Privacy Policy

URBANLINES is a poster printing service operating from the United Kingdom. We sell personalised map posters via our website and Etsy shop. For questions about this policy, contact us at hello@urbanlines.co.uk.

When you place an order, we collect: your name, email address, shipping address, and payment reference (we never store card details: Stripe handles all payment processing). We also collect your poster configuration (city, colours, custom text) to fulfil your order. If you contact us, we store the correspondence. If you sign up to our newsletter, we store your email address together with the date, the IP address you signed up from and the wording you agreed to. We keep those last three solely as evidence of your consent, as UK GDPR requires us to be able to demonstrate it. If you press Accept on a cookie banner that names Microsoft Clarity, we also record how you use the website through it: see section 7.

We use your data to: (a) process and fulfil your order, (b) send order and shipping confirmation emails, (c) ask once, after your order has arrived, what you thought of it, (d) resolve any issues with your order, and (e) comply with legal obligations. We do not use your data for marketing without your consent. If you have opted in to the newsletter, we also use your email address to send it. Every issue carries a one-click unsubscribe link, and you can opt out at any time by using it or by emailing us.

We share the minimum necessary data with our service providers: Stripe (payment processing, PCI-DSS Level 1 compliant), Prodigi (print and fulfilment: your name, shipping address and email address, which Prodigi passes to the courier so it can send you delivery updates), Supabase (database and operational storage), Resend (transactional emails), Vercel (website hosting and privacy-friendly analytics), Railway (backend hosting), and Sentry (error monitoring). If you press Accept on a cookie banner that names Microsoft Clarity, Microsoft receives a record of how you use the website. If you press Accept on one that asks about analytics and advertising cookies, Meta (Facebook/Instagram) and Google Analytics receive information about your visit. We never ask about both under one Accept: see section 7. Microsoft is a separate controller of the Clarity data, not only our service provider: it uses that data for its own purposes, including advertising, as the Microsoft Privacy Statement (privacy.microsoft.com/privacystatement) explains. We do not sell your data to any third party.

We retain order records for 7 years to comply with UK accounting requirements. After this period, personal data is deleted. You may request earlier deletion of your data by contacting us, subject to legal obligations. If you accepted Microsoft Clarity, Microsoft keeps recordings of your visits for 30 days and heatmap and click data for up to 9 months, and may keep a sample of recordings for up to 9 months; after that it deletes them. This data is linked to a random identifier in your browser, not to your name or email address, and Clarity has no way to delete one visitor’s data early. If you withdraw consent, recording stops straight away, and anything already recorded is deleted on that schedule.

You have the right to: access the personal data we hold about you, correct inaccurate data, request deletion (where no legal obligation prevents this), object to processing, and data portability. To exercise any right, email hello@urbanlines.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

We use essential browser storage and cookies required for the configurator and checkout flow, including preserving an unfinished poster draft while you complete payment. These are always on, because the site cannot work without them. We also use Vercel Web Analytics and Speed Insights, which are cookieless and aggregate, and Sentry to capture technical errors.

Only if you press Accept on a banner that names it, we use Microsoft Clarity to see how people use the site and where it gets in their way. Clarity records replays of individual visits: the pages you open, where you click and tap, how far you scroll and how the pointer moves, along with your device, browser and country, and it turns them into heatmaps. The words on the page, including the name and time on your poster, and what you type into forms are hidden before the recording leaves your browser. The address of each page is recorded in full, and that includes anything you search for in our shop. Clarity never runs on the order confirmation or order tracking pages. On this site it sets two cookies: _clck, which recognises your browser on later visits for up to a year, and _clsk, which joins the pages of one visit together for up to a day. It also keeps a random tab identifier, _cltk, in your browser’s session storage until you close the tab. We ask Clarity not to set or sync Microsoft’s advertising cookies. Microsoft may still receive cookies it has already set in your browser on its own domains, and it uses Clarity data for its own purposes, including advertising, as the Microsoft Privacy Statement explains. Microsoft may process this data in the United States, relying on the UK Extension to the EU-US Data Privacy Framework.

Separately, the Meta Pixel and Google Analytics 4 measure which prints people look for and help us show our prints to runners on Facebook and Instagram. They set third-party cookies and load only if you press Accept on a banner that asks about analytics and advertising cookies. If you decline, or simply ignore the banner, none of these tools loads and your browser makes no request to Microsoft, Meta or Google. Our lawful basis for using Clarity, the Meta Pixel and Google Analytics is your consent (UK GDPR Article 6(1)(a)), which you can withdraw at any time.

None of these optional tools is switched on at the moment, so the site shows no cookie banner and loads none of them.

We use industry-standard security measures including HTTPS/TLS encryption, secure database access controls, and we never store payment card details. Stripe's infrastructure is PCI-DSS Level 1 certified.

If we make material changes to this policy, we will update the date above and may notify you by email if you have an active order.