Privacy Policy

Last updated: 15 October 2026

Data Controller

Bowerbird Studio Ltd is the data controller for this website. Unicorn Status is a trading name of that company.

Registered in England and Wales, company number 17073237. Registered office: 49 Aylsham Drive, Ickenham, Uxbridge UB10 8TL.

Data We Collect

If you are on our team: a single httpOnly cookie ("unicorn-auth") keeps the admin side of the site signed in. It comes from a shared passphrase, with no account or profile behind it, and customers never get it.

If you review cards on your company's page: the page opens with a password your company shares. When you add your name so your choices count, we keep that name, an email address if you give one, the decisions, comments and notes you leave on the cards, and when you were last there. A cookie in your browser remembers which name is yours.

If you sign in with Google: signing in is optional. The password link keeps working without it. If you choose it, Google sends us your name, your email address, the web address of your profile picture, Google's ID for your account, whether Google has verified your email address, and your Google Workspace domain if your company uses Workspace. We keep all of those, with the time you last signed in, except the picture address, which we no longer keep. A sign-in made before we stopped may carry it in its session cookie until that session ends, at most 30 days. We ask Google for your basic profile only, never your contacts or your files. Signing in also means we hold:

which company's page you can open, your role there (viewer, approver or owner) and how you were added: by your company's email domain, by an invite, or by us
if someone invited you: your email address, the role offered, who sent the invite, when it was sent and when it runs out, and when you accepted it and with which account (or that it was withdrawn). 30 days after you accept, the address on the invite is replaced by a scrambled copy of it (a hash), which we use only to check that you still sign in with the invited address
if your access is taken away: the company, your account, the email address you had at the time, who removed you and when. We keep this so that signing in again does not quietly put you back. If your account is later deleted, we keep the record with your email address and without the account
your decisions on the cards, recorded against your account instead of a typed name

While you are signed in, your session sits in an encrypted cookie in your browser. The cookie page lists it.

If you fill in a proposal or planning page: your name and contact details, and the answers you give us about your company. Those answers may describe other people at your organisation, such as founders or team members you want on a card.

If we sent you a proposal page: each visit, the date and time, which page, whether it stopped at the password screen, and your browser family (for example Chrome on a Mac). Opening it again within half an hour is the same visit. We work that out on our side, from the time of the last visit we logged, so nothing is stored on your device to count it, and this log does not include your IP address. It tells us whether a proposal has been read, and how many times. You can object to it: email us and we switch it off for your company and delete what it had logged, except the date of the last visit, which our retention periods count from. After that nothing about visits to your company's proposal or planning pages is recorded. While it is off, opening the step-by-step page no longer moves the dates our retention periods count from, so those run from the last visit we logged before you objected.

If you type a page password wrongly: to stop someone guessing it, we record that a wrong attempt was made on that page, when, and a keyed hash (an HMAC) of your IP address. The hash can be compared with another attempt from the same address but cannot be turned back into the address. We never keep the password you typed. These records are deleted once they are a day old, by the next wrong attempt on any page or by our weekly deletion job, whichever comes first, so none lasts more than about eight days.

If you use the step-by-step planning page: how far you got, how many times you opened each step, when you first typed an answer, and whether you jumped straight to the price or copied the share link. This is kept per company, not per person, and it tells us where the page is hard to get through. It is part of the same visit log, and switching the log off for your company stops it too.

If you just visit: we use Vercel Analytics, which counts page views without cookies and without building a profile of you. It is switched off on the proposal and planning pages, whose addresses name your company, so those visits are never sent to Vercel. We do not use tracking pixels or fingerprinting, and we do not run advertising trackers.

Purpose

The admin cookie keeps our own team signed in. It is a strictly necessary cookie.

Your name on your company's page tells us who approved which card. If you sign in with Google, we also check your role every time you open the page, so when we remove you, your Google access stops straight away. If you leave your company, the sure way to end that access is for your company to ask us to remove you. Until then a Google sign-in can carry on for up to 30 days, and longer if your Google account still works after you go. The shared password keeps working for anyone who has it until we change it, which we do when your company asks. None of it is used for marketing.

Information you give us on a proposal or planning page is used to design and produce your card set, to quote for it, and to talk to you about the work. We do not sell it and we do not use it to build marketing lists for anyone else.

Retention

We keep things for a set period with a reason attached, rather than until someone gets round to deleting them.

A proposal or planning page, if we have not made a card set for your company: 12 months after the latest of: when we set the page up, when you last sent it to us, and when someone at your company last opened the step-by-step version. Then we delete the free-text brief, the card list you drafted (which can name people) and the record of how far you got through the step-by-step page. The brief holds budget shape and sometimes named colleagues, which is the least justified thing we hold. The numbers you chose, such as headcount and which collections, and your colour picks stay with your company's entry.
If we made a card set for your company: the same, but 24 months after your last order, or after the latest of those three if that is later. Your last order is the most recent of: when we made a card set for you, when its card list was signed off, when you sent the card list back to us, when you sent your approvals back, and when we made or sent a print batch for you.
Research we did before contacting you: 12 months if we never made contact, 24 months from last contact if we did and heard nothing back.
Orders, cards and print records: 6 years, the Companies Act period, after your last order, or after someone at your company last opened, approved or decided anything on the card set if that is later. Then we delete the personal details on the order record: the names and email addresses of the people who approved cards, who approved each card and any comment they left, who signed the card list off or sent it back and any note with it, and the decisions and notes made on the card list. The cards themselves, their artwork and the print records are not deleted by this, so a reprint stays possible. Nothing deletes them on a timer; we delete them when you ask.
Payment and invoice records: 6 years from the end of the financial year they belong to, for VAT and corporation tax. An order paid for on this site, with the buyer's email and delivery address, is deleted 6 years after the end of the financial year it was placed in. Until our accountant confirms our year end, we take whichever of 31 March and the end of February keeps it longer. Invoices are kept in our accounting software, not on this site.
Records of a proposal page being opened: 12 months.
Brand files you upload: the logos, mascots and photos you upload on your planning page, and images you attach to a note on a card, since this rule began. 12 months after your last order, or 12 months after the file reached us if that is later. If your company has not ordered, 12 months after the file reached us. The files themselves are deleted from our storage, not only our record of them, except one that another card, logo or set of yours still uses, or an image a note on a card still shows.
Brand files we add: files we upload or save ourselves are not on that clock. That covers guidelines, press kits and logo bundles you email us, images we save from your website, files we add to your library, images we attach to a note, and anything uploaded before this rule began. We delete them when you ask.
Wrong password attempts: between one and about eight days, as above.
A Google sign-in account: deleted 12 months after your company's last activity with us, or sooner if you ask. Your company's last activity is the most recent of these: someone there signing in with Google, an approver there opening its page, a decision or approval someone there made on its cards, someone there opening or submitting its planning page, and the last time we changed its card set. Visits from people who can only look are not recorded, so for them only signing in counts. Our own visits, and decisions we record on the page ourselves, do not count. An account with no company is deleted 12 months after it last signed in.
Your role on a company's page: while that company is a customer. It goes sooner if you or your company ask us to remove you, or when your account is deleted. A company stops being a customer when we record that it has, or, whatever we have recorded, when for 24 months none of the things listed under a Google sign-in account above has happened, we have added no role, invite or email domain for it, and it has not ordered. A company where none of those has ever happened is not caught by the 24 months.
An invite nobody accepted: invites run out 14 days after they are sent, and we delete them 30 days after that.
An invite someone accepted: we keep the record of it, and 30 days after acceptance we replace the email address on it with a hash. We delete the hash once the role the invite gave has ended. After that the record holds nothing about you apart from the link to your account, which goes when the account does.
A record that someone was removed: while that company is a customer, even after your account is deleted. Keeping you out of that company's page is the reason we hold your email address, so the record stays, with the address and without the account. When a company stops being a customer, as described under your role above, we delete its roles, these records and the email domains we had verified for it.
Approvals and the name on them: kept with the order record above. If your account is deleted, the decision keeps the name you approved under and loses the link to the account and your email address.
Cookies: the admin cookie and the Google sign-in cookie last 30 days. The page password cookie lasts 90 days and is renewed each visit; when it lapses you type the password once more and lose nothing, because your page and its answers do not expire. The cookie that remembers your name lasts 400 days. The cookie page has the full list.

Our deletion job runs once a week, and most of what it deletes it first holds for a week, so it can check it has picked the right rows. Something can therefore go up to about two weeks after the point given above, or a week later than that if one of the weekly runs fails.

You can ask us to delete something earlier and we will, unless we are required to keep a record of it.

Your Rights

Under the UK GDPR you have the right to access your personal data, correct it, have it erased, restrict how we use it, object to us using it, and receive a copy in a portable form. That includes objecting to the log of visits to a proposal or planning page: email us and we switch it off for your company and delete what it had logged, apart from the date of the last visit. Email george@unicorn-status.com and we will answer.

To delete a Google sign-in account, email us. We remove the account with every role it had. The decisions you made stay on the order record under your name, without the link to the account or your email address. If a company removed you from its page, we keep that record with your email address, so that a new account on the same address does not get back in. You can sign out from the approval page at any time.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, but you do not have to.

Who Else Processes Your Data

We do not sell your data or share it for anyone else's marketing. We do rely on service providers to run the business, and they process data on our instructions:

Vercel, for hosting this site and for page view analytics
Supabase, for the database and for files you upload to us
Google, for the AI models used to draft card content and artwork
Google again, if you choose to sign in with it. For this Google is not working for us: it runs your Google account as a separate controller under its own privacy policy, and it tells us the profile details listed above when you sign in.
withoutbg, which cuts the background out of images you send us
Microsoft, for our email
Stripe, if and when you pay us
Precision Proco, our printer in the UK, who receive the files we send to press. Where a card names one of your people, that name is in the file.

Some of these process data outside the UK. Where they do, the transfer is covered by the safeguards in their own data processing terms.

If someone else named you

A company planning a card set tells us about the people in it, which means we may hold your name and a line about what you do without you ever having filled anything in. You have the same rights over that as you would over anything you gave us yourself. Email us and we will tell you what we hold, correct it, or remove you from the set.

The same goes if a colleague invited you to your company's page: we hold your email address before you have done anything. If you never accept, the invite is deleted on the schedule above.

Why we are allowed to hold it

UK GDPR asks us to name a lawful basis for each purpose. Ours:

Making your company's cards and getting them printed: our contract is with your company, so for you, including if you placed the order on its behalf, legitimate interests, Article 6(1)(f): your company needs its people to work on the cards with us. Where the customer is you yourself, as a sole trader or as a partner ordering in your own name, contract, Article 6(1)(b).
A proposal or planning page you filled in: contract or the steps before one, where you want a quote. Legitimate interests where you were only looking.
Research from public sources, before we approach a company: legitimate interests, Article 6(1)(f). We hold work context taken from what a company has published: a name, a job title, an employer, quoted words and the page we found them on. No home addresses, nothing sensitive, and no automated decision that affects anyone.
Reviewing cards on your company's page, signing in with Google, your role there, invites and removal records: legitimate interests, Article 6(1)(f). Your company bought cards from us and wants its people to check them, and we need to know who approved what and who should no longer get in. That includes the person who placed the order, who does it for the company. Only where the customer is you yourself, as a sole trader or a partner ordering in your own name, is it contract instead.
Colleagues described inside a brief: legitimate interests. They did not fill the form in, so this notice is how they find out, and whoever sent the brief is the person who knows them.
Payment and accounting records: contract, and legal obligation for the copies we have to retain.
Email to business contacts: legitimate interests. Every message carries a way to opt out, and an opt-out is honoured even after we delete everything else about you.

If we hold something about you that you never gave us, you can ask what it is and ask us to stop. Where we rely on legitimate interests you have the right to object, and for research and marketing we will simply stop.

We are registered with the Information Commissioner's Office as a data controller, registration number ZC236826, since 2 September 2026. You can check it on the ICO register.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.