Privacy policy

For the website and for your account, the controller is Aditya Ranjan, trading as Urbane Labs, India (details in the legal notice). You can reach us about privacy at adityaranjan@urbanelabs.co.

For the documents a customer uploads and the data Zero reads from them, the customer is the controller (or acts for its own client), and we process that data only on the customer's instructions, under a data processing agreement (Article 28 GDPR). If you are named in such a document — for example as the contact person in a safety data sheet or the signatory of a supplier declaration — please contact the business that uploaded it; we will help it answer your request.

• Account data — your name, e-mail address and sign-in data, and the business you work for. To give you access to Zero and to provide it (Article 6(1)(b) GDPR).
• Uploaded documents and what Zero reads from them — on the customer's behalf, to provide the service the customer has agreed (Article 28 GDPR; for the customer, usually Article 6(1)(b), (c) or (f)).
• Records of what you do in Zero — which documents you approved, edited or rejected, and when. To keep the audit trail the service depends on (Article 6(1)(b) and (f)).
• Technical data — IP address, browser and request data in our hosting providers' server logs. To run the service securely and to find faults (Article 6(1)(f)). Our logs record identifiers, counts and error codes; they are designed not to contain document content.
• E-mail with us — what you write and your contact details. To answer you and, for prospective customers, to discuss working together (Article 6(1)(b) and (f)).

We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models.

Zero uses a language model (Google's Gemini API) to read uploaded documents. The model finds values and the page and words they stand on; a person then reviews every value before it is used. Zero makes no decision with legal or similarly significant effect about any person (Article 22 GDPR).

These providers process data for us, under data processing agreements:

• Supabase — Database, sign-in and file storage, including the documents you upload and what Zero reads from them. Frankfurt, Germany (EU).
• Vercel — Hosting of the website and the application; the application’s server functions. Server functions in Frankfurt, Germany (EU); content delivery network worldwide; company in the United States.
• Trigger.dev — Background processing of uploaded documents. Processing in the EU (Frankfurt); run records and logs, which carry identifiers but no document content, in the United States.
• Google (Gemini API) — Reading uploaded documents with a language model. Google may keep the requests and responses for up to 55 days to detect abuse and does not use them to train its models. Google’s data centres, which may be outside the EU; company in the United States.
• Google Workspace — E-mail with customers and prospective customers. Google’s data centres, which may be outside the EU; company in the United States.

We, the operator, work from India and access the data there to run and support the service. Transfers outside the EU and the EEA rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, where the recipient is certified) or on the Commission's standard contractual clauses. You can ask us for a copy of the safeguards at adityaranjan@urbanelabs.co.

We disclose data to authorities only where the law requires it.

• Account data: while the account exists; deleted when the account is closed, unless the law requires us to keep it longer.
• Uploaded documents and what Zero read from them: until the customer deletes them or the agreement ends, then deleted or returned as the data processing agreement sets out.
• Requests and responses at Google's Gemini API: up to 55 days, for abuse monitoring.
• Server logs: for the short period our hosting providers keep them.
• E-mail: as long as needed for the conversation, and as tax and commercial law require for business correspondence.

Zero uses only the cookies needed to keep you signed in. It sets no analytics, advertising or tracking cookies. Your browser also remembers that you have seen the cookie notice, so it is not shown again.

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format (Articles 15 to 21 GDPR). Where we rely on your consent, you may withdraw it at any time. Write to adityaranjan@urbanelabs.co.

You also have the right to complain to a data protection supervisory authority, in particular in the EU member state where you live or work (Article 77 GDPR).

Under India's Digital Personal Data Protection Act 2023, questions and grievances about your personal data go to Aditya Ranjan at adityaranjan@urbanelabs.co.

When this policy changes, the date at the top changes, and signed-in users are asked to read it again.