Privacy Policy

Last updated: 22 July 2026

1. Who's responsible

Towpath Digital Ltd (Company No. 16913912), Huntingdon Boathaven, The Avenue, Godmanchester, Huntingdon, England, PE29 2AF, is the data controller for universalcontacts.co.uk. Contact: hello@universalcontacts.co.uk.

2. What we collect

Your account details (name, email); the contact details you choose to put on your card; order and delivery details if you buy a card; support messages; and basic usage data (pages visited, card taps and scans) so we can run and improve the service. Payments are processed by Stripe — we never see your full card number.

3. Details other people send you (contact-back)

If someone taps or views your card and chooses to send their details back, we collect what they submit — typically their name, email, phone number and any note — along with which of your cards it came from, and store it as a lead in your dashboard. For these contact-back records you (the cardholder) are the data controller and Universal Contacts acts as your processor: it is your responsibility to have a lawful basis for holding those contacts and to honour their data rights. We show a short privacy note beside the contact-back form so the sender knows their details go to you.

The contact-back form also carries an optional, unticked "keep me posted" box. If the sender ticks it, Universal Contacts may send them at most one confirmation email and one follow-up about the service; that permission lapses automatically after 12 months unless renewed. If they leave it unticked, we never email them for marketing.

With Pro you can export these leads (CSV and vCard) and forward them to your own CRM through a webhook you configure. Where you send lead data is your choice and your responsibility. We keep contact-back records until you delete them or close your account, and you can delete individual leads at any time.

4. Why we use it

To run your profile and cards (contract), to fulfil and deliver orders (contract), to keep the service secure and improve it (legitimate interests), and to measure how the site is used (analytics). We don't sell your data, and we don't send marketing you haven't asked for.

5. Sharing your card is your choice

Your card exists to be shared — but you control what each person sees with per-field privacy tiers (public, on scan, on unlock). We only show what you've chosen to show.

6. Who we share data with

Trusted processors who help us run the service: Supabase (secure hosting and database), Stripe (payments), Resend (transactional email), our card production partner (name and address, only to print and post your card), and Google Analytics (usage statistics). Each is bound by contract to protect your data.

7. How long we keep it

Your profile: until you delete it. Order records: 6 years, as UK tax law requires. Support emails: up to 2 years. Contact-back leads you receive: kept until you delete them or close your account. Delete your account and your profile data goes with it.

8. Your rights

Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, and take your data elsewhere. Email us and we'll sort it. If you're unhappy, you can complain to the ICO at ico.org.uk.

9. Cookies

See our Cookie Policy.