Privacy

Who this covers

This notice covers swag.urbancustomz.com — the corporate merchandise platform and the private company stores that run on it. It does not cover the retail storefront at urbancustomz.com, which is a separate service.

What we collect

When you contact us

• Your name, work email, phone number if you give one, and company name.
• What you told us you need: products, quantities, deadline, budget range.
• Any artwork or files you upload with a quote request.
• A one-way hash of your IP address, used to rate-limit the public forms. We do not store the address itself.

When you have an account

• Your name, work email, job title and the company you belong to.
• Your role in that company: administrator, approver or employee.
• Orders you have placed through your company store, and their status.
• Your allowance balance and the transactions that make it up.

What we deliberately do not keep

Shipping addresses and payment details are handled entirely by Shopify at checkout and are not copied into this platform. Neither are orders placed on the retail storefront — incoming order notifications that do not belong to a company store are discarded rather than stored.

Why we use it

• To reply to your enquiry and prepare a quote — our legitimate interest as a supplier.
• To operate your company store, which is necessary to perform our contract with your employer.
• To send transactional email: invitations, approval decisions, order and shipping updates.
• To improve the site, using analytics that stay switched off until you agree to them.

Marketing email is separate and opt-in. Consenting to be contacted about your quote is not consent to marketing, and the two are recorded independently.

Who else processes it

We use the following subprocessors. Each one only receives what it needs for its function.

• Shopify — products, carts, checkout, payments, orders and fulfilment. Your payment details go to Shopify and its payment processors, never to us.
• Supabase — accounts, company records, allowances, approvals, quote requests and uploaded artwork.
• Vercel — hosting and content delivery for this site.
• Resend — sending transactional email.
• Cal.com — scheduling, if you book a demo. Booking details are held by Cal.com; we store the lead you submitted before the calendar opened.
• Google Analytics — only if you accept analytics cookies. Nothing loads before then.

Where it is stored

Our infrastructure is hosted in North America. Some subprocessors above operate globally, which means your information may be processed outside the country you are in. Where that happens it is covered by the subprocessor’s own transfer safeguards.

How long we keep it

• Webhook records — 90 days, then deleted automatically. Records of failed deliveries are kept longer because they represent an order that did not sync.
• Marketing attribution (which campaign a lead came from) — only stored with your consent, and expired automatically after that.
• Quote requests and demo leads — kept for as long as the enquiry is commercially live, then archived. Ask us and we will delete yours.
• Accounts, orders and allowance history — kept while your company store is active, because your employer needs the record. Deactivating a member keeps the history and removes the access.
• Audit logs — append-only and retained, since a log that can be edited is not a log.

Cookies

Essential cookies keep you signed in and keep your cart intact; they cannot be turned off without breaking the site. Analytics cookies are off until you choose “Accept” on the banner, and choosing “Decline” means no analytics script is requested at all.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. If your account belongs to a company store, some of that information belongs to your employer’s record and we will tell you where that applies rather than deleting something they are required to keep.

Email sales@urbancustomz.com and we will respond within 30 days.

Security

Access to company data is enforced in the database itself, not only in the application, so one company can never read another’s records. Uploaded artwork is stored privately and served through links that expire. Administrator accounts with elevated access are required to use two-factor authentication.

Changes

If this notice changes materially we will update the date at the top and, where the change affects you directly, tell account holders by email.

Questions about any of this? Get in touch.