Last updated: 30 October 2026
This policy explains what personal data webcards.co.uk collects, why we collect it, and what rights you have over it. We have tried to write it in plain English rather than legal boilerplate.
This section matters most, because it describes something unusual, and we would rather be direct about it.
We identify newly incorporated UK limited companies using the public register published by Companies House. For some of those companies we build a free one-page digital business card and publish it, then write to the company to let them know it exists and that they can claim it, change it, or have it removed.
The information used comes from the public register and typically includes the company name, company number, registered office address, incorporation date and SIC codes. Where a registered office is a residential address, or is a director's name, that information is personal data even though it is publicly available.
Our lawful basis for this is legitimate interests — specifically, offering a relevant free service to newly formed businesses. We have considered the impact on the people concerned and taken the following steps to limit it:
If you would rather we did not do this, email hello@webcards.co.uk with the company name or the card address and we will take the page down and remove the record. You do not have to give a reason, and we will not ask for one.
We write to companies by post, to the registered office address on the public register. Letters may contain a QR code or a web address unique to that company, which tells us the card has been looked at. That tells us a card was visited; it does not identify who visited it.
Where we contact a business by email, we do so on the basis of legitimate interests for business-to-business communication, and every message includes a way to opt out. We do not send bulk marketing email to addresses we have collected without a relationship.
| Data | Why | Lawful basis |
|---|---|---|
| Email address | To identify your account and sign you in. We do not use passwords, so your email address is how you access your card. | Contract |
| Contact name (optional) | So we know who we are writing to when you contact us. | Contract |
| The content of your card | To publish the page you asked us to publish. Usually business contact details, which you choose. | Contract |
| Support messages | To answer your question. | Legitimate interests |
| Payment details | Handled entirely by Stripe. We never see or store your card number. | Contract |
Brandy is our marketing agent at webcards.co.uk/scoutcard. It answers marketing questions, compares your website with up to three competitors' websites, and can compare product prices between online shops. This section explains what that involves.
Brandy's answers are written by an AI model provided by Anthropic. To produce an answer we send Anthropic what is needed for that answer: your question and the conversation so far, the business and competitor details in the panel, and summaries of the websites read. Under its commercial terms Anthropic acts as our processor and does not use this data to train its models.
Please do not type personal details about other people — for example your customers' names or contact details — into the chat. Brandy does not need them to help you.
When image review is switched on, you can add one image to a chat message — for example an advert, a social media post or a screenshot. Your browser makes the image smaller before sending it. It is sent to Anthropic with your message so Brandy can answer, and it is not stored by us. Please avoid images that show other people's faces or personal details; crop them out first.
When you enter a website, we read its public pages (and, where a shop publishes one, its public product list) to summarise what the business offers and at what prices. We keep the summary and the product names and prices, not the pages themselves. We read only what anyone could see in a browser, we pace our requests, and we stop if a site refuses automatic readers. Product lists from shops are business information and are shared between users, so the same shop is not read again and again.
| Data | Why | Lawful basis | How long |
|---|---|---|---|
| Business name, website and the language you choose | To set up your marketing agent | Contract | While your account is open |
| Competitor names and websites, and any text you paste | To compare you with them | Contract | Until you change them, press "Clear my data", or close your account |
| Summaries of the websites read, and your comparison results | To show your results again and build on them | Contract | The latest three readings per website and your latest ten comparisons |
| Your chat messages, and any images you add | To answer you | Contract | Not stored by us. They stay in your open browser page and are sent to Anthropic only to write the answer |
| Usage counts (which feature, which AI model, the size of the request) | To apply fair-use limits and control costs | Legitimate interests | While your account is open |
| One-way codes (hashes) of your email address, company number and website address | To stop the same business starting the free 45-day trial repeatedly | Legitimate interests | Kept after an account is closed, because that is their purpose. A hash cannot be turned back into the original details |
We save nothing you type. To apply the free-trial limits we keep short-lived counters linked to a one-way code made from your IP address with a secret key; the IP address itself is not stored. The counters are deleted within a few days. Your questions, any images you add, the shops you enter and the website summaries are sent to Anthropic only to produce the answer. Our lawful basis is legitimate interests: offering a free trial while preventing abuse and runaway costs.
We do not use advertising cookies, analytics cookies, or third-party trackers.
When you sign in, we store a session token in your browser so you stay signed in. This is strictly necessary to provide a service you have asked for, so it does not require consent — which is why you are not being shown a cookie banner.
The marketing agent also remembers, in your own browser only, the choices you make on its page: the page language, the answer language, the colour theme and, when you are signed in, your basket list. These stay on your device, are not sent to us for tracking, and you can clear them at any time in your browser settings.
We count how many times a card page is viewed, so that the business can see whether their card is being used. This count is anonymous: no cookie is set, no IP address is stored, and individual visitors are not identified or tracked between visits.
| Operator | Fehér Gábor EV (sole trader) |
|---|---|
| Registered address | 2143 Kistarcsa, Bagolyvár u. 7, Hungary |
| Tax number (adószám) | 59708322-2-33 |
| Contact | hello@webcards.co.uk |
We are the data controller for the personal data described in this policy. We are based in Hungary and provide services to businesses in the United Kingdom. Because we offer services to people in the UK, UK data protection law applies alongside EU law, and this policy is written to meet both.
We use a small number of service providers who process data on our behalf. Each is bound by a contract limiting what they may do with it.
| Provider | What for | Where data is held |
|---|---|---|
| Krystal Hosting | Website hosting | United Kingdom (London) |
| Supabase | Accounts, sign-in, and the marketing agent's data and server functions | Ireland (EU) |
| Anthropic | The AI model that writes the marketing agent's answers | United States, under Anthropic's data processing terms with Standard Contractual Clauses and the UK Addendum |
| Resend | Sending sign-in codes and service emails | Sending from Ireland (EU); account and log data may be held outside the EEA under appropriate safeguards |
| Optional "Sign in with Google". Only used if you choose it. | See Google's own privacy policy | |
| Stripe | Subscription payments | See Stripe's own privacy policy |
We are established in Hungary, so personal data is processed within the European Economic Area. Transfers from the UK to the EEA are permitted under the UK adequacy regulations without additional safeguards. Where a provider transfers data beyond the UK or EEA, that transfer is covered by appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or an adequacy decision.
Under UK data protection law you have the right to:
Email hello@webcards.co.uk. We aim to reply within one working day, and we are required by law to respond fully within one month. There is no charge.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you spoke to us first, but you are not obliged to.
Data is transmitted over encrypted connections and stored in access-controlled databases. Because we do not use passwords, there is no password of yours for anyone to steal or reuse. Access to your account is by a one-time code sent to your email address, or by signing in with Google if you choose that option.
Keeping control of your email account matters: anyone with access to it could request a sign-in code. If you think your email has been compromised, tell us and we will secure your account.
If we change this policy in a way that materially affects you, we will email account holders before it takes effect. The date at the top always shows the current version.