Urbfix Privacy Policy

1. Who operates Urbfix

Codeploy Private Limited operates Urbfix and acts as controller or operator where applicable. This policy explains how personal information is handled when you use our website, workspace and API.

2. Information we collect

Account information: name, work email and authentication metadata.

Organization information: workspace name, website, country, state, billing email and GSTIN when provided.

API and technical data: API key metadata, request timestamps and IDs, IP or network information where logged, integration URLs and usage information.

Document data: insurance documents submitted for extraction, file metadata, structured results, validation and evidence.

Billing data: plan and subscription status, transaction and invoice identifiers, and billing contact details. Paddle handles raw payment card details; Urbfix does not store them directly.

3. How we use information

We use information to provide and secure accounts and workspaces, authenticate users, process insurance documents, return results, manage API access and usage, administer subscriptions, provide support, detect abuse or security incidents, comply with legal obligations, and improve the service where permitted. We do not state that customer documents are used for model training.

4. Service providers and AI processing

Service providers may process data where necessary to operate Urbfix, including Supabase for authentication, database and storage; OpenAI for document extraction and AI processing; Paddle for payments and subscriptions; and hosting or infrastructure providers. These providers do not become owners of your documents.

5. Payments

Paddle processes paid transactions as Merchant of Record. Codeploy Private Limited may receive customer references, subscription and payment status, transaction and invoice information needed to provide access. Raw card details are handled by Paddle.

6. Retention

Insurance documents and extracted results are retained according to the retention configuration associated with your account or service and operational requirements. Contact support for questions about retention or deletion applicable to your account.

7. Security

Controls include encrypted HTTPS transport, private storage, tenant isolation, hashed API keys, limited server-side credentials, TEST/LIVE separation and key revocation. No certification is implied by this statement.

8. International processing

Service providers may process data in different jurisdictions. Applicable safeguards are used where required by law.

9. Your rights

Depending on applicable law, you may have rights to access, correct, delete or restrict certain personal data. Contact support@urbfix.com.

10. Cookies

Urbfix uses necessary authentication and session cookies. If optional analytics or marketing cookies are introduced, we will provide consent or notice where required.

11. Changes

We may update this policy and will show the latest update date above. Material changes will be communicated where required.