Who we are
Urban AI Labs builds and operates AI systems for small and mid-sized businesses. This policy explains what we collect, why, and the choices you have.
What we collect
Information you give us, your name, email, phone, company, and anything you enter in a form, assessment, or your UrbanOS account. Information collected automatically, basic usage and device data to keep the product secure and improve it.
How we use it
To provide and operate UrbanOS, respond to your requests, send service and account emails, and, only where you have opted in, occasional updates. We do not sell your personal information.
Service providers
We share data only with the providers that run our platform: Supabase (database + authentication), Vercel (hosting), GoHighLevel (CRM), Resend (email), Stripe (payments), and Google/Microsoft for optional single sign-on. Each processes data on our behalf under their own security terms.
Connected accounts
UrbanOS lets you connect the platforms your business already uses, analytics, search, advertising, payments, CRM, your website, so we can report on them and automate work for you. You choose which accounts to connect, you can see exactly what each one is permitted to do, and you can disconnect any of them at any time from Settings → Integrations. Disconnecting destroys the stored credentials for that account. We request the narrowest permission that will do the job: where a read-only permission exists, that is the one we ask for. Credentials are encrypted before they are stored, are readable only by our servers, and are never shown in your browser or to anyone outside our team.
Google user data
When you connect a Google account (for example Google Analytics or Search Console), Urban AI Labs' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we read your Google data only to provide the reporting, insights and automation you asked for inside UrbanOS. We do not sell it, we do not use it for advertising, and we do not use it to train generalized artificial intelligence or machine learning models. Humans do not read it except where you have asked us to help, where it is necessary for security or to fix a problem you have reported, or where the law requires it. We request read-only access to Google Analytics and Search Console, and you can revoke it at any time from Settings → Integrations or from your Google Account permissions page.
We do not transfer Google user data to any third party except the sub-processors that host our infrastructure, Supabase (database) and Vercel (application hosting), which act on our instructions and are bound to equivalent restrictions. Google user data is never sent to our CRM, email, or payments providers, and it is never used to train generalized artificial intelligence or machine learning models, our own or anyone else's.
Retention and deletion
We keep Google user data only as long as we need it to provide the reporting and automation you asked for. When you disconnect a Google account, the stored credentials for it are destroyed immediately, and any Google Analytics or Search Console data derived from that connection is deleted within 30 days. When you close your account, we delete your organization's data, including all Google user data, within 30 days, except where we are legally required to keep records. You can request deletion at any time by emailing kevin@urbanailabs.com, and we will complete it within 30 days.
Your data, your control
You can access, correct, export, or delete your information at any time. Email us and we will take care of it.
Cookies & analytics
We use only the cookies needed to keep you signed in and to understand aggregate, non-identifying site usage. You can decline non-essential cookies in your browser.
Security & retention
Data is encrypted in transit and at rest, isolated per organization, and retained only as long as needed to run your service or meet legal obligations. See our Security page for detail.
Data minimization
We collect only the information we actually need to run your service. We do not ask for information because it might be useful later, and we do not retain it after the purpose it was collected for has ended, except where we are required to keep records. When we are required to disclose information, we disclose only what is specifically required rather than everything we hold. The less we hold about you, the less there is to lose, misuse, or be compelled to hand over.
Requests from government and public authorities
We may be legally required to disclose personal information to a government or public authority. When that happens, we assess whether the request is legally valid before we respond, we disclose only the specific information we are compelled to provide, and we will challenge requests we believe are unlawful or overbroad. Where we are legally permitted to do so, we will notify you before disclosing your information, so that you have the opportunity to seek your own legal remedy. The procedure above is the one we follow; a longer companion write-up of the same approach, shared across our group of companies, is published at urbaneventsglobal.com/government-data-requests/.
Questions? Email kevin@urbanailabs.com.