Privacy Policy

Urbay Connect (“Urbay Connect”, “we”, “us”) is a customer-management application for automotive brokers and salespeople, available at app.urbayconnect.com. It helps a business manage its leads and customers, deals, follow-ups, appointments, sales and conversations with customers.

This policy explains what information Urbay Connect processes, why, who helps us process it and the choices available to you. For questions, contact us at ray@urbayconnect.com.

This policy covers the Urbay Connect application and the websites and services that link to it. Urbay Connect is used by businesses (for example a broker and the team members it invites). The business decides which customer and lead information it enters or receives in Urbay Connect and how it uses it; we process that information on the business’s behalf to provide the service. Customers or leads of a business who have questions about how that business uses their information should contact that business directly; we will help the business respond where appropriate.

Account and profile information. Name, email address and password for each user (passwords are handled by our authentication provider and are never visible to us), the user’s role in the business, two-step verification enrollment, and invitation details when a team member is invited.

Business information. Business name, logo, location and time zone, and team membership.

Customer and lead information entered or received by a business. Names, phone numbers, email addresses, the vehicle a customer is looking for, budget, trade-in and financing details, the source of the lead, deals and their stages, notes, follow-ups, appointments and test drives, call logs, and sale records (such as price, vehicle details and salesperson; gross profit and commission are visible only to authorized roles).

WhatsApp Business information and messages. When a business connects its WhatsApp Business number through Meta’s WhatsApp Business Platform, we receive and store: the WhatsApp Business Account and phone number identifiers, the display number and verified business name, connection status, and an access token issued by Meta for that number (stored encrypted on our servers and never shown in the browser). We process the messages the business sends and receives through that number (text and message metadata such as sender and recipient numbers, timestamps, delivery and read status), including, where the business uses the WhatsApp Business app at the same time, messages it sends from that app. Message content is used only to display the conversation to the business and link it to the right customer and deal.

Leads from connected lead sources. When a business connects a Facebook Page to receive leads from Facebook and Instagram lead ads (Meta Lead Ads), we receive and store the Page identifier and name and an access token issued by Meta for that Page (stored encrypted on our servers and never shown in the browser). For each lead submitted through that Page’s lead forms we retrieve the answers the person gave (such as name, phone, email and form questions) and the ad information Meta provides (campaign, ad set, ad and form identifiers and names, platform and submission time). When a business sends leads to Urbay Connect from another system it chooses (a website form or another service, including the Auto-lead Data Format), we receive the lead details that system sends. Lead information is used only to create or update the customer and deal for that business, assign follow-up and show where the lead came from.

SMS information. If a business uses SMS through Urbay Connect, we process message content and metadata in the same way through our SMS provider.

Google Calendar authorization (optional). If a user connects Google Calendar, we receive the Google account email and OAuth tokens with permission to create and update calendar events. Tokens are encrypted. Urbay Connect only sends appointments the user chooses to add to Google Calendar; it does not read the user’s other calendar events.

Google user data (Limited Use). Urbay Connect’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to keep the user’s own Urbay Connect appointments in their Google Calendar. We do not sell it, use it for advertising or to train AI models, or let people read it, except with the user’s consent, for security or to comply with the law.

Technical and security information. Server and application logs (such as request times, error codes and IP addresses processed by our hosting provider), sign-in events, and bot-protection checks on the sign-in page.

Urbay Connect includes an assistant, Urbay IA, that can summarize a customer’s history, draft messages, suggest next steps and propose changes. To do this, relevant information from the business’s workspace (for example names, notes, deal details and follow-ups) is sent to our AI provider, Anthropic, for processing. We limit what is sent: full phone numbers and email addresses are not included (at most the last digits of a phone number, to tell two people apart).

Urbay IA never sends messages to customers and never changes data on its own: every proposed change must be reviewed and confirmed by the user, and the change is recorded in the history. AI output can be inaccurate and should be reviewed before it is used. We do not use your data to train AI models, and our AI provider’s commercial terms restrict it from training on data sent through its API.

We use only what is needed to run the service. We do not use advertising or third-party analytics cookies.

• Authentication cookies that keep you signed in securely.
• A cookie that remembers which business workspace you selected.
• Short-lived security cookies during the Google Calendar connection.
• Browser session storage for temporary items, such as an invitation link while you sign in or your last search.
• Meta’s JavaScript SDK, loaded only on the Connections settings page when a business connects WhatsApp or a Facebook Page for lead ads, which may set its own cookies under Meta’s policies.
• Cloudflare Turnstile on the sign-in page to protect against automated abuse.

• To provide and operate Urbay Connect: customer management, deals, pipeline, follow-ups, calendar, sales, analytics and conversations.
• To authenticate users, enforce roles and permissions, and keep each business’s data separate from every other business.
• To send and receive WhatsApp and SMS messages on behalf of the business that connected the number.
• To receive leads from the lead sources a business connects (such as Facebook and Instagram lead ads) and add them to that business’s customers and deals.
• To provide AI-assisted features that users request.
• To send service-related notices to users.
• To monitor, debug and improve reliability and security, and to prevent fraud, spam and abuse.
• To comply with legal obligations and enforce our Terms of Service.

We use the following providers to run Urbay Connect. They process information on our behalf or as needed to provide their services:

• Meta Platforms (WhatsApp Business Platform and Lead Ads): sending and receiving WhatsApp messages for businesses that connect their number, and delivering leads from the Facebook Pages businesses connect.
• Supabase: database, authentication and file storage (for example business logos).
• Vercel: application hosting and logs.
• Anthropic: processing for Urbay IA features.
• Google: Google Calendar, only for users who connect it.
• Cloudflare: Turnstile bot protection on the sign-in page.
• Telnyx: SMS delivery, only for businesses that use SMS.

Meta, Google and other platforms you choose to connect also process information under their own terms and privacy policies. WhatsApp messages travel through Meta’s infrastructure.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We share information only:

• with the service providers listed above, to operate the service;
• within a business’s workspace, according to the roles the business assigns to its team members;
• with the platforms a business chooses to connect (such as Meta/WhatsApp or Google);
• when required by law, or to protect the rights, safety and security of users, customers or Urbay Connect;
• as part of a merger, acquisition or sale of assets, subject to this policy.

We keep a business’s information for as long as its account is active and as needed to provide the service. Customer history in Urbay Connect is an audit trail and is kept for the life of the account. Raw webhook events received from messaging providers are deleted automatically after 30 days. When a team member is deactivated, they lose access immediately; the business’s records they worked on remain with the business.

When a business asks us to close its account, we delete or anonymize its data within a reasonable period, except where we must keep it to comply with legal obligations, resolve disputes or enforce agreements. Backups are retained for a limited period by our database provider before they expire.

We protect information with measures that include encryption in transit, database row-level security that isolates each business’s data, role-based permissions, two-step verification required for owners and administrators, encryption of third-party access tokens (such as WhatsApp and Google tokens) on our servers, signature verification of incoming webhooks, and an append-only change history. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

• Users can view and update their name in Settings, and businesses can edit or remove customer records they manage.
• A business can disconnect WhatsApp, a Facebook Page used for lead ads or Google Calendar at any time in Settings; we then delete the stored access token for that connection.
• You can request access to, correction of or deletion of your personal information, or ask questions about this policy, by writing to ray@urbayconnect.com. Depending on where you live, you may have additional rights under applicable law, and we will respond as required by that law.
• Customers of a business may also contact that business directly; we will assist the business with such requests.

To delete a user account, a business account or the information associated with it — including data received through WhatsApp — email ray@urbayconnect.com from the email address associated with the account, with the subject “Data deletion request”. We will confirm the request, verify that it comes from an authorized person, and complete the deletion as described in “Data retention”. Business owners and administrators can also deactivate team members from the Team page at any time. Step-by-step instructions, including how to disconnect WhatsApp and Google Calendar, are on our Data Deletion page.

Urbay Connect is operated from the United States, and information is processed and stored in the United States by us and our service providers. If you use Urbay Connect from another country, your information will be transferred to and processed in the United States.

Urbay Connect is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version on this page with a new effective date and, for material changes, notify account owners in the app or by email.

Urbay Connect — ray@urbayconnect.com — app.urbayconnect.com