Your privacy, protected.

1. Scope

This policy applies to information we collect through our website, marketing activities, and when you engage with Ursara as a customer, prospect, or visitor. If you are an end user of a customer (for example, a borrower or investor using a customer-managed portal), the customer controls your data and their privacy policy applies.

2. Information We Collect

• Contact information such as name, email address, phone number, title, and company.
• Account and customer data provided by customers to operate the Ursara platform.
• Payment and billing details for subscriptions and services.
• Usage and device data such as IP address, browser type, pages viewed, and timestamps.
• Support communications including emails, chat messages, or call recordings where permitted by law.

3. Sources of Information

• Directly from you or your organization.
• From our customers when they use the platform.
• From service providers that help us operate and secure our services (for example, analytics and payment processors).
• From public or professional sources such as company websites or business networks.

4. How We Use Information

• Provide, maintain, and improve our services.
• Authenticate users and secure our platform.
• Process payments, invoices, and subscriptions.
• Respond to inquiries and provide support.
• Send service updates, security alerts, and marketing communications (you can opt out of marketing at any time).
• Comply with legal obligations and protect our rights.

5. Legal Bases for Processing (EEA/UK/Switzerland)

Where GDPR applies, we process personal information under these legal bases: (i) performance of a contract, (ii) legitimate interests (such as improving and securing our services), (iii) compliance with legal obligations, and (iv) consent where required.

6. How We Share Information

• Service providers who support hosting, analytics, customer support, and payment processing.
• Business transfers in connection with a merger, acquisition, or asset sale.
• Legal requirements when required by law or to protect rights, safety, and security.

We do not sell personal information.

7. Google API Services User Data

When a user chooses to connect a Google account, Ursara accesses only the Google data needed to provide the user-facing email and calendar features the user enables. This includes the connected account's email address, permission to send messages the user composes or explicitly triggers, and read-only calendar information used to list calendars and display upcoming meetings. Ursara does not use this connection to read Gmail message content or to create, modify, share, or delete Google Calendar events.

Ursara uses Nylas as a service provider to securely manage Google authorization credentials and execute the Google API requests required for these features. Google Workspace API user data is not transferred to third-party artificial intelligence or machine-learning services, and it is not used to develop, improve, or train generalized or personalized AI or machine-learning models.

Ursara's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Users may disconnect their Google account from Ursara at any time through the Email and Calendar Accounts settings. Users may also revoke Ursara's access through their Google Account permissions or contact us to request deletion of connected-account data.

8. Cookies and Analytics

We use cookies and similar technologies for site functionality, analytics, and to understand engagement. You can control cookies through your browser settings. Some features may not work without cookies.

9. Data Retention

We retain personal information for as long as necessary to provide services, fulfill legal obligations, resolve disputes, and enforce agreements. Retention periods may vary depending on the type of data and legal requirements.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure; however, we continuously improve our controls.

11. International Transfers

We may transfer personal information to countries other than where you live. Where required, we use approved transfer mechanisms such as Standard Contractual Clauses and other lawful bases.

12. Your Rights and Choices

• Access, correction, deletion and portability where applicable.
• Opt out of marketing by using unsubscribe links or contacting us.
• California residents may request information about our data practices and exercise rights under the CCPA/CPRA.
• European residents may object to or restrict processing and lodge a complaint with their data protection authority.

To exercise rights, contact us using the information below. We may need to verify your identity before responding.

13. Children's Privacy

Our services are not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will take appropriate action.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the effective date above. If changes are material, we will provide additional notice where required.