Sign inCreate free profile
Skip to content

Privacy Policy

Last updated: 27 September 2026

1. Who's responsible

Towpath Digital Ltd (Company No. 16913912), Huntingdon Boathaven, The Avenue, Godmanchester, Huntingdon, England, PE29 2AF, is the data controller for universalcontacts.co.uk, and is registered with the UK Information Commissioner's Office (ICO), registration number ZC210106. Contact: hello@universalcontacts.co.uk.

2. What we collect

  • Your account details: your name and email.
  • The contact details you choose to put on your card.
  • Order and delivery details, if you buy a card.
  • What you tell us when you ask for a print price — your name, company, email and the job itself, which we keep as the quote.
  • Support messages.
  • Your mobile number, if you choose to verify it: we send a one-time code to it.
  • Basic usage data — pages visited, card taps and scans — so we can run and improve the service.
  • The link that brought you, if it carried one of our tags (for example a card’s “get your own” link or a link from another Towpath site). We keep that tag with your account if you sign up and with your order if you buy, so we know which link or card sent you and can credit a referral. It is a label on our own link, not a profile of you, and nothing is stored on your device for it unless you allow analytics.

Payments are processed by Stripe — we never see your full card number.

3. Details other people send you (contact-back)

If someone taps or views your card and chooses to send their details back, we collect what they submit — typically their name, email, phone number and any note. We also record which of your cards it came from, and store it as a lead in your dashboard.

For these contact-back records you (the cardholder) are the data controller and UniversalContacts acts as your processor: it is your responsibility to have a lawful basis for holding those contacts and to honour their data rights. We show a short privacy note beside the contact-back form so the sender knows their details go to you.

The contact-back form also carries an optional, unticked "keep me posted" box. If the sender ticks it, UniversalContacts may send them at most one confirmation email and one follow-up about the service; that permission lapses automatically after 12 months unless renewed. If they leave it unticked, we never email them for marketing.

With Pro you can export these leads (CSV and vCard) and forward them to your own CRM through a webhook you configure. Where you send lead data is your choice and your responsibility. We keep contact-back records until you delete them or close your account, and you can delete individual leads at any time.

If you sent your details to a cardholder and want them removed, contact that cardholder - they control the record. You can also email hello@universalcontacts.co.uk and we will remove your details from our platform and pass your request on to them.

4. Why we use it

To run your profile and cards (contract), to fulfil and deliver orders (contract), to keep the service secure and improve it (legitimate interests), and to measure how the site is used (analytics). We don't sell your data, and we don't send marketing you haven't asked for.

5. Sharing your card is your choice

Your card exists to be shared — but you control what each person sees: you keep a separate card for each profile, so you only ever show the details you've put on the card you share. We only show what you've chosen to show.

6. Who we share data with

Trusted processors who help us run the service:

  • Supabase — our database, sign-in and server functions. The database is hosted in London.
  • Cloudflare — delivers and protects this website, so it handles your connection to it, including your IP address.
  • Stripe — payments.
  • Resend — transactional email.
  • Our card production partner — your name and address, only to print and post your card.
  • Our print and signage production partners — your artwork and the delivery address, only to make and send a quoted item.
  • Google Analytics — usage statistics, only if you allow analytics cookies.
  • Twilio — sends the one-time code when you verify your mobile number.
  • Google Wallet — only if you choose to add your card to it: the details on the pass go to Google. An Apple Wallet pass is made by us and saved on your own phone.

Each is bound by contract to protect your data.

Within Towpath Digital. UniversalContacts is one of several Towpath Digital products. Your name, email and phone number, the links you choose to share across Towpath, the cards you publish, your consent choices and your orders are also kept in the Towpath hub, our own shared record, hosted on Supabase in London. That keeps them the same in every Towpath product you use, and means an opt-out made in one is honoured in all of them.

If you switch on sending your leads to CentralContacts, another Towpath product, they go to your own CentralContacts address book. You can switch it off at any time.

Where your data is processed. Some of these processors operate outside the UK - for example Stripe, Resend and Google are based in the United States. Where we transfer personal data outside the UK we rely on UK adequacy regulations or on Standard Contractual Clauses together with the UK International Data Transfer Addendum, so your data keeps an equivalent level of protection.

7. How long we keep it

Your profile: until you delete it. Order records: 6 years, as UK tax law requires. Support emails: up to 2 years. Contact-back leads you receive: kept until you delete them or close your account. Delete your account and your profile data goes with it. We keep your order records (as above), the record of any consent you gave, and any unsubscribe or block, so that an opt-out is still honoured.

8. Your rights

Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, and take your data elsewhere. Email us and we'll sort it. If you're unhappy, you can complain to the ICO at ico.org.uk.

9. Cookies

See our Cookie Policy.

10. Related pages