Privacy notice

1. Who is responsible for your data

Heirstone Consulting provides URBN Strategy and is the data controller for the website, for enquiries you send us and for the accounts we hold.

For the project content inside a workspace — sites, scenarios, assumptions, evidence and any personal data your team chooses to put into them — your organisation is the controller and we act as a processor on your instructions. Those instructions are set out in our terms of service.

Send privacy questions and rights requests to clientservices@urbnstrategy.com. You do not need to use a particular form of words.

2. The data we hold

Account data

Your name, email address, a hashed password (we never store the password itself), the organisations you belong to and your role in each, the time you accepted our terms and the version you accepted, and sign-in timestamps.

Workspace content

Projects, sites, boundaries, scenarios, assumptions, sources, calculations, decisions, exports and office plans, together with a record of who changed what, when and why. This content is created by your team; we do not add to it.

Enquiries

If you send the contact form, we keep your name, email address, company if given, the subject you chose, your message and the time it was sent, so we can reply and keep a record of the conversation.

Technical data

Our servers keep short-lived operational logs containing the request path, status, timing and a request identifier, and may record the IP address for security purposes such as rate limiting and abuse prevention. We do not build advertising profiles.

When you visit the website, a small script from Cloudflare Web Analytics also reports, as aggregate counts, the page viewed, the site you came from, your country, your browser, operating system and device type, and page-speed measurements. It sets no cookies and uses no browser storage.

Cookies and local storage

One strictly necessary cookie keeps you signed in. A note that you have seen the cookie notice, and which workspace setup windows you have seen, are stored in your browser, not on our servers. The full list is in the cookie notice.

3. Why we use it, and our legal basis

We do not sell personal data, we do not share it with advertising networks, and we do not use your workspace content to train artificial intelligence models. The platform’s Advisor answers from your own saved calculations; the Advisor does not call an AI provider. Reading documents with Claude is described in Document reading with Claude.

4. Who we share it with

We share personal data only with suppliers who help us run the service, under contracts that require them to protect it and use it only on our instructions:

• Hosting and database — our application, database and backups run on managed cloud infrastructure.
• Domain and email — for the website address and for correspondence with you.
• Visit statistics — Cloudflare Web Analytics counts visits to the website (pages viewed, referring site, country, browser and device type, page speed) without cookies. See the cookie notice.
• Payments — when you pay for a plan by card, Stripe processes the payment and the invoice. We never see or store your full card number.
• Document reading (Anthropic) — when you ask Claude to read a client document, Anthropic processes the text we send, as our sub-processor. See Document reading with Claude.
• Renders (Higgsfield) — when you ask for a render of a 3D view, Higgsfield processes the picture of the view and the description we send, as our sub-processor. See Renders with Higgsfield.
• Professional advisers — accountants and lawyers, where necessary and confidential.

Document reading with Claude

On fit-out projects, Claude, an AI model made by Anthropic, can read the client's documents and suggest the requirements they state. Anthropic acts as our sub-processor for this. Nothing is sent to Anthropic unless all of these hold:

• an owner of your organisation has switched document reading on, after reading what is sent;
• the client's consent is recorded on the project;
• an editor presses Read with Claude, sees our estimate of what will be sent and its cost (worked out without sending anything), and presses Read;
• the document is not marked as not to be sent to AI, and it is not private. Pictures and photographs are private unless you change them. Bills of quantities and commercial documents are read by our own parsers and are sent only when an editor allows them.

What is sent. The text of the documents you choose to read, as it is (paragraphs, table rows and spreadsheet rows, each with its place in the file), including any names, addresses and terms it contains. A page without a text layer is sent as an image of the page when it holds no picture, such as a drawing; a page that holds a picture or photograph, such as a scan, only when an editor allows that document's picture pages. It is sent inside each request; no file is stored with Anthropic. File names, your account, the client name and details you enter on the project, other projects and anything you type in the brief are not sent.

What Anthropic does with it. Anthropic uses it only to return the reading. It does not use data sent through its API to train its models, and it keeps what it receives only for the period set by its commercial terms.

What we keep. The facts Claude suggests, each with the quote it was read from, encrypted under the project's and the document's own keys. Each fact stays a candidate until someone in your team confirms it. When a project is deleted, the facts are erased with it, as described in How long we keep it. We also keep a record of each request (when, which model, the documents' internal ids, who asked, the number of tokens, the estimated cost and the outcome), with no document text in it, as our billing and audit record; it stays after the project is erased.

How to switch it off. An owner can switch document reading off for the whole organisation at any time (Account and organisation). On a project, record that the client withdrew their consent (project menu, Client consent): nothing more from that project is sent, and its documents are marked as not to be sent to AI. A single document can be marked as not to be sent to AI on its card.

Renders with Higgsfield

Higgsfield, an image generation service, can turn a picture of one of your 3D views (the massing model, the fit-out's 3D view or the stacked floors) into a photoreal image. Higgsfield acts as our sub-processor for this. Nothing is sent to Higgsfield unless an owner of your organisation has switched renders on after reading what they send, the client's consent to renders is recorded on a fit-out project (project menu, Client consent, where renders are a separate tick beside reading with Claude), and an editor presses Render, sees the picture, the description and the credits it will use, and presses Render.

What is sent. That picture of the view, which on a client's project is drawn from the client's plans, and the description shown, which you can edit. No document, file name, project name, client name or account detail is sent.

What Higgsfield does with it. Higgsfield uses it to make the image. The picture is uploaded to Higgsfield's storage at an unlisted address, marked temporary, and Higgsfield deletes it within seven days; no request can delete it sooner. We delete the request itself, with its description and the image made, as soon as the image is back, and in any case Higgsfield removes it an hour after it ends. Our Higgsfield account is set so that what it makes for us is not used to train Higgsfield's models.

What we keep. The picture, the description and the render, with the project: encrypted under the project's key on a fit-out project, and erased with it. A record of each render (when, which model, its cost and outcome), with no picture or description in it, stays as our billing and audit record. An owner can switch renders off at any time (Account and organisation).

We will also disclose data where the law requires it, or to establish or defend legal claims. If the business is ever sold or reorganised, data may transfer with it, and we will tell you before that happens.

The map background is served by a third-party tile provider. Loading a map discloses your IP address and the map area to that provider; no account or project data is sent.

5. Where it is stored

Our application and database are hosted on managed cloud infrastructure in Singapore. Where a supplier processes data outside your country, we rely on an adequacy decision or on standard contractual clauses with appropriate safeguards. Ask us and we will tell you exactly which suppliers and regions apply to your account.

6. How long we keep it

• Workspace content — for as long as your organisation keeps its account, and then for up to 30 days in backups before deletion.
• Account records — for as long as the account exists, plus the period needed to resolve disputes and meet accounting rules.
• Enquiries — up to 24 months after our last exchange.
• Operational logs — a short rolling window, typically 30 days.

Approved decisions, their evidence and the change history are deliberately immutable inside a live workspace: that is what makes them trustworthy. If you need something removed, tell us and we will handle it at the account level.

When you delete a project, nobody can open it any more, and its administrator can restore it for 7 days. After that, the project is erased from our live database. A feasibility project's records and files are deleted. A fit-out project's documents and figures are encrypted under the project's own key, and we destroy that key.

Copies can remain in database backups and logs until they expire: the hosting provider's backup retention period, plus 30 days for the copies we take before updates. Feasibility data in those copies is protected by the hosting provider's disk encryption; fit-out data in them stays encrypted by us, but could be read from a backup until it expires.

7. How we protect it

• Traffic is encrypted in transit with TLS.
• Passwords are stored only as salted hashes, and sessions use a host-only cookie that is not readable by scripts.
• Every request checks that you belong to the organisation whose data you are asking for, and viewers cannot change anything.
• Repeated failed sign-ins are rate limited, and sessions expire after eight hours.
• Backups are taken regularly and kept securely.

No service can promise perfect security. If a breach affects your personal data and is likely to present a risk, we will tell you and the relevant supervisory authority without undue delay.

8. Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete data where we no longer need it;
• restrict or object to a particular use;
• provide your data in a portable format, or send it to another provider;
• withdraw consent, where we relied on it, at any time.

Contact us at clientservices@urbnstrategy.com. We reply within one month and will not charge you. If your data sits inside an organisation’s workspace, we will usually pass the request to that organisation, since they decide what is held there.

If you are unhappy with our answer you can complain to your local data protection authority. In the UK that is the Information Commissioner’s Office; in the EU it is the authority for your country of residence.

9. Children, automated decisions and changes

The service is for professional use and is not directed at children. We do not knowingly collect data from anyone under 16.

We do not make decisions about you by automated means that produce legal or similarly significant effects. Calculations in the platform act on project data, not on people.

If this notice changes materially we will post the new version here with a new date and, for significant changes, tell account holders by email.