Privacy Notice

The data controller for platform personal information is TouchYourWorld Technologies Ltd, Company No. 17436889, registered in England and Wales.

TouchYourWorld operates through two related entities:

• TouchYourWorld CIC – Community Interest Company for social-purpose activity, including user Contribution money and sponsor-funded Story and campaign money; Company No. 17446404; registered in England and Wales; registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.
• TouchYourWorld Technologies Ltd – technology and commercial operator that builds and runs the platform; Company No. 17436889; Registered in England and Wales; registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.

Privacy contact: compliance@touchyourworld.com.

Depending on how you use TouchYourWorld, we may process:

• Account and contact information - such as name, email address, country and password (stored in hashed form).
• OTP, login and account-security records - including one-time passcodes, trusted-device tokens and related session security data.
• Profile and country information - including display and location details you provide.
• Stories and media - titles, Story text, images, linked media (including social or video links) and any beneficiary information you include.
• Comments, reports and support enquiries - including conversation comments and emails you send to us.
• Touch activity - Vote, Contribution and Sponsored Contribution Touch activity associated with Stories, campaigns, visitors or accounts. Logged-out Vote Touches do not require an account or payment information, but limited technical information (such as an IP address, cookie or security record) may still be processed.
• Payment-related metadata - limited Stripe transaction metadata for Contribution purchases, refunds and disputes. Full card details are handled by Stripe, not stored by TouchYourWorld as ordinary card numbers.
• Recipient verification information - identity, eligibility, banking and KYC/KYB information handled by or shared with Stripe for payouts.
• Device and technical data - such as IP address, browser type, device information, session identifiers, security signals and server logs.
• Cookie and similar technology data - described in section 10 and the Cookie Notice.
• Marketing preferences - if you choose to receive optional marketing.
• Sponsorship and business-contact information - where you or an organisation contact us about partnerships.

Payment and KYC categories above apply to Contribution Touch purchases, refunds, disputes and recipient payouts processed through Stripe.

Some Stories may voluntarily include health or other sensitive personal information. If you publish a Story about another person, you must have that person’s authority and should minimise what you publish.

Do not publish identity documents, card details, passwords or unnecessary banking information in a public Story.

We collect information:

• directly from you;
• from Story owners and other users who create a Story for a beneficiary;
• from sponsors and business contacts;
• from Stripe and Stripe Connect, which provide payment processing, recipient onboarding and identity or business verification services; and
• from your device, browser and use of the platform (including security and analytics signals).

Stories, profile or display information, media, comments, Touch totals, rankings and outcome updates may be publicly accessible and indexed by search engines. Think carefully before publishing personal information about yourself or others.

We may share personal information with categories of recipients such as:

• hosting and infrastructure providers;
• email and authentication providers;
• security and anti-abuse services such as Google reCAPTCHA where used;
• video and social-media embed providers (for example when a Story or page embeds YouTube content after External media consent);
• Stripe and Stripe Connect, which provide payment processing, recipient onboarding and identity or business verification services, including KYC/KYB checks required for payouts;
• professional advisers, auditors and insurers;
• sponsors only where necessary and lawfully disclosed;
• regulators, courts and law enforcement where required; and
• a buyer or successor during a genuine business restructuring.

TouchYourWorld does not sell personal information.

Some providers or users may be located outside the United Kingdom. Where required, we will use legally recognised safeguards for international transfers.

We keep personal information only as long as needed for necessary legal, security, fraud-prevention, transaction and service purposes, including:

• Account records - while your account is active and afterwards as needed for security, disputes or legal requirements.
• Public and completed Stories - as needed for transparency, campaign integrity and platform history.
• Touch and transaction records - for allocation integrity, fraud prevention and future payment/compliance needs.
• KYC and provider records - according to Stripe, Stripe Connect and legal requirements.
• Security and server logs - as needed to protect the service and investigate abuse.
• Support enquiries and consent records - as needed to respond, evidence consent or meet legal duties.

Exact calendar retention periods are not yet published. A detailed retention schedule will be added when approved. Until then, retention remains purpose-based rather than inventing fixed periods.

TouchYourWorld uses cookies and similar technologies as described in the Cookie Notice:

• Necessary - always on for security, session continuity, CSRF protection, login convenience where chosen, PWA/service-worker shell behaviour, and Google reCAPTCHA where used as necessary security / anti-abuse functionality.
• Analytics - optional. Google Analytics on non-local environments loads only after you opt in.
• External media - optional. YouTube or similar embeds load only after you opt in; otherwise a placeholder is shown.

Use the on-site banner or footer Cookie Settings to accept, reject or manage optional Analytics and External media preferences. You can withdraw marketing or analytics consent later through Cookie Settings.

Open Cookie Settings

You must be at least 18 years old to create a TouchYourWorld account, purchase or allocate Contribution Touches, create or manage a Story, receive funds or any other benefit through a Story, or enter into a sponsorship or other commercial arrangement with TouchYourWorld.

Public visitors may browse public content and cast eligible free Vote Touches without creating an account. No account or payment information is required for an anonymous Vote. Limited technical information may be processed for security, fraud prevention, rate limiting and audit purposes. TouchYourWorld does not know the age of an anonymous visitor and does not claim that age verification has occurred for anonymous Votes.

An adult may create a Story for the benefit of a person under 18. The adult must have the necessary authority or permission from the minor’s parent or legal guardian and is responsible for protecting the minor’s privacy. Any payment or benefit connected to that Story must be handled through an eligible and verified adult, organisation or legal representative.

Because children may still access public pages, we take care with children’s information in line with applicable guidance, including the UK ICO Children’s Code. We avoid unnecessary collection and do not use children’s personal information for behavioural advertising or profiling.

Account holders must confirm that they are at least 18 years old. TouchYourWorld and its payment partners may conduct additional age, identity and eligibility checks when required. A parent or guardian may contact compliance@touchyourworld.com.

We use proportionate technical and organisational measures such as hashed passwords, OTP checks, CSRF protection, secure cookie flags where configured, and access controls. No method of transmission or storage is perfectly secure, and we do not claim absolute security or certifications we do not hold.

TouchYourWorld does not currently make solely automated decisions that produce legal or similarly significant effects about you. Automated security signals (such as reCAPTCHA scores) may help detect abuse and can be reviewed by people where needed.

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to certain processing, to data portability, and to withdraw consent where processing is based on consent.

These rights can be limited by lawful retention requirements and the rights of others - for example, public completed-Story records needed for transparency, or records retained for fraud prevention or legal claims.

To exercise your rights, email compliance@touchyourworld.com.

You can withdraw optional marketing or analytics consent through Cookie Settings.

Please contact compliance@touchyourworld.com first so we can try to help.

You may also complain to the UK Information Commissioner’s Office (ICO) or to your local data-protection authority.

We may update this Privacy Notice from time to time. Material updates will be dated and communicated appropriately.

compliance@touchyourworld.com

See also our Terms of Use, Cookie Notice, Transparency and Contact pages.