Privacy Policy

1. Who We Are

The party responsible for the Platform, and the controller of the personal data described in this Policy (except where stated otherwise in Section 2), is Urbanno Inc., as identified above. We are headquartered in Québec, Canada, and are subject to Law 25 and PIPEDA.

2. Scope of This Policy

This Policy applies to personal data we collect from businesses and professionals who use the Services, and from visitors to our website. The Services are intended solely for professionals and are not directed at individuals under 18 years of age.

Three terms are used throughout this Policy: Controller — the party that decides why and how data is processed and is legally responsible for it. Processor — the party that processes data on behalf of the Controller, following the Controller’s instructions. Sub-processor — a third-party service provider used by the Processor to carry out processing.

3. Categories of Personal Data We Process (as Controller)

Urbanno is the Controller for all data generated by Clients using the Platform. Sub-processors are Supabase (authentication, database, and storage), Cloudflare (hosting, CDN, and logs), Stripe (payment processing, Early Access Plan only), and Resend (authentication emails, user notifications, billing, and transactional email).

• Account and identity data — name, email address, hashed password, company name, user role, and profile details.
• Project and content data — uploaded image sequences, 3D scene configs, unit data, pricing, floor plans, PDFs, and logos.
• Usage and operational data — actions in the admin back-office, project configuration changes, audit logs, and support correspondence.
• Technical and device data — IP address, browser type, operating system, session cookie, and server logs.
• Billing and payment data (Early Access Plan only) — subscription plan, billing contact name and email, invoices, and payment-method tokens managed by Stripe. Urbanno never receives or stores full card numbers; all payment processing is handled directly by Stripe.
• Transactional email — notification, billing, and confirmation emails sent to the Client.

Buyer interaction data and Buyer contact details are processed by Urbanno as the Client’s processor, not as controller; they are described in Section 5.

We do not collect special-category or sensitive personal data and ask that you not submit it through the Platform.

4. How We Collect Personal Data

• Directly from you when you register for an account, configure a Project, or contact support;
• Automatically through session cookies and server logs when you use the Platform;
• From our authentication provider when you sign in;
• From Stripe when you subscribe to the Early Access Plan, in the form of subscription status and billing confirmations; and
• Directly from a Buyer who voluntarily submits the contact form on a published Experience, on behalf of the Client that owns it (Section 5).

5. Buyer Data: Analytics and Contact Details

A published Experience involves two separate kinds of Buyer data, governed by two separate legal bases: interaction analytics, which depend on the cookie consent banner, and contact details, which the Buyer chooses to submit through a contact form. For both, the Client that owns the Experience is the Controller and Urbanno acts only as Processor.

5.1 Interaction analytics (consent required)

PostHog is the Sub-processor. Analytics are loaded only after the Buyer affirmatively accepts the cookie consent banner.

• Interaction data — navigation paths, unit clicks, gallery views, and time on view, linked via a randomly generated browser identifier. This interaction data contains no name, email, IP address, or phone number.
• IP addresses — used momentarily for approximate location and bot detection, then discarded. Never stored alongside events.
• No-consent visitors — if a Buyer declines or does not respond to the banner, no analytics identifier is set and no interaction data is collected or stored. The Buyer may change their choice at any time through the “Cookie preferences” control on the Experience.

5.2 Contact details submitted by a Buyer

If a Buyer submits the contact form on an Experience, they are asking the Client to contact them. The legal basis is the Buyer’s own submission — their consent and the steps taken at their request prior to a possible transaction — which is independent of the cookie banner: a Buyer who declined analytics cookies can still send their details, and those details are still stored. The contact form names the recipient and the purpose at the moment of collection, and the consent banner states that form submissions are handled separately from the analytics choice. Supabase is the Sub-processor (storage only).

• What is stored — email address (required), name and phone number (optional), the unit the Buyer was viewing, and the time of submission.
• Link to browsing behaviour — if, and only if, the Buyer had accepted analytics cookies, the submission also stores the random browser identifier described in Section 5.1, so the Client can see which browsing activity led to the enquiry. If the Buyer declined, no such link exists and the enquiry stands alone.
• Who can access it — only the Client account that owns the Experience. Access is enforced by database-level row security, not merely by the interface: Urbanno personnel granted technical support access to a Project are excluded from these records and cannot read them.
• How Urbanno uses it — we do not use Buyer contact details for our own marketing, do not sell or rent them, and do not disclose them to other Clients or to third parties. We process them solely to store them for, and make them available to, the Client.
• Never sent to the analytics provider — the contact event recorded in PostHog carries no name, email, or phone number.

Retention and deletion of both categories are described in Section 10. A Buyer wishing to access, correct, or delete their data should contact the Client that owns the Experience; see Section 12.

Because the Free Plan does not allow publishing or deploying Experiences, Free Plan users do not generate any Buyer analytics or collect any Buyer contact details. The collection described in this Section applies exclusively to Clients on the Early Access Plan or higher who have published at least one Experience.

6. Purposes and Legal Bases for Processing

We process the personal data described in Section 3 to:

• create, operate, secure, and maintain your account and the Platform;
• provide the Services and host the Experiences you configure;
• authenticate users and prevent fraud, abuse, and unauthorised access;
• provide customer support and respond to your requests;
• understand and improve how the Platform is used through internal product analytics;
• process subscription payments and manage billing for the Early Access Plan;
• send service, security, and billing communications; and
• comply with our legal, regulatory, accounting, and tax obligations, and establish, exercise, or defend legal claims.

Where Law 25 and PIPEDA apply, we process personal data on the bases they permit, including performance of a contract, our legitimate business interests, compliance with a legal obligation, and, where required, your consent.

Where the GDPR applies, our legal bases are: performance of a contract (Art. 6(1)(b)) to operate your account, host your Experiences, and process payments; legitimate interests (Art. 6(1)(f)) to secure the Platform and improve our Services; legal obligation (Art. 6(1)(c)) for accounting and tax duties; and consent (Art. 6(1)(a)) for any non-essential cookies.

Where the CCPA/CPRA applies, you have the rights described in Section 12. We do not sell personal data and do not share it for cross-context behavioural advertising.

7. Cookies

Strictly necessary cookies. We use a secure, httpOnly session cookie issued by our authentication provider to keep Clients signed in. This cookie is strictly necessary for the Platform to function and does not require consent.

Analytics cookies (consent required). Analytics cookies are set on published Experiences only after the Buyer affirmatively accepts the consent banner described in Section 5. No advertising cookies are used.

8. Sub-Processors and Recipients

Our current sub-processors, each bound by contract to use data only to provide services to us:

• Supabase — authentication, database, and storage, including Buyer contact details (USA / EU)
• Cloudflare — application hosting and CDN (global edge)
• PostHog — Buyer interaction analytics, loaded only after consent (USA / EU)
• Stripe — payment processing for the Early Access Plan (USA)
• Resend — authentication emails, user notifications, billing, and transactional email (USA)

We will update this list as we introduce new sub-processors. We may also disclose personal data to professional advisers, courts, regulators, or competent authorities where required by law.

9. International Transfers

We and our sub-processors process personal data outside Québec, including in the United States. Before transferring personal data outside Québec, we conduct a privacy impact assessment as required by Law 25, and we rely on appropriate contractual safeguards with our sub-processors. Where the GDPR applies, we rely on the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism, supported by appropriate technical and organisational measures.

10. Retention

We keep personal data only for as long as necessary for the purposes set out in this Policy, taking into account the life of your account, legal and accounting retention requirements, the need to resolve disputes and enforce our agreements, and security and fraud-prevention needs. When your account is closed, we will endeavour to give reasonable advance notice before deleting data. Urbanno is under no obligation to maintain backups and provides no guarantee of data recovery. Backups are overwritten on a rolling basis.

Buyer data (Section 5). Both categories are retained for as long as the Client’s Project exists, on the Client’s instructions as Controller.

• Interaction analytics — deleted when the Client unpublishes the Experience or moves back to the Free Plan, because an unpublished Experience collects nothing further.
• Contact details — retained through those two reversible changes, because they are the Client’s own business enquiries and would otherwise be lost by a temporary downgrade.
• Deletion of the Project or the account — permanently deletes both categories, together with all other Project data, by cascade.

11. Automated Decision-Making

We do not carry out automated decision-making that produces legal or similarly significant effects concerning you. Our internal product analytics are used only to understand and improve the Platform and do not, by themselves, make decisions that significantly affect you.

12. Your Rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure of your data, subject to legal retention requirements;
• request restriction of, or object to, certain processing;
• request portability of data you provided to us; and
• withdraw consent at any time where we rely on consent, without affecting prior processing.

Where the CCPA/CPRA applies, you also have the right to know, to delete, and to correct personal information, and not to be discriminated against for exercising your rights. We do not sell or share personal information as those terms are defined under that law.

To exercise any right, contact us at privacy@urbanno.io. We will respond within the timeframes required by applicable law (in Québec, generally within thirty (30) days) and may need to verify your identity first. Exercising these rights is free of charge, subject to limited exceptions permitted by law.

If you are a Buyer with a question about data collected through a Client’s Experience, the Client is the controller of that data — please contact that Client directly. We will forward to the relevant Client any request you send us.

13. Data Security

We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access controls based on the principle of least privilege, secure authentication, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Administrative access. A limited number of authorised Urbanno personnel may access stored data, including the data described in Section 5, where strictly necessary to operate, maintain, secure, back up, or troubleshoot the Services, or where required by law. Such access is limited to what the task requires and is subject to confidentiality obligations. It is never used to contact Buyers, for our own marketing, or for any commercial purpose of our own. This is distinct from the in-product support access a Client may grant over a Project, which does not include Buyer contact details at all (Section 5.2).

14. Personal Data Breaches

If a confidentiality incident involving personal data occurs, we will assess it and act in accordance with Law 25 and, where applicable, PIPEDA and the GDPR. We maintain a register of confidentiality incidents, and where an incident presents a real risk of serious harm, we will notify the Commission d’accès à l’information du Québec and the affected individuals, as required by law. A notification is not an admission of fault.

15. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a revised effective date and version stamp.

When we make a material change — a new category of personal data, a new purpose, a new sub-processor, or a change to retention or to your rights — we notify Clients by email to the address on their account. We do not undertake to give advance notice: notice is given when the updated version is published. The one exception is that where a change introduces a genuinely new processing of personal data, we will inform you before that processing begins, as applicable law requires. Your continued use of the Platform after an update takes effect constitutes acceptance of the revised Policy, to the extent permitted by applicable law.

Editorial corrections that do not change what we collect, why we collect it, who receives it, or how long we keep it — typographical fixes, punctuation, formatting, or rewording for clarity — are not material and do not trigger notice. They still receive a revised version stamp.

16. How to Complain

We would like the opportunity to resolve your concern first — please contact us at privacy@urbanno.io. You also have the right to lodge a complaint with a supervisory authority, including:

• in Québec, the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca);
• elsewhere in Canada, the Office of the Privacy Commissioner of Canada (www.priv.gc.ca); and
• in the EU/EEA or UK, your local data-protection supervisory authority.