Privacy

Who this covers

This notice covers swag.urbancustomz.com — the corporate merchandise platform and the private company stores that run on it. It does not cover the retail storefront at urbancustomz.com, which is a separate service.

What we collect

When you contact us

• Your name, work email, phone number if you give one, and company name.
• What you told us you need: products, quantities, deadline, budget range.
• Any artwork or files you upload with a quote request.
• A one-way hash of your IP address, used to rate-limit the public forms. We do not store the address itself.

When you have an account

• Your name, work email, job title and the company you belong to.
• Your role in that company: administrator, approver or employee.
• Orders you have placed through your company store, and their status.
• Your allowance balance and the transactions that make it up.

What we deliberately do not keep

Shipping addresses and payment details are handled entirely by Shopify at checkout and are not copied into this platform. Neither are orders placed on the retail storefront — incoming order notifications that do not belong to a company store are discarded rather than stored.

Why we use it

• To reply to your enquiry and prepare a quote — our legitimate interest as a supplier.
• To operate your company store, which is necessary to perform our contract with your employer.
• To send transactional email: invitations, approval decisions, order and shipping updates.
• To improve the site, using analytics that stay switched off until you agree to them.

Marketing email is separate and opt-in. Consenting to be contacted about your quote is not consent to marketing, and the two are recorded independently.

Who else processes it

We use the following subprocessors. Each one only receives what it needs for its function.

• Shopify — products, carts, checkout, payments, orders and fulfilment. Your payment details go to Shopify and its payment processors, never to us.
• Supabase — accounts, company records, allowances, approvals, quote requests and uploaded artwork.
• Vercel — hosting and content delivery for this site.
• Resend — sending transactional email.
• Cal.com — scheduling, if you book a demo. Booking details are held by Cal.com; we store the lead you submitted before the calendar opened.
• Google (Analytics and Ads) — only if you accept analytics on the banner. Receives which pages you viewed and which steps you completed, so we can measure our advertising. Nothing loads before you accept.
• Meta (Facebook and Instagram) — same basis and same purpose, for our advertising on those platforms.

We never send Google or Meta your name, email address, phone number or order details — not even in a scrambled form. Meta’s “advanced matching” feature, which would upload contact details, is switched off. They receive only which pages were viewed and which steps were reached.

Our own website analytics are separate from both, and that data stays in the Supabase database above, hosted in Canada.

Where it is stored

Our infrastructure is hosted in North America. Some subprocessors above operate globally, which means your information may be processed outside the country you are in. Where that happens it is covered by the subprocessor’s own transfer safeguards.

How long we keep it

• Webhook records — 90 days, then deleted automatically. Records of failed deliveries are kept longer because they represent an order that did not sync.
• Marketing attribution (which campaign a lead came from) — only stored with your consent, and expired automatically after that.
• Quote requests and demo leads — kept for as long as the enquiry is commercially live, then archived. Ask us and we will delete yours.
• Accounts, orders and allowance history — kept while your company store is active, because your employer needs the record. Deactivating a member keeps the history and removes the access.
• Audit logs — append-only and retained, since a log that can be edited is not a log.

Cookies and site analytics

Essential cookies keep you signed in and keep your cart intact; they cannot be turned off without breaking the site.

If you choose “Accept” on the banner, two things happen. We record how the site is used with our own analytics, and we let Google and Meta measure our advertising as described above. Nothing is sold, and no contact details are shared with either.

Our own analytics uses a random identifier stored in your browser and a matching uc_as cookie, which lets us tell that an order came from a particular visit. The identifier is random, expires after 30 minutes of inactivity, and is not linked to you by name. Google and Meta set their own cookies, governed by their privacy policies.

We record which pages were viewed, roughly where the visit came from (country and region, from the network request — never a precise location), the kind of device and browser, and which site referred you. We never store your IP address. It is converted to an unreadable value with a key that changes daily, used only to recognise automated traffic, and discarded. Query strings are removed from page addresses before anything is stored.

Choosing “Decline” means none of that happens — our analytics records nothing and the Google and Meta scripts are never requested at all. In our own records, raw analytics are kept for 90 days and visit records for at most 400 days; only day-by-day totals, which identify nobody, are kept longer.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. If your account belongs to a company store, some of that information belongs to your employer’s record and we will tell you where that applies rather than deleting something they are required to keep.

Email sales@urbancustomz.com and we will respond within 30 days.

Security

Access to company data is enforced in the database itself, not only in the application, so one company can never read another’s records. Uploaded artwork is stored privately and served through links that expire. Administrator accounts with elevated access are required to use two-factor authentication.

Changes

If this notice changes materially we will update the date at the top and, where the change affects you directly, tell account holders by email.

Questions about any of this? Get in touch.