Privacy Policy

Who we are

Urbs (“Urbs”, “we”, “us”) runs the location intelligence app at urbs.ai and is the controller of the personal information described here. Contact us about anything in this policy at tamas@urbsai.com.

What we collect

From your sign-in provider

You sign in with Google or Apple, or Microsoft where it’s offered. The provider tells us your email address, whether it’s verified and, if it shares one, your name. If you use Apple’s Hide My Email, we receive the relay address instead. We never see your password for those services.

From you

• Profile: the name and workspace name you enter when you first sign in.
• Workspaces: the workspaces you create, who owns them and who belongs to them.
• Investigations: your questions, the assistant’s answers, the searches, places and areas involved, your map view and settings, and map annotations drawn by you or added by the assistant.
• Drafts: a question you’ve typed but not sent, so it survives a page reload.
• Saved lists: the places you save, who saved them and when, and a record of changes and CSV exports, including who exported, how many rows and which columns.
• Preferences: display settings such as light or dark mode and panel size.
• Messages to us: anything you send when you email us.

Automatically

• Assistant request records: for each question, the workspace and investigation, the model, whether the request completed, how long it took, how many steps and tools it used, the number of tokens processed and the cost. These records don’t contain your question or the answer.
• Service logs: our hosting providers keep standard request logs, such as IP address, browser, time and the address requested, to run and protect the service.

From the former waitlist

Before signup opened, Urbs ran a waitlist. We still hold the email address, the page it was submitted from and the date for people who joined. We no longer collect waitlist sign-ups and will delete an entry on request.

How we use it

Under UK and EU data protection law, we rely on these legal bases:

• Providing Urbs to you (contract): signing you in, keeping your workspaces, investigations and lists, answering your questions and producing the exports you ask for.
• Running the service safely and well (legitimate interests): preventing abuse, applying usage limits, fixing faults, and using request records to understand speed, reliability and cost.
• Meeting legal obligations: answering lawful requests and keeping the records the law requires.

We only open the contents of your workspace to help with something you’ve asked us about, to investigate a security or abuse problem, or when the law requires it. We don’t use your content for advertising or to train AI models, and we don’t make decisions about you by automated means that have legal or similarly significant effects.

The AI assistant

To answer a question, we send it to an AI model along with recent messages from the same investigation and the place or area records the answer needs. Requests pass through Vercel’s AI Gateway to the model provider; the current default model is from OpenAI.

The provider processes this content to produce the answer. It may keep it for a limited time under its API terms, for example to detect abuse. OpenAI’s API terms say it doesn’t use API content to train its models by default. Please don’t include sensitive personal information about yourself or anyone else in your questions.

Who we share it with

We don’t sell personal information. These service providers process it on our behalf to run Urbs:

• Supabase: sign-in, and the database that stores accounts, workspaces, investigations and lists.
• Vercel: hosting, and the AI Gateway that routes assistant requests.
• OpenAI, through Vercel’s AI Gateway: generating assistant answers.
• Amazon Web Services, in its London region: place searches, export files and, when you look up a town or postcode, geocoding with Amazon Location Service. Only the place name or postcode is sent for geocoding.
• Google, Apple or Microsoft: only the one you choose to sign in with.

Your browser loads background map images directly from OpenFreeMap, which receives your IP address and the area of the map you’re viewing, as with any web request. We don’t share your account details with it.

We may also disclose information when the law requires it, to protect people or the service from harm, or to a buyer or successor if Urbs is reorganised or sold. This policy would continue to apply.

International transfers

Some of these providers process information outside the UK, including in the United States. When they do, we rely on safeguards recognised under UK law, such as the International Data Transfer Addendum or the UK extension to the EU–US Data Privacy Framework where the provider is certified.

Cookies and similar storage

Urbs has no advertising or analytics cookies. It uses:

• Sign-in cookies from Supabase, which keep you signed in and secure the sign-in process.
• An urbs-theme cookie, which remembers light or dark mode for up to a year.
• Browser session storage, which lets an export in progress resume after a reload. If you turn on assistant timing, it also keeps timings in your own browser; they aren’t sent to us.

Each is needed for something you’ve chosen to do, so we don’t ask for consent. You can clear them in your browser settings at any time, which signs you out.

People who appear in place data

Urbs is about businesses and places, not individuals. Even so, some place records, such as a sole trader’s business name, phone number or website, can relate to a person. These come from the published sources on our data sources page. They are currently shown only to accounts in our live data pilot, and we use them under our legitimate interest in helping customers understand local markets. We keep business-level fields only and don’t include named contacts. If a record relates to you, you can ask us to correct or remove it, or object to its use, at tamas@urbsai.com.

How long we keep it

• Account, workspaces and saved content: while your account is open. Archiving an investigation hides it; it doesn’t delete it.
• Assistant request records: as long as the investigation they relate to.
• List change and export records: as long as the list they relate to.
• Export files from the live data pilot: stored privately in our AWS account until they’re no longer needed for the pilot.
• Service logs: for our providers’ standard periods, typically days to weeks.

If you ask us to delete your account, we’ll delete or anonymise your personal information within 30 days, except anything we must keep to meet a legal obligation or resolve a dispute. Backup copies are overwritten on our providers’ normal schedule.

Your rights

Depending on where you live, you can ask us to:

• give you a copy of your personal information, including in a portable format;
• correct anything that’s wrong;
• delete your information or your account;
• limit how we use it, or object to uses based on our legitimate interests.

There’s no self-serve deletion or download yet, so email tamas@urbsai.com from the address you sign in with. We’ll respond within one month, free of charge, and may ask you to confirm your identity first.

If you’re unhappy with how we’ve handled your information, please tell us first. In the UK you can also complain to the Information Commissioner’s Office; in the EU, to your local data protection authority.

Notice for US residents

In the past 12 months we have collected identifiers (such as name and email address), the content you create in Urbs, and internet activity limited to the service logs described above. We get them from you, from your sign-in provider and from your use of Urbs, use them for the purposes in this policy, and keep them for the periods above.

We don’t sell personal information, share it for cross-context behavioural advertising or use sensitive personal information to infer things about you. Wherever you live in the US, you can ask to know, correct or delete your information using the contact above, and we won’t treat you differently for asking.

Security

The database only lets members of a workspace read that workspace’s data. Information is encrypted in transit, and our providers encrypt it at rest. No system is perfectly secure; if a breach affects you, we’ll tell you and the regulator as the law requires.

Children

Urbs is a business tool for adults aged 18 and over. We don’t knowingly collect children’s information; if you think a child has given us some, contact us and we’ll delete it.

Changes to this policy

We’ll update this page when what we collect, or who processes it, changes, for example when we add billing or new integrations. The date at the top will change too. For significant changes we’ll also tell signed-in users before they take effect.