Privacy Policy

Version 1.2 (closed beta) · Effective date: 13 October 2026

Summary

• We use your data to run URA, and for nothing else. That means running page analyses, producing reports, keeping your account secure and supporting you. We do not sell your data, we do not "share" it for cross-context advertising, and we run no ad trackers.
• We do not use your content or reports to train AI models. We send your content to AI providers (Anthropic, Google, OpenAI) through their paid business APIs only to produce your results.
• Personas are fictional. The "synthetic audience" is generated by AI. Personas are not real people, and reports are simulations, not real customer data.
• You control what you capture. The Chrome extension captures only the tab you choose, when you choose. You are responsible for having the right to capture what that tab shows, including other people's personal data.
• AI assistants act only with your permission. If you connect URA to ChatGPT, Claude or another MCP client, you approve it on an OAuth consent screen. We receive only what the assistant sends to run the URA tool you asked for, not your chat history. Full details: section 10.
• You have rights. You can access, correct, delete or export your data, and you can complain to a regulator. Email support@uralabs.app. We reply within 30 days.

1. Who we are

The operator. URA is currently operated by Tomer Pascal, an individual resident in Israel ("URA", "we", "us"). No company has been incorporated yet. We intend to transfer the service to an Israeli company once it is incorporated. When that happens, that company will take over as operator, "URA", "we" and "us" will mean that company, and we will notify you at least 14 days in advance.

For personal data covered by this policy, URA is the controller (under the GDPR / UK GDPR) and the database controller under the Israeli Privacy Protection Law, 5741-1981. See section 4 for the one exception: content you capture or upload about other people.

Contact: support@uralabs.app

URA is a closed, invite-only beta for business users. This policy is published at app.uralabs.app/privacy, together with our Terms of Use at app.uralabs.app/terms.

2. Scope

This policy covers:

• our website (uralabs.app) and web app (app.uralabs.app), including the waitlist form and the in-app support chat;
• the URA Chrome extension;
• the URA public API and the URA MCP server (https://app.uralabs.app/api/mcp), including when you use URA through an AI assistant.

It does not cover third-party websites you ask us to analyse, or third-party services you connect to URA (such as an AI assistant). Their own privacy policies apply.

3. What data we collect

3.1 Data you give us

3.2 Data we generate for you

3.3 Data collected automatically

We use product-usage records only to understand how the service is used, fix problems and improve it. They are stored in our own database, linked to your account, and are not shared with any analytics or advertising company. We do not use third-party analytics tools.

We do not collect payment card data. Credits are free during the beta. If we add paid plans, we will use a payment processor and update this policy first.

3.4 Sharing a report

You can share a report as a link. You decide who can open it: people you invite by email, or (if you turn it on) anyone who has the link.

• People you invite get an email from us with the link. When they open it, we email them a 6-digit code to confirm their address. They don't need a URA account. We keep their email, a hash of the code (for 15 minutes of use) and a cookie on their browser that keeps them signed in to that one report for up to 30 days.
• Views. We record when a shared report is viewed (time, and for invited people their email; for open links a hashed browser fingerprint so refreshes are not counted twice). You can see the number of views and which invited people opened it.
• What viewers see. The report itself, read-only: scores, reasons, simulated quotes, recommendations and competitor comparisons. They do not see your account details, notes or labels, and they cannot use your credits.
• Turning it off. You can remove a person or turn sharing off at any time. The link then stops working.

If you invite someone, you are responsible for having a reason to share the report with them. Invited people can ask us to delete their email by writing to support@uralabs.app.

3.5 Do you have to give us this data?

There is no legal obligation for you to give us personal data. Giving it is voluntary. But we need your email and password to create your account, and the page URL or capture to run an analysis. Without them, we cannot provide the service. Optional fields can be left blank.

This policy is the notice we give you under section 11 of the Israeli Privacy Protection Law and Articles 13–14 of the GDPR. It tells you who we are (section 1), what we collect and whether you must provide it (sections 3 and 3.5), why we use it (section 7), who receives it (sections 11–12), how long we keep it (section 13), and your rights (section 15).

4. Data about other people

You may submit content that contains other people's personal data. For example, a page you capture may show a customer list, names, photos or emails.

• For that third-party data, we act on your behalf (as your processor / service provider). We use it only to produce your analysis.
• You are responsible for having a lawful basis and any notices or consents needed to capture and upload it.
• Please avoid capturing pages that show personal data you do not need analysed. Where you can, use test data or hide it before capturing.
• If you need a data processing agreement (DPA) for this, email support@uralabs.app and we will provide one.

5. The Chrome extension

The URA Chrome extension lets you analyse pages that our servers cannot reach, such as pages behind a login, staging sites, design prototypes or localhost.

What it captures. When you start a capture, the extension captures the browser tab you choose, including whatever is visible or loaded in it: a video recording of the tab, screenshots, page text, page structure (DOM) and links.

You are in control.

• The extension captures only when you start a capture, and only the tab you choose. Its script is present on pages you visit, but it does nothing until you start a capture.
• It does not monitor your browsing in the background and does not collect your browsing history.
• It sends captures to URA only to run the analysis you requested.

Third-party data in your tab. Everything visible in that tab may be captured, including other people's personal data (for example, customer names in a dashboard). You are responsible for having the right to capture and upload it. See section 4.

Chrome Web Store. If the extension is listed on the Chrome Web Store, our use of data received from it will comply with the Chrome Web Store User Data Policy, including its Limited Use requirements.

6. Cloud recordings of public pages

When you submit a public URL (yours or a competitor's), our servers open it in an automated browser and record it in desktop and/or mobile view.

• We record only the pages you ask us to.
• A public page may happen to contain personal data (for example, names in testimonials or team photos). We process this only as part of your analysis. We do not extract it, profile anyone, or use it for any other purpose.
• To judge how well-known a brand is, we may look up the brand name or domain in public sources (for example, Wikipedia and public website rankings). We send only the brand name or domain, never your account data.
• Recordings are stored with your report (see section 13).
• You must have a lawful right to submit the URL for analysis.

7. How we use your data and our legal bases

Under Israeli law, we use your data only for the purposes listed here. The table also shows the legal basis under the GDPR / UK GDPR.

Emails we send. We send account emails (invites, password resets, security and policy notices), which you cannot opt out of while you have an account. We send service emails about your own activity, such as when a report is ready or a run could not finish; these include a short summary of the report (for example the headline result, the main issue and one audience quote), and you can turn them off in Settings. We also send onboarding emails about using URA (for example, how to get your first report, tips, and new features) for a limited period after you join. Every onboarding email has an unsubscribe link, and you can also unsubscribe by writing to support@uralabs.app. We do not send third-party advertising, and we will not send other promotional emails without your consent where the law requires it.

Looking at your content. During the beta, the URA team (currently two people) may look at analyses and reports to give support you ask for, investigate errors, improve the quality of results, and keep the service secure. We treat what we see as confidential (see Terms, section 17).

What we do not do:

• We do not sell your personal data.
• We do not use your data for advertising or share it for cross-context behavioural advertising.
• We do not use your content or reports to train AI models.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The AI reports are about your web page, not about you.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can object (see section 15).

8. AI processing and AI providers

URA relies on third-party AI models to produce results.

• What we send: the content needed for the task, such as page recordings and screenshots, page text, your questionnaire answers, your questions, and earlier analysis results. We do not send your password or tokens.
• No training. We do not use your content or reports to train AI models. We use these providers through their paid commercial APIs. Under those API terms, the providers do not use API inputs or outputs to train their models by default. They may keep data for a limited time for abuse monitoring or legal reasons, under their own terms.
• Accuracy. AI output can be wrong. Reports are predictions and simulations, not facts or guaranteed outcomes.

9. Synthetic personas are fictional

The personas in your synthetic audience are created by AI. They are fictional characters that represent likely customer types.

• They are not real people, and they are not built from profiles of real, identifiable individuals.
• Simulated quotes are AI-generated text, not statements by real customers.
• Any resemblance to a real person is coincidental.

10. Using URA through AI assistants (ChatGPT, Claude and other MCP clients)

You can connect URA to an AI assistant that supports the Model Context Protocol (MCP), such as ChatGPT or Claude, through our MCP server at https://app.uralabs.app/api/mcp. The assistant can then use URA tools on your behalf.

How you connect. You add URA in the assistant, sign in to URA, and approve access on our consent screen. The assistant cannot use URA until you approve. Analyses the assistant starts use your account's credits, just as if you started them in the app.

What we receive. Only what is needed to run the tool: your request and its inputs (such as a page URL, competitor URLs, device type, brand or audience details, or a report ID), the access token that identifies your URA account, and standard technical data. We do not receive your chat history or other content from your assistant account, unless the assistant includes it in a tool request.

How we use it. Only to provide the service you requested. Analyses started through an assistant are processed exactly like analyses started in the app.

The assistant provider. Once we return results to the assistant, the provider (for example, OpenAI or Anthropic) handles them under its own terms and privacy policy. They may appear in your chat and be stored there. Revoking or deleting in URA does not remove results already shown in your chat; delete those in the assistant.

11. Who we share data with

We share personal data only with:

• Service providers that help us run URA (section 12). They may use the data only to provide services to us.
• AI assistants you connect, when you ask them to use URA (section 10).
• People you share a report with, when you share it (section 3.4).
• A successor, if the service is transferred to a company we incorporate (section 1), or as part of a merger, acquisition or asset sale. We will notify you at least 14 days before your data becomes subject to a different policy.
• Authorities or others where required by law or court order, or to protect rights, safety and security.
• Anyone else only with your instruction or consent.

12. Service providers (sub-processors)

GitHub hosts our source code. It does not receive customer data.

We will update this list before adding or replacing a provider that processes your personal data.

13. How long we keep data

When your account is closed. You have 30 days to ask for an export of your reports. We then delete your account data, content and reports, so that they are gone within 90 days of closure (plus up to 30 more days for backups to roll over). If you ask us to delete your data and do not need an export, we will delete it within 30 days of verifying your request.

We may keep data longer where the law requires it or to resolve a dispute. We may keep aggregated or de-identified data that no longer identifies you.

14. International transfers

URA is operated from Israel. Our database is hosted in Singapore, and most of our other providers are in the USA. Your data will be transferred to and stored in those and possibly other countries.

• From the EU/EEA, UK and Switzerland to Israel: the European Commission and the UK recognise Israel as providing an adequate level of protection.
• To the USA, Singapore and other countries: we rely on the EU-US Data Privacy Framework (and its UK Extension and Swiss framework) where the recipient is certified, or on the European Commission's Standard Contractual Clauses (and the UK Addendum) included in our providers' data processing terms.
• From Israel abroad: we transfer data in line with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, relying on our providers' data processing terms, under which they commit to protect the data and use it only to provide services to us.

You can ask for more information about these safeguards at support@uralabs.app.

15. Your rights

Depending on where you live, you have some or all of these rights:

• Access: get a copy of your personal data (including under section 13 of the Israeli Privacy Protection Law).
• Correction: fix inaccurate or incomplete data (including under section 14 of the Israeli law).
• Deletion: ask us to delete your data.
• Restriction: ask us to limit how we use your data.
• Portability: get your data in a common, machine-readable format.
• Objection: object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent: where we rely on consent, at any time. This does not affect earlier processing.
• Revoke integrations: revoke API keys in Settings → API Keys, and disconnect AI assistants (section 10).

How to exercise your rights. Email support@uralabs.app from the email address on your account. We may need to verify your identity. We will respond within 30 days. If a request is complex, we may extend this where the law allows, and we will tell you why. Exercising your rights is free, unless a request is clearly unfounded or excessive.

Data about others. If you are a third party whose data appears in a customer's capture, we will generally refer your request to that customer and help them respond.

Right to complain. You can complain to the Israeli Privacy Protection Authority (www.gov.il/en/departments/the_privacy_protection_authority), your local data protection authority in the EU/EEA, or the UK Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.

16. California privacy rights (CCPA/CPRA)

This section applies to California residents.

Categories collected (last 12 months): identifiers (name, email, IP address, account and token IDs); commercial information (credits and usage); internet or electronic activity (logs, usage of URA); professional information (company, if provided); and content you submit. We may incidentally process other categories that appear in pages or captures you submit.

Sources: you, your devices, AI assistants you connect, and public web pages you ask us to record.

Purposes and disclosures: as described in sections 7, 11 and 12, for business purposes.

No sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising. We do not knowingly sell or share data of consumers under 16.

Sensitive personal information. We use your account password only to authenticate you. We do not use sensitive personal information to infer characteristics about you.

Your rights: to know, access, delete and correct your personal information. You can use an authorised agent. Submit requests to support@uralabs.app. We will verify your request and will not treat you differently for exercising your rights.

17. Cookies and similar technologies

We use only cookies and storage needed to provide the service:

• authentication and session cookies (Supabase) to keep you signed in and secure;
• browser local storage for interface preferences (for example, layout settings and whether you dismissed the welcome dialog);
• the in-app support chat (tawk.to), available only after you sign in, which uses its own cookies and local storage to keep your chat conversation working;
• for people viewing a shared report by invitation, one cookie that keeps them signed in to that report for up to 30 days.

We do not use advertising, analytics or tracking cookies. Product-usage records (section 3.3) use your existing login session and no extra cookie. If we add non-essential cookies, we will update this policy and ask for consent where required.

18. Security

We use measures appropriate to the risk, guided by the Israeli Privacy Protection (Data Security) Regulations, 5777-2017 and the GDPR. These include:

• encryption in transit (HTTPS/TLS) and encryption at rest by our hosting and database providers;
• passwords, API keys and OAuth tokens stored only as hashes;
• access controls that limit each user to their own data;
• limited administrative access, restricted to the URA team;
• choosing providers with recognised security practices.

No system is completely secure. If a security incident affects your personal data, we will notify you and the relevant authorities as the law requires.

Please keep your password and API keys secret, and tell us at once at support@uralabs.app if you suspect your account, an API key or a connected AI assistant has been compromised.

19. Children

URA is a business service for people aged 18 or over. It is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, contact support@uralabs.app and we will delete it.

20. Changes to this policy

We may update this policy, for example when we incorporate a company, add paid plans, or add a service provider.

• We will post the new version here with a new effective date and version number.
• For material changes, we will notify you by email or in the app at least 14 days before they take effect. Changes needed for legal or security reasons may take effect sooner.
• Where the law requires your consent to a change, we will ask for it.

21. Contact

URA, operated by Tomer Pascal, Israel (see section 1).

Email: support@uralabs.app (privacy requests, support and legal notices).