Privacy Policy

1. Introduction

Urba Inc. ("Urba," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, use our services, or interact with us.

Urba is a Canadian company headquartered in Alberta. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).

By using our website or services, you consent to the collection and use of your information as described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

We collect the following categories of personal information:

Contact Information

Name, email address, phone number, and company name — collected when you make a purchase, submit content, apply for a position, or contact us.

Billing Information

Billing address, city, postal code, and province. Credit card and payment details are processed directly by Stripe, our payment processor, and are never stored on our servers.

Content Submissions

Photos, videos, captions, and Instagram handles submitted through our content submission platform.

Technical Data

IP address, browser type, and timestamps — collected automatically when you interact with our website for security, rate limiting, and fraud prevention purposes.

Social Media Identifiers

Instagram handles and linked social media account information provided when purchasing campaigns or submitting content.

Transaction Data

Purchase history, campaign selections, discount codes used, referral codes, loyalty tier status, and advertising credit balances.

Career Applications

Resume, cover letter, portfolio URL, and related professional information submitted through our careers page.

3. How We Use Your Information

We use your personal information for the following purposes:

• To provide, operate, and improve our services
• To process payments and fulfill advertising campaigns
• To send transactional emails including order confirmations, invoices, campaign updates, and login verification codes
• To authenticate your identity through our passwordless login system
• To prevent fraud, enforce rate limits, and maintain security
• To respond to your inquiries and support requests
• To administer our loyalty program and referral system
• To evaluate career applications

4. How We Share Your Information

We do not sell your personal information. We share your information only with the following third-party service providers who assist us in operating our business:

• Stripe — processes credit card payments on our behalf. Stripe's privacy policy governs their handling of your payment data.
• Resend — delivers transactional emails (order confirmations, login codes, campaign updates) on our behalf.
• Instagram / Meta — we use the Instagram Graph API to retrieve public follower counts and manage campaign accounts.

Some of these third-party processors, including Stripe and Resend, may store or process your data in the United States or other jurisdictions outside Canada. When your data is transferred outside Canada, it remains subject to the laws of the receiving jurisdiction and the privacy policies of those processors.

We may also disclose your information if required to do so by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Cookies and Local Storage

We use minimal cookies and browser storage, limited to what is necessary to operate our services:

• Session cookies — maintain your login session and CSRF security tokens. These are httpOnly, session-scoped, and deleted when you close your browser.
• urba_buy_state — localStorage used to persist your shopping cart across browser sessions. Automatically expires after 24 hours and is cleared upon purchase completion.
• urba_retry_order — localStorage used temporarily to reference an order during payment retry. Cleared after use.
• urba-theme — localStorage used to remember your dark/light mode preference.

We do not use any third-party tracking cookies, analytics services (such as Google Analytics), advertising pixels (such as Facebook Pixel), or any other tracking technologies.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:

• Account data — retained while your account remains active and for a reasonable period afterward
• Order and transaction data — retained for 7 years for tax and legal compliance
• Contact form submissions — retained for 2 years
• Content submissions — retained indefinitely in accordance with the content license agreement
• Login verification codes — expire after 10 minutes and are automatically deleted
• Email delivery logs — retained for 1 year
• IP addresses in rate-limit logs — retained for 24 hours
• Career applications — retained for 1 year after the position is filled

7. Your Rights

Under PIPEDA and Alberta's PIPA, you have the following rights regarding your personal information:

• Access — you may request a copy of the personal information we hold about you
• Correction — you may request that we correct any inaccurate or incomplete personal information
• Deletion — you may request that we delete your personal information, subject to legal retention requirements and existing license agreements
• Withdraw consent — you may withdraw your consent to the collection, use, or disclosure of your personal information at any time, though this may limit your ability to use certain features of our services

To exercise any of these rights, please contact us at hello@urba.media. We will respond to your request within 30 days.

8. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm to affected individuals, we will notify you and the Office of the Privacy Commissioner of Canada as required under PIPEDA's mandatory breach notification provisions. Notification will include the nature of the breach, the information involved, and steps we are taking to reduce the risk of harm.

9. Electronic Messages (CASL)

In compliance with Canada's Anti-Spam Legislation (CASL), Urba sends electronic messages only in the following circumstances:

• Transactional messages — order confirmations, payment receipts, login verification codes, campaign status updates, and invoice delivery. These are sent as necessary to fulfill our services and do not require separate consent under CASL.
• Commercial messages — we will not send marketing or promotional emails without your express consent. If you opt in to receive commercial messages, every message will include a clear unsubscribe mechanism, and we will honor unsubscribe requests within 10 business days.

10. Children's Privacy

Our services are not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Urba Inc.

Privacy Officer

Email: hello@urba.media

Website: urba.media/contact