Privacy Policy

1. Who We Are

The party responsible for the Platform, and the controller of the personal data described in this Policy (except where stated otherwise in Section 2), is Urbanno Inc., as identified above. We are headquartered in Québec, Canada, and are subject to Law 25 and PIPEDA.

2. Scope of This Policy

This Policy applies to personal data we collect from businesses and professionals who use the Services, and from visitors to our website. The Services are intended solely for professionals and are not directed at individuals under 18 years of age.

Three terms are used throughout this Policy: Controller — the party that decides why and how data is processed and is legally responsible for it. Processor — the party that processes data on behalf of the Controller, following the Controller’s instructions. Sub-processor — a third-party service provider used by the Processor to carry out processing.

3. Categories of Personal Data We Process (as Controller)

Urbanno is the Controller for all data generated by Clients using the Platform. Sub-processors are Supabase (authentication, database, and storage), Cloudflare (hosting, CDN, and logs), Stripe (payment processing, Priority Beta plan only), and an email provider such as Resend (transactional notifications).

• Account and identity data — name, email address, hashed password, company name, user role, and profile details.
• Project and content data — uploaded image sequences, 3D scene configs, unit data, pricing, floor plans, PDFs, and logos.
• Usage and operational data — actions in the admin back-office, project configuration changes, audit logs, and support correspondence.
• Technical and device data — IP address, browser type, operating system, session cookie, and server logs.
• Billing and payment data (Priority Beta plan only) — subscription plan, billing contact name and email, invoices, and payment-method tokens managed by Stripe. Urbanno never receives or stores full card numbers; all payment processing is handled directly by Stripe.
• Transactional email — notification, billing, and confirmation emails sent to the Client.

Buyer interaction data is processed by Urbanno as the Client’s processor, not as controller; it is described in Section 5.

We do not collect special-category or sensitive personal data and ask that you not submit it through the Platform.

4. How We Collect Personal Data

• Directly from you when you register for an account, configure a Project, or contact support;
• Automatically through session cookies and server logs when you use the Platform;
• From our authentication provider when you sign in; and
• From Stripe when you subscribe to the Priority Beta plan, in the form of subscription status and billing confirmations.

5. Buyer and Visitor Analytics

The Client that owns the Experience is the Controller; Urbanno acts only as Processor; PostHog is the Sub-processor. Analytics are loaded only after the Buyer affirmatively accepts the cookie consent banner.

• Interaction data — navigation paths, unit clicks, gallery views, and time on view, linked via a randomly generated browser identifier. No name, email, IP address, or phone number is stored.
• IP addresses — discarded immediately after momentary use for bot detection. Never stored alongside events.
• No-consent visitors — if a Buyer declines or does not respond to the banner, no identifier is set and no data is collected or stored. The Buyer may change their choice at any time through the “Cookie preferences” control on the Experience.

6. Purposes and Legal Bases for Processing

We process the personal data described in Section 3 to:

• create, operate, secure, and maintain your account and the Platform;
• provide the Services and host the Experiences you configure;
• authenticate users and prevent fraud, abuse, and unauthorised access;
• provide customer support and respond to your requests;
• understand and improve how the Platform is used through internal product analytics;
• process subscription payments and manage billing for the Priority Beta plan;
• send service, security, and billing communications; and
• comply with our legal, regulatory, accounting, and tax obligations, and establish, exercise, or defend legal claims.

Where Law 25 and PIPEDA apply, we process personal data on the bases they permit, including performance of a contract, our legitimate business interests, compliance with a legal obligation, and, where required, your consent.

Where the GDPR applies, our legal bases are: performance of a contract (Art. 6(1)(b)) to operate your account, host your Experiences, and process payments; legitimate interests (Art. 6(1)(f)) to secure the Platform and improve our Services; legal obligation (Art. 6(1)(c)) for accounting and tax duties; and consent (Art. 6(1)(a)) for any non-essential cookies.

Where the CCPA/CPRA applies, you have the rights described in Section 12. We do not sell personal data and do not share it for cross-context behavioural advertising.

7. Cookies

Strictly necessary cookies. We use a secure, httpOnly session cookie issued by our authentication provider to keep Clients signed in. This cookie is strictly necessary for the Platform to function and does not require consent.

Analytics cookies (consent required). Analytics cookies are set on published Experiences only after the Buyer affirmatively accepts the consent banner described in Section 5. No advertising cookies are used.

8. Sub-Processors and Recipients

Our current sub-processors, each bound by contract to use data only to provide services to us:

• Supabase — authentication, database, and storage (USA / EU)
• Cloudflare — application hosting and CDN (global edge)
• PostHog — Buyer interaction analytics, loaded only after consent (USA / EU)
• Stripe — payment processing for the Priority Beta plan (USA)
• Resend (or equivalent) — transactional and billing email (USA)

We will update this list as we introduce new sub-processors. We may also disclose personal data to professional advisers, courts, regulators, or competent authorities where required by law.

9. International Transfers

We and our sub-processors process personal data outside Québec, including in the United States. Before transferring personal data outside Québec, we conduct a privacy impact assessment as required by Law 25, and we rely on appropriate contractual safeguards with our sub-processors. Where the GDPR applies, we rely on the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism, supported by appropriate technical and organisational measures.

10. Retention

We keep personal data only for as long as necessary for the purposes set out in this Policy, taking into account the life of your account, legal and accounting retention requirements, the need to resolve disputes and enforce our agreements, and security and fraud-prevention needs. When your account is closed, we will endeavour to give reasonable advance notice before deleting data. Urbanno is under no obligation to maintain backups and provides no guarantee of data recovery. Backups are overwritten on a rolling basis.

11. Automated Decision-Making

We do not carry out automated decision-making that produces legal or similarly significant effects concerning you. Our internal product analytics are used only to understand and improve the Platform and do not, by themselves, make decisions that significantly affect you.

12. Your Rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure of your data, subject to legal retention requirements;
• request restriction of, or object to, certain processing;
• request portability of data you provided to us; and
• withdraw consent at any time where we rely on consent, without affecting prior processing.

Where the CCPA/CPRA applies, you also have the right to know, to delete, and to correct personal information, and not to be discriminated against for exercising your rights. We do not sell or share personal information as those terms are defined under that law.

To exercise any right, contact us at privacy@urbanno.io. We will respond within the timeframes required by applicable law (in Québec, generally within thirty (30) days) and may need to verify your identity first. Exercising these rights is free of charge, subject to limited exceptions permitted by law.

If you are a Buyer with a question about data collected through a Client’s Experience, the Client is the controller of that data — please contact that Client directly. We will forward to the relevant Client any request you send us.

13. Data Security

We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, access controls based on the principle of least privilege, secure authentication, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Personal Data Breaches

If a confidentiality incident involving personal data occurs, we will assess it and act in accordance with Law 25 and, where applicable, PIPEDA and the GDPR. We maintain a register of confidentiality incidents, and where an incident presents a real risk of serious harm, we will notify the Commission d’accès à l’information du Québec and the affected individuals, as required by law. A notification is not an admission of fault.

15. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a revised effective date and, where the change is material, we will take reasonable steps to notify you in advance. Your continued use of the Platform after an update takes effect constitutes acceptance of the revised Policy, to the extent permitted by applicable law.

16. How to Complain

We would like the opportunity to resolve your concern first — please contact us at privacy@urbanno.io. You also have the right to lodge a complaint with a supervisory authority, including:

• in Québec, the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca);
• elsewhere in Canada, the Office of the Privacy Commissioner of Canada (www.priv.gc.ca); and
• in the EU/EEA or UK, your local data-protection supervisory authority.