Privacy policy

Last updated 2026-10-04

Who we are

SetMirror is operated by EBERLCO, Budapest, Hungary (“we”). We are the controller of the personal data described here. Contact: hello@setmirror.com.

What we process, and why

• Account data. When you create an account or sign in, our identity provider (Auth0, EU region) receives your email address and either your password or the account you chose (Google), and gives us your name, email address, profile picture address and account ID. We use them to let you in and to show who you are in the app. We never see or store your password; the identity provider does. Basis: performing our service to you (GDPR Art. 6(1)(b)).
• Your content. Locations (names, addresses, GPS), scans and videos of places, 3D models generated from them, imported models and plans, notes, measurements, camera shots and settings. We use it only to provide the service to you. Basis: Art. 6(1)(b).
• Technical data. When the app is served from a web host, the host's server logs record your IP address, browser and the time of each request. We use this for security and to keep the service running. Basis: our legitimate interest (Art. 6(1)(f)).

We do not use analytics, advertising or tracking tools, and we do not sell personal data.

Where your data is kept

By default SetMirror keeps your locations, scans, models, plans, notes, measurements and shots on your own device, in your browser's storage. Clearing the site's data in your browser deletes them, and they are not backed up for you.

If you choose Publish to cloud for a location, its scan is uploaded so that you, and the people you share it with, can open it from other devices. Only the scan files are uploaded, and they are encrypted in your browser before they leave it: our storage only ever holds the encrypted files and a separate key per location, which our server hands out only to people who are allowed to open that location. The location's name, who owns it, the email addresses and roles of the people you share it with, and an access log (who opened or changed it, when, and from which country) are kept in a database. Notes, measurements, shots and other scene data stay on your device.

When you publish you choose a region, Europe or United States. The encrypted files and the database records of that location are stored in that region only (Europe: Cloudflare's EU jurisdiction). We do not use your content to train models and we do not send it to third-party AI services.

Cookies and local storage

SetMirror itself sets no cookies. It stores the items below in your browser. They are needed to run the app and are not shared with anyone. Signing in takes you to the identity provider's own page, which may set its own cookies under its policy, and our hosting provider may set technical cookies that keep the service secure.

Everything above is strictly necessary to provide the service you asked for, and there is no analytics, advertising or tracking storage. That is why SetMirror does not show a cookie banner. If we ever add optional storage (for example analytics) we will ask for your consent first and list it here.

Who receives data

• Okta, Inc. (Auth0), our identity provider for sign-in, and the sign-in service you pick (Google), each under its own privacy policy.
• Cloudflare, Inc., which serves the app and stores published locations (encrypted files and database records) in the region you chose, as our processor.
• The OpenStreetMap Foundation (Nominatim address service), only when you ask for or type GPS coordinates in "Edit location": the coordinates are sent so it can return the street address; nothing else is sent.
• The people you share a location with, who can see what the role you gave them allows (see "Where your data is kept").
• Authorities, only where the law requires it.

If data is transferred outside the European Economic Area (for example to our US-based providers, or when you choose the United States region), we rely on an adequacy decision or the standard contractual clauses approved by the European Commission.

How long we keep it

Data on your device stays until you delete it. Account data is kept as long as your account exists. A published location, its encrypted files and the sharing settings stay until you delete the location or close your account; deleting removes the files, the key and the permissions. You can close your account yourself under Settings, Close account: it deletes your published locations, the sharing settings and your account record. Access log entries are kept for security and audit purposes for up to 12 months and are deleted automatically by a daily job; entries about a closed account are not linked to it. Server logs of our hosting provider are kept for a short period (no longer than 90 days).

Your rights

You can ask us for access to your personal data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time. Write to hello@setmirror.com; we answer within one month. You may also complain to your data protection authority, for example in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu), or the authority where you live.

Security

The app is served over HTTPS. Sign-in uses our identity provider's hosted page and signed tokens. Published scans are encrypted in your browser before upload, stored in private storage that is not publicly readable, and every request is checked against the permissions of the location. Data on your own device is only as safe as the device, so keep it and your browser profile protected.

Children

SetMirror is for professional use and is not meant for people under 16. We do not knowingly process their data.

Changes

If we change how we handle personal data we will update this page and the date above, and tell you in the app when the change is significant.