Skip to content
UK BusinessCredit Cards

Privacy policy

By Chris

This site collects very little. It sets no cookies of its own for visitors, has no accounts and no newsletter. The one thing it records in any detail is a click on a referral button, and that record does not include your IP address.

Who we are

UK Business Credit Cards (https://ukbusinesscreditcards.co.uk) is an independent publication run by Chris, a UK business owner. It is not part of Capital on Tap or any other card issuer. For anything in this policy, email hello@ukbusinesscreditcards.co.uk. The contact page has more on how we handle email.

What we collect

Google Analytics 4 (only if configured)

The site is built to load Google Analytics only when a measurement ID has been configured. When it is loaded, it runs with IP anonymisation on and with Google signals and advertising personalisation off, so it produces aggregate page statistics and nothing else. It records events such as a referral click, a promo-code copy or a calculator result, with the page path and, for calculators, the tool name and result figures. It receives nothing that could identify you.

Vercel Analytics

The site is hosted on Vercel and uses its analytics, which is privacy-friendly by design: it sets no cookies, stores no IP addresses, and produces aggregate page-view counts and referrer information only.

Server logs

Requests to the site pass through Vercel’s servers, which keep standard technical logs for security and reliability under Vercel’s own retention rules. They are not combined with anything below.

Email you send us

If you email us, your message sits in an ordinary mailbox until it is dealt with, then is deleted unless it concerns a correction we may need to refer back to.

The referral click log

This site earns money in one way: a referral bonus when a new customer applies to Capital on Tap through our link. To see which pages lead to applications, we keep a first-party record of clicks on referral buttons and copies of the promo code. When you click a referral button or copy the code, we record:

  • The page you were on, its title, and which button or box on the page you used.
  • The page you landed on when you arrived at the site, the site that referred you (if your browser sends one), and any campaign parameters in the address.
  • Coarse session information for the current tab: how many pages you had viewed, how long you had been on the page and on the site, and how far down the page you had scrolled.
  • Your screen size, your browser’s user-agent string, and the device type, browser and operating system we derive from it.
  • Country, region and city, as derived by Vercel from your IP address at the moment of the request.

The session information comes from your browser’s sessionStorage, which holds a small note of your landing page, referrer, start time and page count for the current tab only. It contains no identifier and is cleared by the browser when the tab is closed. Nothing is written to it that persists between visits.

Each record is stored in a database and summarised in an email to the site owner, as a daily digest or, if configured, one email per click, containing the same fields. Traffic that the user-agent string identifies as automated is flagged and excluded from those summaries.

What we do not collect

  • No accounts, logins or profiles for visitors.
  • No newsletter or mailing list.
  • No advertising, retargeting or social-media pixels of any kind.
  • No contact form, so nothing you write is stored on our servers.
  • Nothing you enter into the calculators or the eligibility checker is sent to us; they run in your browser.
  • Fonts are served from our own domain, so no request goes to a font provider.

We rely on legitimate interests under UK GDPR: measuring how the site is used, understanding which pages lead to referral applications so that the site can be maintained, and keeping it secure. We have weighed that against your rights and kept the data to the minimum: aggregate analytics, and a click record with no IP address, cookie or identifier. If you would rather not appear in the click log at all, apply to Capital on Tap directly rather than through our button; the how we make money page explains how.

Retention

  • Click log: kept for the lifetime of the referral programme, because it is the only record of how the site’s single income source performs. We review it annually and delete anything no longer needed.
  • Analytics: held by Google (if enabled) and Vercel under their standard retention settings.
  • Server logs: held by Vercel under its own retention rules.
  • Email: deleted once dealt with, as described above.

Third parties

  • Vercel: hosts the site, runs its analytics, keeps server logs and derives the country, region and city in the click log from your IP address at the edge.
  • Neon: the database provider that stores the click log.
  • Resend: the email service that delivers click summaries to the site owner.
  • Google Analytics: only if enabled, as described above.
  • Capital on Tap: when you click through to capitalontap.com you leave this site, and Capital on Tap’s own privacy policy applies to anything you do there, including the application. Our link carries a referral code so that Capital on Tap can attribute a successful application to us; it carries nothing about you.

We do not sell or share data with anyone else.

Your rights

Under UK GDPR you can ask what data we hold about you, ask for it to be corrected or erased, and object to processing based on legitimate interests. Because the click log contains no identifier, we usually cannot single out your records from anyone else’s, and we will explain that honestly if you ask; where we can identify data as yours, such as an email you sent, we will act on the request. Email hello@ukbusinesscreditcards.co.uk. If you are unhappy with how we handle your data or your request, you can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies and browser storage

The public site sets no cookies. There is one exception that does not apply to visitors: when the site owner signs in to the private admin area, a single session cookie is set in that browser so the admin pages recognise it. It is only ever created by signing in with the admin password and is never set for anyone browsing the public pages.

If Google Analytics is enabled, it sets its own cookies in order to tell one browser’s visits apart from another’s. Those are set by Google’s script and are governed by Google’s terms; we configure it with IP anonymisation on and advertising features off.

The site does use browser storage, which is not a cookie and is never sent to a server on its own. sessionStorage holds a small note about the current tab’s visit, with no identifier, which the browser discards when the tab closes. If your browser blocks storage, the site works the same and simply records less.

Changes to this policy

If we add a service or change what is collected, this page will be updated and the date below will move. Material changes will also be noted in the site’s news section. This policy was last updated on .

Related reading