Privacy Policy

Last updated: July 28, 2026

Effective date: July 28, 2026

1. Who We Are

UrbanFlow Work ("UrbanFlow," "we," "us," or "our") is a digital services company that builds custom websites, web applications, and mobile applications for businesses. We operate the website urbanflow.work(the "Site") and any related digital products, tools, and services (collectively, the "Services").

For the purposes of data protection laws, including the EU General Data Protection Regulation ("GDPR") and the UK GDPR, UrbanFlow Work is the data controller responsible for your personal data.

Contact for privacy inquiries:
Contact: Submit via Legal Form

2. Information We Collect

2.1 Information You Provide Directly

When you interact with our Services, you may voluntarily provide us with:

• Contact information: name, email address, phone number
• Business information: company name, website URL, project type, budget range
• Communication content: messages sent through our contact forms, discovery forms, chat widget, or email
• Course enrollment data: name, email address, and payment details when enrolling in our AI Masterclass or other educational products
• Account data: if you create an account for any of our products (e.g., Niyaz Mocks, RankTracker), we collect the information needed to create and maintain your account

2.2 Information Collected Automatically

When you visit our Site, we may automatically collect:

• Device information: browser type, operating system, device type, screen resolution
• Usage data: pages visited, time spent on pages, referring URL, click behavior
• Network information: IP address, approximate geographic location (country/region level)
• Cookies and similar technologies: see Section 7 below for details

2.3 Information From Third Parties

We may receive limited information from third-party services we use, such as analytics providers and payment processors. We do not purchase or otherwise acquire personal data from data brokers.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To deliver our Services: building and delivering websites, apps, and digital products you commission
• To communicate with you: responding to inquiries, scheduling calls, sending project updates, and providing customer support
• To process payments: handling one-time project payments and course enrollment fees
• To improve our Services: analyzing usage patterns to enhance user experience, fix bugs, and optimize performance
• To send marketing communications: with your consent, we may send emails about new services, features, or promotions. You can opt out at any time
• To comply with legal obligations: fulfilling tax, accounting, and regulatory requirements
• To protect our rights: detecting and preventing fraud, abuse, or security incidents

Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

• Consent: where you have given explicit consent (e.g., subscribing to marketing emails)
• Contractual necessity: where processing is necessary to perform a contract with you (e.g., building your commissioned project)
• Legitimate interests: where processing is necessary for our legitimate business interests (e.g., improving our Services, fraud prevention), provided those interests are not overridden by your rights
• Legal obligation: where processing is necessary to comply with applicable law

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

• Service providers: we use trusted third-party services to help operate our business, including cloud hosting (Google Cloud, Firebase, Cloudflare), payment processing, analytics, and email delivery. These providers are contractually obligated to protect your data and only use it for the purposes we specify
• Legal requirements: we may disclose your information if required to do so by law, regulation, legal process, or governmental request
• Business transfers: in connection with any merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change
• With your consent: we may share information when you give us explicit permission to do so

5. International Data Transfers

UrbanFlow Work operates globally and may transfer your personal data to countries outside your country of residence, including the United States and other countries where our service providers operate.

When we transfer personal data from the EEA, UK, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with our service providers that include appropriate security measures
• Other legally recognized transfer mechanisms

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Project data: retained for the duration of the project plus 3 years for warranty, support, and legal purposes
• Account data: retained while your account is active and for 30 days after deletion request
• Marketing data: retained until you unsubscribe or request deletion
• Analytics data: aggregated and anonymized data may be retained indefinitely for statistical purposes
• Financial records: retained for 7 years as required by applicable tax and accounting laws

7. Cookies & Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: required for our Site to function (e.g., session management). These cannot be disabled
• Analytics cookies: help us understand how visitors interact with our Site (e.g., Google Analytics). These are used only with your consent where required by law
• Functional cookies: remember your preferences (e.g., currency selection on the pricing page)

We do not use advertising or behavioral tracking cookies. You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Site.

8. Your Rights

8.1 Rights Under GDPR (EEA, UK, Switzerland Residents)

If you are located in the EEA, UK, or Switzerland, you have the following rights:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: request that we limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time

You also have the right to lodge a complaint with your local data protection authority.

8.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: request information about the categories and specific pieces of personal information we have collected about you
• Right to delete: request deletion of your personal information
• Right to correct: request correction of inaccurate personal information
• Right to opt out of sale/sharing: we do not sell or share your personal information for cross-context behavioral advertising
• Right to non-discrimination: we will not discriminate against you for exercising any of your privacy rights

In the preceding 12 months, we have collected the following categories of personal information: identifiers (name, email), internet activity information (browsing data), and commercial information (project details). We have not sold any personal information.

8.3 Rights Under Other U.S. State Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with comprehensive privacy laws may have similar rights to access, delete, correct, and opt out of certain processing activities. Please contact us via our Legal Inquiry Form to exercise your rights under any applicable state privacy law.

8.4 Rights Under Other International Laws

If you are located in Canada (PIPEDA), Australia (Privacy Act 1988), Brazil (LGPD), India (DPDP Act), or any other jurisdiction with applicable data protection laws, you may have rights to access, correct, or delete your personal information. We are committed to honoring your rights under your local laws.

8.5 How to Exercise Your Rights

To exercise any of the rights described above, please submit a request via our Legal Inquiry Form. We will respond to your request within 30 days (or sooner if required by applicable law). We may need to verify your identity before processing your request.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls limiting who within our organization can access personal data
• Regular security assessments of our infrastructure and service providers
• Use of enterprise-grade cloud platforms (Google Cloud, Firebase, Cloudflare) with built-in security features

While we strive to protect your information, no method of transmission or storage is 100% secure. If you become aware of any security breach, please notify us immediately via our Legal Inquiry Form.

10. Children's Privacy

Our Services are not directed to children under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us via our Legal Inquiry Form and we will promptly delete the data.

11. Third-Party Links

Our Site may contain links to third-party websites, services, or applications that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our Site.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, notify you via email or a prominent notice on our Site.

We encourage you to review this page periodically. Your continued use of our Services after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Legal Inquiries: Submit via Contact Form
• Website: urbanflow.work
• Contact page: urbanflow.work/contact