party service providers are located outside Australia, including in the United States. Under APP 8, before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that recipient does not breach the APPs.

By using the Platform, you acknowledge that your personal information may be transferred to and stored in servers located outside Australia, and you consent to such transfer.

7. Data Storage and Security

7.1 Storage Infrastructure

Your personal information, images, and Content are stored on infrastructure provided by Amazon Web Services (AWS), with data centres located in the ap-southeast-2 (Sydney) region. We take reasonable steps to ensure storage remains within Australia or in jurisdictions with appropriate data protection standards where possible.

7.2 Security Measures

We implement reasonable technical and organisational security measures to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

Encryption of data in transit using TLS/HTTPS;
Encrypted storage for sensitive credentials;
Access controls and authentication requirements;
Account locking after repeated failed authentication attempts;
Regular security monitoring via Appsignal;
Cloudflare R2 security controls for file storage.

7.3 No Absolute Security

No security system is impenetrable. While we take reasonable precautions, we cannot guarantee the absolute security of your information. In the event of a data breach that is likely to result in serious harm, we will comply with our notifiable data breach obligations under the Privacy Act.

8. Data Retention

8.1 Retention Periods

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, or as required by law.

Account information

Duration of Account plus 7 years after closure (for legal and audit purposes)

Images and uploaded content

Duration of Account. May be retained up to 90 days after Account closure before permanent deletion.

Payment records

7 years (as required by Australian taxation law)

Usage logs and IP data

Up to 12 months from collection

AI-generated metadata

Duration of the associated image or Account, whichever is shorter

Email communication records

3 years from last interaction

Soft-deleted content

Up to 90 days after soft deletion, before permanent deletion

8.2 Soft Deletion

When you delete a Location, Collection, Project, or other content item within the Platform, it may be ‘soft deleted’ — meaning it is hidden from your view and treated as deleted for all practical purposes, but the underlying data is retained in our systems for a short period before permanent deletion. This enables accidental deletion recovery. If you need to recover soft-deleted content, contact us promptly at hey@set.space.

8.3 Account Closure

When your Account is closed (by you or by us), we will begin the process of permanently deleting your personal information and Content in accordance with our retention schedule. Some residual information may be retained in backups for a limited period before those backups are also purged.

9. Cookies and Tracking Technologies

9.1 Cookies We Use

The Platform uses cookies and similar tracking technologies to:

Maintain your authenticated session (essential session cookies);
Remember your preferences and settings;
Monitor platform performance and detect errors;
Analyse usage patterns through anonymised analytics.

9.2 Types of Cookies

Session cookies

Required to authenticate and maintain your login session. Cannot be disabled.

Preference cookies

Remember your display settings and account preferences.

Analytics cookies

Collect anonymised data about platform usage to help us improve the service.

Security cookies

Used to detect and prevent fraud and unauthorised access.

9.3 Managing Cookies

You may configure your browser to refuse cookies or to alert you when cookies are being sent. However, if you disable essential session cookies, you will not be able to access authenticated features of the Platform.

10. Your Privacy Rights

Under the Privacy Act and the APPs, you have the following rights in relation to your personal information.

10.1 Access

You have the right to request access to the personal information we hold about you. To make an access request, contact us at hey@set.space. We will respond within 30 days and may charge a reasonable fee to cover the cost of providing access.

10.2 Correction

If you believe that personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request that we correct it. We will take reasonable steps to correct the information and respond to your request within 30 days.

10.3 Deletion

You may request deletion of your personal information by contacting hey@set.space or by closing your Account through the Platform settings. We will comply with deletion requests subject to our retention obligations and any legal requirements to retain certain information.

10.4 Data Export

You may request a copy of your personal information and Content in a machine-readable format by contacting hey@set.space. We will endeavour to provide your data export within 30 days.

10.5 Opt-Out of Marketing Communications

You may opt out of receiving marketing or promotional communications from us at any time by:

Clicking the ‘unsubscribe’ link in any marketing email; or
Contacting us at hey@set.space.

We will honour opt-out requests within 5 business days. Note that you cannot opt out of transactional communications essential to your use of the Platform (such as account security notices).

10.6 Complaints

If you believe we have mishandled your personal information or failed to comply with the Privacy Act or the APPs, you may lodge a complaint with us at hey@set.space. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

11. Children’s Privacy

The Platform is not directed at children under the age of 18, and we do not knowingly collect personal information from children. If you are under 18, please do not use the Platform or provide any personal information.

If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information as soon as reasonably practicable. If you believe we have collected information from a child, please contact us at hey@set.space.

12. AI Processing and Automated Decision-Making

12.1 Nature of AI Processing

The Platform uses automated AI processing to analyse images you upload. This processing generates descriptive metadata, classifications, and vector representations of your images. These outputs are stored alongside your images and used to provide Platform features such as similarity search.

12.2 No Consequential Automated Decisions

We do not use automated decision-making to make decisions that have legal or similarly significant effects on you. AI outputs are informational tools to assist you in organising your content, not binding assessments or decisions.

12.3 Third-Party AI Providers

Image data submitted for AI processing is transmitted to third-party AI and LLM API providers. These providers process your image data under their own terms of service and privacy policies. We take reasonable steps to engage providers who maintain appropriate data handling standards. Images submitted for AI processing may be used by those providers in accordance with their own policies, which may include use for model training unless you have opted out with those providers. We recommend reviewing the policies of our AI providers if this is a concern.

12.4 Token Usage Tracking

We track your AI token consumption on a per-Account, per-calendar-month basis for the purposes of enforcing usage limits and managing service costs. This tracking data is retained in accordance with our general data retention schedule.

13. International Users

Set Space is operated from Australia and this Policy is governed by Australian privacy law. If you are located in a jurisdiction with its own privacy laws (such as the European Union, United Kingdom, or United States), additional rights and protections may apply to you under those laws.

While our primary compliance framework is the Australian Privacy Act and APPs, we aim to handle personal information in a manner broadly consistent with international privacy standards. If you have specific concerns about your rights under your local jurisdiction’s privacy laws, please contact us at hey@set.space.

14. Contact Us

For all privacy enquiries, access requests, correction requests, and complaints:

Email: hey@set.space Mail: Parent Company Studio, Studio H13, Balam Balam Place, 15 Phoenix St, Brunswick VIC 3056

Please include ‘Privacy Request’ in the subject line. We will acknowledge receipt of your enquiry within 5 business days.

Office of the Australian Information Commissioner (OAIC) Website: oaic.gov.au Phone: 1300 363 992