Privacy policy

Who we are

URBI APPAREL (registration 202603268515 / MA0353173-D) operates wearurbi.com. For privacy questions or requests, email hello@wearurbi.com.

Contact/return address: B18-09, The Andes Condo Villa, Jalan Mas 3, 58200 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia.

What we collect and why

We use your email address to send passwordless login links and manage your account. You may save your name, phone number and promotional preference in your profile.

When you order, we record your selected items, sizes, quantities, prices, discounts, payment references and status, and the contact and delivery information supplied through checkout. We use these details to handle payment confirmation, source and embroider your shirts, arrange delivery, respond to support requests, and manage returns, refunds and disputes.

We keep referral and promotion records to determine eligibility and prevent repeated use of one-use offers. Security and service providers may process technical information such as IP addresses and request information to operate and protect the services.

Hosted checkout is provided by payment providers. urbi does not receive your full card number or card security code through that checkout. Payment providers handle payment information under their own privacy notices.

Providing an email address is necessary for account access. Checkout requires the information needed for payment and delivery. Promotional consent is optional; choosing not to receive promotions does not prevent a purchase.

Who receives information

We use Cloudflare for hosting, database services and website analytics; Resend for account emails; and Stripe and PayPal for payments. When arranging delivery, we share the necessary recipient and parcel details with Ninja Van and any relevant delivery partners.

If you contact us through WhatsApp, Meta/WhatsApp processes your messages. Where AI support is enabled, ElevenLabs also processes messages or call content needed to provide that support. Please avoid sending passwords, payment-card details or sensitive documents in support chats. AI support may make mistakes; you can request human assistance at hello@wearurbi.com.

These providers may process information outside Malaysia. Their handling of information is also described in their own privacy notices. We may also disclose information where necessary to meet legal obligations or handle disputes.

Cookies and browser storage

We use a secure account-session cookie to keep you signed in for up to 30 days. Login links expire after 15 minutes and can be used once. Separate order-access cookies may remain for up to seven days.

Browser storage remembers your shopping bag, checkout attempt and referral code. You can clear cookies and browser storage through your browser settings, but doing so may sign you out or remove your saved bag. Cloudflare provides website traffic analytics to help us understand use of the store.

Promotional messages

You can choose whether to receive email and WhatsApp promotions using the preference in your account. You can withdraw that permission through the same preference or by emailing hello@wearurbi.com. Necessary account, payment, delivery and support messages are separate from promotional messages.

Promotional campaigns will only be enabled after the consent and unsubscribe process is ready.

How long we keep information

We retain necessary order, payment, refund and accounting records for seven years from the end of the year to which the business income relates. Records may need to be held longer where an applicable filing rule, unresolved dispute or legal obligation requires it. This period applies to necessary business records, not automatically to every account field or support conversation.

We retain account information while it is needed to provide the account. You may request account deletion at hello@wearurbi.com. We will assess the request, remove information no longer needed and explain any records we must retain. Deleting an account does not automatically delete legally required transaction records.

Expired authentication credentials are no longer valid. Technical expiry is different from deletion of a stored database row. Backup copies are retained separately and may not disappear immediately when an active record is removed.

We review unpaid checkout records, support conversations, promotional-consent records, technical logs and independent backups according to their ongoing operational, security and legal purpose. You can contact us about retention of your information. We do not currently provide automatic deletion through the website.

Your requests and choices

Email hello@wearurbi.com to request access to, correction of, or deletion of your personal information, or to withdraw promotional consent. We may ask for proportionate information to verify that the request comes from the account holder. Do not email your password, card security code or login link.

We will assess requests under the rules applicable to your circumstances, explain any limitations and respond within the applicable period. Depending on where you live, you may also have rights to object to or restrict processing, obtain a copy of information, or complain to the relevant data-protection authority.

Protecting information

We use access controls, secure connections and protected account sessions. Administrative access is restricted. No service can guarantee absolute security. We will assess suspected incidents and follow applicable notification obligations.

Changes

We will update this notice when our processing changes and show the effective date. Where required, we will provide additional notice or request consent.