Privacy notice

Urban Assist is operated by Urban Assist Services Ltd, registered in England and Wales under company number 14892337, with its registered office at 128 City Road, London EC1V 2NX. We are the data controller for the personal data described here.

• Account details — your name, email address and mobile number. We use one-time codes rather than passwords, so we never hold a password for your account.
• Addresses — the service addresses you save, including postcode and the approximate coordinates we derive from it so we can match you with nearby professionals.
• Bookings and payments — what you booked, when, the price, and whether you paid by card or cash. Card details are entered directly into Stripe and never reach our servers.
• Messages and reviews — chat with your professional about a job, and any rating or review you leave afterwards.
• Device and usage data — the technical information needed to keep you signed in, and, only if you turn it on, a push-notification token for this device.

• To provide the service you asked for — creating a booking, assigning a professional, taking payment, and letting the two of you message each other. Lawful basis: performance of a contract.
• To keep both sides safe — identity and right-to-work checks on professionals, fraud prevention, and resolving disputes about a job. Lawful basis: legitimate interests.
• To meet legal obligations — retaining transaction and VAT records. Lawful basis: legal obligation.
• To send optional messages — push notifications and marketing emails. Lawful basis: consent, which you can withdraw at any time in your account settings.

We do not sell your personal data. We share only what each party needs to do its job:

• Your assigned professional — your first name, the service address, the job details, and a contact route through the app. They see your address only once a booking has been assigned to them.
• Stripe — payment processing. Stripe is the controller of your card data.
• Supabase — our database and authentication host.
• Google Firebase — push notifications (only if you enable them) and chat messages. Chat content is stored in the US. See our DPA for transfers.
• Twilio — delivers one-time SMS codes for sign-in. Twilio sees the phone number you enter and delivery metadata.
• Sentry — error monitoring for the apps. Error reports are scrubbed of personal data where possible.
• Vercel Inc. — hosting plus cookieless product analytics (Vercel Web Analytics — no cookies, no persistent identifier, no cross-site tracking). Data held in the US under SCCs/DPF. Hosting logs include IP address and request metadata.
• Postcodes.io and getAddress.io — turning a postcode into an address list and coordinates. We send the postcode; we do not send your name.
• Google Maps — the map previews on a booking, loaded from Google when you open that screen.

Booking, payment and VAT records are kept for six years after the end of the relevant tax year, as UK tax law requires. Messages and reviews attached to a booking are kept as long as that booking record. Everything else is deleted when you close your account.

You have the right to access your data, correct it, delete it, restrict or object to how we use it, and to receive it in a portable format. Two of these are built into the app: from your account you can download everything we hold about you, and you can permanently delete your account. Deletion removes your profile, addresses, messages and reviews; it does not remove the financial records we are legally required to keep, which are retained without your contact details attached.

To exercise any other right, email info@urbanassist.co.uk. If you are not satisfied with our response you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

We use strictly necessary cookies to keep you signed in and to remember the postcode you last searched. We do not use advertising or cross-site tracking cookies, so no consent banner is required. If that changes, this notice will be updated first.

Your data is stored in the United Kingdom or the European Economic Area. Where a processor transfers data outside the UK, that transfer relies on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

If we change how we use your data we will update this page and, where the change is significant, tell you directly before it takes effect.