Skip to content

Privacy Policy

How Urdi collects, uses, and protects information.

This Privacy Policy describes how Urdi, Inc. (“Urdi,” “we,” “us”) handles personal data in connection with the urdi.ai website, the Urdi platform, and the Urdi mobile applications (together, the “Services”). The Services are operated from the United States and are not directed to or offered to persons located in the European Economic Area, the United Kingdom, or Switzerland.

Our two roles: controller and processor

Urdi processes personal data in two distinct capacities:

  • Urdi as controller. We are the controller of your personal data when you visit our websites, request early access, create an account, pay for the Services, contact support, receive communications from us, provide Customer Identity Materials, or are identified or depicted in materials that we use to describe or promote Urdi, the Services, or Customer Applications. This policy governs that processing.
  • Urdi as processor. Our customers connect data sources and use the Services to process information: email, calendars, contacts, files, chat messages, CRM records, meeting notes and transcripts, source code, credentials, and records created in Urdi apps (together, “Customer Content”). For that processing we act as a processor, or service provider, on behalf of the customer, who is the controller of that data. It is governed by our Data Processing Addendum and the customer’s instructions, not by this policy. If your personal data is held in a customer’s Urdi workspace and you wish to access, correct, or delete it, direct your request to that customer. We support our customers in responding to such requests as their processor.

Information we collect as controller

  • Account and contact data: name, work email, company name, role, password credentials (stored only in hashed form), and profile settings.
  • Waitlist submissions: the company name and work email submitted when requesting early access.
  • Billing data: plan, transaction history, and payment details (handled by our payment processor; we do not store full card numbers).
  • Usage and device data: log data, IP address, device and browser type, app version, feature usage, crash and diagnostic data, and security logs.
  • Communications: support requests and other correspondence with us.
  • Customer identity and marketing materials: company and trade names, logos, trademarks, brand assets, business and biographical information, testimonials and quotes, names, titles, photographs, recordings, voices, and likenesses of customer personnel, information about a customer’s relationship with Urdi, and screenshots, listings, and other materials that identify or depict them (together, “Customer Identity Materials”).

Information we process as processor

Customer Content that customers direct us to process may include: the content of email messages and attachments; calendar events; contact lists; files and documents; chat messages; CRM records (including personal data of the customer’s own customers and prospects); meeting notes and transcripts; source code and development artifacts; credentials and secrets the customer elects to store (encrypted); and logs of agent and automation activity. We process this data only to provide the Services to the customer, under the DPA.

How we use personal data

As controller, we use personal data to: provide, operate, secure, analyze, and improve the Services; develop, train, evaluate, and improve our models, features, and machine-learning systems; manage early access and accounts; process payments; provide support; send service and administrative messages; send product communications, which you may opt out of; identify customers, users, developers, publishers, and partners; advertise, market, publicize, demonstrate, and promote Urdi, the Services, and Customer Applications using Customer Identity Materials as permitted by our Terms of Service; monitor for fraud, abuse, and security incidents; comply with law; and enforce our Terms of Service.

We may use Customer Content, and data derived from it, and may share, disclose, or license it, to provide, secure, analyze, and improve the Services, to develop, train, evaluate, and improve our models and features, and for other lawful business purposes. Two exceptions: information received from Google APIs, which remains subject to the Limited Use commitment described below, and any case where applicable law provides otherwise. We may also create and use aggregated and de-identified data for any lawful purpose. That is data which no longer identifies any individual and which we will not attempt to re-associate with one.

Except for Customer Application Materials (as defined in our Terms of Service) and Customer Identity Materials that we may use, disclose, distribute, and license as permitted by those Terms, authorized Urdi personnel may access Customer Content only as needed to operate, secure, support, and improve the Services and to investigate abuse or comply with law, and are bound by confidentiality obligations.

To the extent a law such as the GDPR applies to any of our processing notwithstanding the territorial scope stated above, we rely on the following legal bases: performance of a contract; our legitimate interests in operating, securing, improving, and marketing the Services; consent, where required, which may be withdrawn at any time; and compliance with legal obligations.

Google user data

Urdi’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In accordance with those requirements, information received from Google APIs is not used for advertising, is not sold, and is not used to train generalized AI or machine-learning models.

AI features and automated processing

The Services use large language models and other AI systems. To provide these features, relevant Customer Content and account data may be transmitted to third-party AI model providers. These providers process the data under their own terms and do not use it to train their foundation models, but they may retain it for a limited period and review content that their systems flag to detect and prevent misuse, security threats, and policy violations (see Subprocessors). AI agents in the Services can take automated actions, such as sending an email or updating a record; these operate under permissions, scopes, and approval controls configured by the customer, and their activity is logged. AI features do not make legal or similarly significant decisions about individuals without human involvement; customers are responsible for their use of AI-generated output as set out in the Terms of Service.

Third-party AI processing is part of the Services. Processing by third-party AI providers is an essential part of the Services; the Services cannot be used without it. It is disclosed to you, and you agree to it, when you accept our Terms of Service at sign-up or sign-in. To provide the AI features you use, the content sent can include your messages and prompts; attachments such as photos, camera captures, files, and audio; the content of apps you use; and data read from your connected accounts. Requests are routed through OpenRouter to AI model providers that currently include OpenAI, Microsoft Azure, Google (including Gemini and Veo models), CoreWeave and DeepInfra (which host DeepSeek models), Z.ai, Together, Baseten, DigitalOcean, Cerebras, and Groq. We update this list when those providers change. To stop this processing, stop using the Services and delete your account.

How we share personal data

We may share personal data with:

  • Subprocessors and service providers that support the operation of the Services. The current categories, with locations and purposes, are listed at /subprocessors. Each provider is bound by agreements limiting its use of the data.
  • Connected Services at your direction: when you or your organization connect a third-party service or instruct an agent to interact with one, data flows to that service under its own terms and privacy policy.
  • Legal and safety recipients: where required by law or legal process, or where reasonably necessary to protect the rights, safety, or property of Urdi, our customers, or others. We review requests and narrow them where legally possible.
  • Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy’s commitments.
  • Application distribution and marketing recipients: marketplace and catalog users, customers, partners, distributors, repositories, social networks, advertising channels, media recipients, and members of the public when we host, run, modify, publish, distribute, sublicense, demonstrate, market, or otherwise use Customer Application Materials or Customer Identity Materials as permitted by our Terms of Service.
  • Other business purposes: we may otherwise share, disclose, or license personal data, and data derived from it, to third parties for our own lawful business purposes, subject to applicable law and to the Limited Use commitment for information received from Google APIs.

Where data is processed

Personal data is processed in the United States. During early access, portions of the platform are hosted in Germany pending migration to United States infrastructure, and content is delivered through a global content delivery network. To the extent applicable law requires a specific mechanism for cross-border transfers of personal data, we rely on recognized transfer mechanisms, including standard contractual clauses where appropriate, as set out in the DPA.

Retention

We retain account and other controller data for as long as your account or access request is active, and for a limited period afterwards as needed for legal, security, and accounting purposes, after which it is deleted or anonymized. Personal data contained in Customer Content (“Customer Personal Data”) is retained according to the customer’s instructions and the DPA, and is deleted or returned when the associated workspace or account is deleted, subject to a limited backup-cycle carve-out. We may retain Customer Application Materials and Customer Identity Materials for the periods permitted by our Terms of Service, including after termination, but personal data within those materials remains subject to applicable law and the DPA where it applies. We may also retain data where necessary to comply with law, to exercise or defend legal claims, or to respond to legal process such as a litigation hold, in which case it remains protected under this policy until it can be deleted. Deletion may be requested at any time as described below.

Security

We maintain technical and organizational measures designed to protect personal data, including industry-standard encryption in transit and at rest, additional envelope encryption for stored credentials and secrets, one-way salted password hashing, role- and workspace-scoped access controls, audit logging of agent and system activity, and encrypted backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach, we will notify affected customers and, where required, authorities and individuals in accordance with applicable law.

Your rights and choices

Depending on your jurisdiction, you may have rights to access, correct, export, delete, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, email privacy@urdi.ai; we may need to verify your identity and will respond within the time required by applicable law. You can also delete your account yourself, or request deletion without the app, as described at urdi.ai/support. If we act as processor for the data in question, we will refer your request to the responsible customer and support their response. Where applicable law provides for it, you may also lodge a complaint with your local data protection authority.

US state privacy laws

US state privacy laws (such as those in California, Texas, and other states) grant residents certain rights and may treat some of our data practices, including sharing personal information with third parties or using it for targeted advertising, as a “sale” or “sharing” of personal information. Where required by applicable law, we provide the choices described in “Your rights and choices” above, including the ability to opt out of the sale or sharing of personal information and of cross-context behavioral (targeted) advertising, and we honor verified requests. We honor access, correction, and deletion requests from US residents as described above, and we do not discriminate against anyone for exercising privacy rights.

Children

The Services are not directed at children and may not be used by anyone under 16. We do not knowingly collect personal data from children as a controller; if you believe a child has provided us personal data, contact privacy@urdi.ai and we will delete it. Customers who upload personal data relating to minors (for example, schools or teachers) are the controllers of that data and are responsible under our Terms of Service for having the required legal basis, notices, and parental or institutional consents.

Mobile apps

Our mobile apps may request device permissions (such as notifications) that you can manage in your device settings, and use a third-party push notification service to deliver notifications. You can delete your account in the app from Settings > Delete account, or, without the app, by emailing privacy@urdi.ai from your account’s email address as described at urdi.ai/support. Deleting your account immediately and permanently ends your access: you can no longer sign in, and your sign-in methods, your API tokens, and the access of apps you connected to your account stop working. Your user account is part of a customer’s account, which that customer administers. Your profile and the content you created remain in that customer’s account under its control, and we continue to process them on the customer’s behalf. Deleting your account does not automatically erase that remaining personal data; to have it erased, contact the customer or email privacy@urdi.ai, and we will handle your request as described in “Your rights and choices” above. If you are the last owner of a customer account or the only owner of a team workspace, you must transfer ownership before your account can be deleted. Data we retain after deletion is described under “Retention” above. Our App Store privacy labels and Google Play Data safety disclosures reflect this policy.

Cookies

The urdi.ai website uses only strictly necessary cookies, such as session and security cookies. We do not use advertising cookies or third-party analytics cookies on the marketing site. If this changes, we will update this policy and request consent where required.

Changes to this policy

We may update this policy from time to time. We will post the updated version here; if a change is material, we will notify account holders by email or in-product before it takes effect.

Contact

Urdi, Inc.