Urbano DX Privacy Policy

This policy covers the Urbano DX public marketing website. Project-specific data handling is defined separately in the relevant MSA, SOW, DPA, and security documents.

If you contact us by email, through the contact form, or through the AI diagnostic on this site, we receive the information you provide: name, email address, company, service interest, and message or conversation content.

Most of this site is static pages, but the contact form and the AI diagnostic run against our own backend, and what you submit through them is stored in our database in the EU (Hetzner, Nuremberg, Germany):

• Contact form: name, email address, company, service interest, message, the language you used, your browser user agent, and the campaign or referrer details of the page where you first arrived.
• AI diagnostic: an anonymous sign-in identifier, the conversation you have with it, the analysis it produces, and the name, email address, and company you provide if you ask to be contacted about the result.

Our hosting provider and CDN also process standard technical logs such as IP address, user agent, request path, and timestamp.

This website runs no advertising, remarketing, or cross-site tracking tags. Google Tag Manager, and the ad pixel it loaded, were removed on July 24, 2026.

• Functional storage: your chosen language and the campaign details of your first visit are kept in your browser's local and session storage. They stay in your browser unless you submit a form, in which case the campaign details are sent with it.
• Firebase (Google): the AI diagnostic signs you in anonymously, which stores an authentication token in your browser. Firebase Analytics loads only after you interact with the site and sets Google Analytics measurement identifiers. Blocking it, or simply not using the diagnostic, breaks nothing else on the site.

We do not currently show a cookie banner. Our reasoning, and the limits of it, are stated openly on our Trust page.

We use contact information to respond to inquiries, prepare project discussions, and manage early business development.

We do not sell personal information. Google (Firebase authentication and analytics), our hosting provider, and the provider that delivers our email notifications process data on our behalf; the current list is published at urbanodx.com/subprocessors. We may also share information with professional advisors or delivery partners when needed to respond to your request or prepare a project.

• Contact form submissions are deleted automatically 24 months after we receive them.
• AI diagnostic sessions and transcripts are deleted automatically 12 months after they are created.

These are enforced by automatic expiry in the database, not only by policy. Where a record has become part of a signed engagement, an invoice, or a tax record, that record is kept for as long as the applicable law requires, in the system where it lives.

Write to urbano@urbanodx.com to access, correct, or delete your information. On a deletion request we remove the contact record, any diagnostic sessions linked to your address, and the diagnostic account row. A deleted record may still exist in an existing backup snapshot until that snapshot ages out of rotation. Under the GDPR you also have the right to object to processing, to request restriction, to data portability, and to complain to a supervisory authority (in Poland, the UODO).