Privacy Policy — Set-Os
1. Who is responsible for your data
Set-Os is a progressive web app (PWA) for people who work by project, workday or service (especially in audiovisual production) to record their workdays, expenses and work receipts. Set-Os is only for people over 18: we do not knowingly process data of minors and, if we detect an account belonging to a minor, we close it.
Data controller: Unit OS SpA, RUT 78.497.936-9.
Domicile: Chile.
Contact for any personal data matter: dudas@wrap-os.com
We have not appointed a data protection officer: the channel above is the controller's direct contact.
2. Principles we follow
- Lawfulness and fairness: we only process your data if there is a legal basis to do so (section 4), and we never use it deceptively.
- Purpose and proportionality: we ask only for what each feature needs and do not use it for anything else without telling you.
- Accuracy: you can correct your data whenever you want.
- Transparency: this policy says what data we use, what for, who receives it and for how long.
- Security and confidentiality: we apply reasonable technical and organizational measures (section 9).
- Accountability: we answer for how your data is processed, even when a provider we hire handles it.
3. What data we process
3.1 Data you give us
- Identity and contact: first and last name, email, phone (WhatsApp), date of birth, country and city.
- Identity document: RUT (Chile), CUIT (Argentina), RFC (Mexico), etc.
- Work data: job title, area, projects, daily rate, availability, workdays and hours.
- Expenses and receipts: photos of receipts and invoices, vendor, amount, category and document.
- Optional profile data (some of it sensitive): health insurance (Fonasa or Isapre), pension fund (AFP), union membership and bank account number. We only store them if you enter them, we only use them in the features where you activate them, and you can withdraw them or ask us to delete them whenever you want.
3.2 Data generated when you use Set-Os
- GPS location: when you check in or out, we record your location and the time. Only with your permission.
- Photos: when you upload them, your browser removes their metadata (EXIF). The location you record is stored as data of the photo.
- Activity in the app: closed workdays, overtime, signed contracts, advances and timestamps.
- Device and connection: browser type, system, phone model and IP address, for security and support. The hosting server also keeps access logs.
- Payments: order, amount, date and authorization code. We do not store card numbers.
3.3 Sensitive data
The law calls data such as health data and union membership "sensitive". In Set-Os they only appear if you enter them in your profile (health insurance and union). We process them only with your specific consent for that feature, we do not use them for analytics or share them, and you can withdraw them at any time.
4. What we use it for and the legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and maintain your account, sign in | Identity, contact, document | Performance of the contract (the Terms) |
| Record your workday and calculate hours | Location, hours | Your consent (location permission) and performance of the contract |
| Record expenses and read receipts with AI | Photos, amounts, vendor | Performance of the contract; you start the AI reading and review the result |
| Charge the Full plan and issue payment receipts | Payment data, email | Performance of the contract and tax legal obligation |
| Send you service notices (password recovery, plan expiry, reminders) | Email, notifications | Performance of the contract; for push notifications, your consent |
| Share a document with your production company through a link (section 7) | Workdays or expenses you choose | Your decision and consent each time you send |
| Use your health insurance or union data in the features where you activate them | Sensitive profile data | Your specific consent, which you can withdraw |
| Measure visits with Google Analytics | Browsing, device | Your consent (cookie notice) |
| Security, abuse and fraud prevention, improving the service | Activity, IP, usage events with a pseudonymous identifier | Legitimate interest, weighed against your rights |
| Handle your rights requests and comply with the law | The necessary ones | Legal obligation |
We do not sell your data, we do not use it for third-party advertising and we do not make automated decisions that produce legal effects on you: AI receipt reading is an aid that you review and confirm before saving, and the expense-report "auditor" only flags possible errors for you to review.
5. Who receives your data
5.1 Inside Set-Os
- You: full access to your data.
- Support team: only if you report a problem, temporarily.
5.2 Providers that process data on our behalf
- Hosting and email: HostGator (server where we store the data).
- File backup: Backblaze B2 (United States): copy of your photos and receipts.
- AI to read receipts: Anthropic (Claude API, United States): receives the image of the receipt to extract its data. According to its commercial terms it does not use it to train its models and deletes it according to its retention policy (up to 30 days).
- Payments: Transbank (Chile) and dLocal (other countries): receive the data needed to charge; Set-Os does not store card data.
- Maps and addresses: OpenStreetMap (Nominatim) receives the coordinates of your check-in to show you the address. The "View on Google Maps" links open Google, which receives that location only when you open them.
- Receipt QR code (Full plan): the api.qrserver.com service generates the QR image from the document's verification link.
- Push notifications: the notification service of your browser or system (Google, Apple, Mozilla or Microsoft, depending on your device).
- Analytics: PostHog US Cloud (usage events with a pseudonymous identifier; it does not receive RUT, email, GPS, photos or amounts) and Google Analytics (only if you accept it).
- Sign-up security: Google reCAPTCHA checks that you are not a robot.
5.3 Authorities
Only when the law requires it or a competent authority orders it.
6. Cookies and storage on your device
Necessary (always on). The session cookie (setos_sess) keeps you signed in; we also use protection against forged submissions (CSRF) and a language preference cookie (setos_idioma). At sign-up, Google reCAPTCHA checks that you are not a robot. We also store on your device (local storage) your cookie choice, your language and the records that have not been sent yet when there is no signal. Fonts are loaded from Google Fonts, so Google receives your IP address when you open the page.
Analytics (only if you accept). Google Analytics uses the cookies _ga and _ga_WV27F13PZ6 to measure visits and screen usage. If you choose "Necessary only" or do not answer, Google Analytics is not loaded and nothing is sent to Google from that tool. You can change your decision whenever you want with the "Cookies" link at the bottom of the home page; when you withdraw permission we delete those cookies.
No cookies. PostHog receives app usage events (with a pseudonymous identifier, without RUT, email, GPS, photos or amounts) sent from our server, without installing cookies in your browser. You can object to this analytics as explained in section 10.
7. Links to share your workday or expense report (Full plan)
You can create a read-only link to send to your production company. It is your decision, case by case:
- What it includes: what you choose (period and, for expenses, project) and see in a preview: date, check-in, check-out and hours for workdays; date, vendor, concept, category, document and amount for expenses. Your name always appears; your RUT only if you check it.
- What it does not include: photos of receipts, GPS location or the amount of your overtime.
- Who sees it: anyone who has the link, with no account needed. Share it only with whoever should have it: we cannot know who opens it. We keep the number of visits and the date of the last one.
- How long it lasts: 14 days. You can stop sharing earlier from the app itself, and the link stops working instantly.
- How it is stored: a copy of the document as it was created, with a verification code, and only the encrypted summary (hash) of the link, not the link itself. The link is not indexed by search engines.
8. International transfers
Part of your data is processed outside Chile, mainly in the United States: the backup of photos and receipts (Backblaze), AI receipt reading (Anthropic), analytics (PostHog and, if you accept, Google) and QR generation. We only send what is needed for each service and choose providers that offer data processing terms and security guarantees, as Chilean law requires for transfers abroad.
9. How long we keep your data and how we protect it
| Data | Retention period |
|---|---|
| Your account data, workdays, expenses and photos | As long as your account exists |
| After you ask to delete your account | They stop being available in the app immediately. We keep an encrypted backup for up to 90 days, in case the request was a mistake, and then destroy it permanently: after that period they cannot be recovered. Payment records are kept because of tax obligations. |
| Shared links | 14 days; the stored document is deleted together with your account. |
| Technical and security logs | The time needed to provide support and protect the service. |
Security
- Connection: HTTPS/TLS on all connections.
- Passwords: stored hashed (bcrypt), never in plain text.
- Access: attempt limits on sign-in, password recovery and the administration areas.
- Photos: the browser removes their EXIF metadata when uploading them; the location you record is only seen by you and your project.
- Backups: daily copy of the database on the server.
If a security breach occurs
If we detect an incident that compromises your personal data, we will report it to the Personal Data Protection Agency when the law requires and we will notify you by email or inside the app, without delay, together with the measures we took and what you can do.
10. Your rights
- Access: know what data of yours we process and receive a copy.
- Rectification: correct inaccurate or incomplete data; you can do it from the app or ask us to do it.
- Erasure: delete your account and your data (with the encrypted backup of up to 90 days from section 9), except what we must keep by law.
- Objection: object to processing based on legitimate interest, for example usage analytics.
- Portability: receive your data in a structured, commonly used format (CSV or JSON).
- Temporary blocking: ask us to stop using your data while we resolve a request of yours, except for storing it.
- Automated decisions: we do not make automated decisions with legal effects on you (section 4); if we ever did, you could ask for human intervention.
- Withdraw a consent: at any time, as easily as you gave it (location permission on your device, notifications, cookies and sensitive profile data). Withdrawing it does not affect what was done before.
How to exercise them: write to dudas@wrap-os.com from your account's email, telling us which right you want to exercise. It is free. Deadline: we reply within 30 days. If we need more time because of the complexity of your request, we will tell you beforehand and explain why.
11. Consents
We ask for your permission, separately and clearly, for: using your location when you check in and out; photos with location; notifications; analytics cookies; the sensitive data in your profile; and accepting this Policy and the Terms. You can withdraw each one whenever you want.
12. Changes to this Policy
If we change this policy in a significant way, we will tell you through the app and by email before the change takes effect and, when the law requires it, we will ask for your consent again. If you do not agree, you can close your account without penalty. Previous version: 1.1 (October 9, 2026).
13. Language
This Policy is available in Spanish, English and Portuguese. The English and Portuguese versions are translations for your convenience: if there is any difference, the Spanish version prevails. Some automatic system notices (for example emails and error messages) may arrive in Spanish only.
14. Contact and complaints
Email: dudas@wrap-os.com
Complaints: write to us first and we will sort it out. If you are not satisfied, you can complain to Chile's Personal Data Protection Agency (once it is operating) and, on consumer matters, to SERNAC. If you are in another country, to the personal data authority of your country.
Last reviewed: October 15, 2026 · Terms and Conditions