Privacy Policy

GotMyNumber is run by Towpath Digital Ltd, registered in England and Wales (company no. 16913912). We are the data controller for personal data processed through gotmynumber.co.uk. Towpath Digital Ltd was called Central Contacts Ltd until 13 April 2026; it is the same company, so nothing about who holds your data has changed.

We are registered with the Information Commissioner's Office, registration number ZC210106.

Privacy contact: privacy@gotmynumber.co.uk. We have not appointed a Data Protection Officer; this address reaches the people who run the site.

Looking up a number. We record the number you looked up, when, the page that sent you to us (if your browser tells us), your browser type, and a one-way hash of your IP address made with a secret key. We never store the IP address itself, and we delete the hash after 31 days. The hash lets us count how many different people looked a number up, rather than how many times a page loaded, which is how we decide whether a number's page is shown to search engines. We also use lookups to understand how people find the site, and we count how many different people use it each day from the same hash, only as daily totals. You do not need an account.

Sharing GotMyNumber. When you press the Share GotMyNumber button, your browser sends our own server a short note as it goes. We record which link it was (the Share button), where it sat on the page, when you clicked, whether your browser type looks automated, and the same one-way hash of your IP address that lookups use, deleted after 31 days. The Share button shares the address of GotMyNumber, never the number you looked up, and we cannot see whether you sent it or to whom. Nothing is stored in your browser. Until 18 October 2026 we also counted clicks on links to other Towpath Digital sites in the same way; those links are gone, and the records already made are kept and deleted as section 6 says.

Buying us a coffee. The “Buy us a coffee” link on a number page opens Ko-fi, a third-party tipping service, in a new tab. We deliberately send Ko-fi no referrer, so it is never told which page you came from — and a number page’s address is the number you looked up. We count that the link was pressed in the same way as the links above: which link, where it sat on the page, when, whether your browser type looks automated, and the same one-way hash of your IP address, deleted after 31 days. If you choose to tip, everything after that happens on Ko-fi under Ko-fi’s own privacy policy: we never see your card details, and we see your name or message only if you give one there.

Checking for a verified business. When you open a number's page, your browser asks the Towpath Hub, our central business directory, whether a verified business has registered that number. Only the number is sent.

Reporting a number. We store the number, the type of report, what you wrote, the date of the call if you give it, and two one-way hashes made with a secret key: one of your IP address, and one of the wider network it belongs to. We never store the address itself. The first lets us count how many different people have reported a number; the second stops one person using two addresses on the same network from counting as two people. We do not ask for your name or email to make a report.

Creating an account. Your email address, and your name if you give it. Your password is handled by our database provider's sign-in service and we never see it.

Joining a waitlist. Your email address and which feature you asked about. On the claim your number waitlist we also ask two optional questions: which situation you are in (it is your number, or your number has been reported and it was not you) and which number you mean. Both can be left blank and the waitlist works without them. We ask because those are two different problems and we cannot tell them apart otherwise. The number is kept so we can see whether it has been reported; it is never shown on a number’s page or anywhere else public. All of it is deleted together with your email address once we have emailed you.

Asking for a quote for a business list check. What you type into the quote form on the business list checks page: your name, email address, company if you give it, the size of your list and your message, with the time you sent it. We use it to reply and to prepare your quote. It is kept in a file on the server that runs this website, in the UK, not in our database, and we do not store your IP address with it. When a request arrives, the people who run the site get an email saying a request is waiting; that email gives the list size and when it was sent, not your name or contact details.

Claiming a number you own. This is not open yet. When it opens it will use Towpath Digital's central verification service: we will send a one-time code by text message to prove the number is yours, and the record of that check will hold a one-way hash of the number, not the number itself. We will update this policy before it opens.

When an advert loads. Google places adverts on this site. When one loads, your browser asks Google for it, so Google receives your IP address, your browser details and the address of the page you are on, as it does on any site with Google adverts. Google uses cookies to choose and measure adverts only if you agree (section 7). We do not send Google the number you looked up, and we receive nothing about you from Google except totals for the site.

Measuring visits with Google Analytics, only if you agree. If you say yes to analytics in Google’s consent message, we use Google Analytics to count visits and see which pages are used and how people arrive, and to see which pages pay for the site through adverts. Google is told the kind of page and a cut-down address: a number page is reported only by its area code (for example “01480”) or, for a mobile or other number, its first four digits, never the full number; the page title on a number page is replaced, and on other pages any long run of digits is cut to four. Google is never told what you typed into a search box, which page of another site you came from, or anything about pages in a signed-in account. Google also receives your IP address and browser details when the measurement is sent, as with any website. Google signals and advertising personalisation are switched off for our Analytics. If you say no, or your browser sends Global Privacy Control, Google Analytics is not loaded at all and nothing is sent to it.

What we never collect: payment card details (we do not take payments on this website), your contacts, your call history, or your location.

A phone number can be personal data, for example a personal mobile. You have rights over it even though you have never used this site.

Reports are about calls and messages, not about people. Our terms forbid names, addresses and other personal details in a report, and we remove reports that include them. Each report is shown as one person's account, which we have not checked, and the Community score measures how widely a number has been reported, not whether it is dangerous.

We rely on legitimate interests to publish reports. We have weighed the value of warnings about unwanted and scam calls against the effect on the person using the number, and that is why reports are limited to what happened on the call and are open to challenge.

To object to, correct or remove a report, email privacy@gotmynumber.co.uk with the number and the report you mean. If you are asking about a number you say is yours, we may ask you to show that it is. We will reply within one month. If we decide to keep a report, we will tell you why, and you can complain to the ICO.

We do not sell personal data, and we do not pass what we hold to advertisers. These providers process it on our behalf, under contract:

Google, for advertising. Google serves the adverts on this site as a separate controller, not on our behalf: it decides what it collects when an advert loads and what it does with it. How Google uses information from sites that show its adverts is set out at policies.google.com/technologies/partner-sites.

Transfers outside the UK. Our data is stored in the UK. Cloudflare's network handles connections from wherever you are, so connection data can pass through its servers outside the UK; its data processing addendum sets out the safeguards it applies. Google Analytics data can be processed outside the UK, including in the US, under Google’s data processing terms. If we add a provider, such as a text-message provider when claiming opens, we will add it here first.

Visit counting is switched off. We used to count visits with Porthole, Towpath Digital's own visit counter, without asking first. We have stopped: anything it sends is now discarded, not stored. Until the last part of it is removed from our network, a page may still place a random ID in your browser's local storage; it is not linked to you and nothing it sends is kept. You can clear it by clearing this site's data in your browser.

Signing in. If you sign in, your browser keeps your sign-in session in its local storage, which is needed for signing in to work. In the account dashboard, a cookie remembers whether the side menu is open or closed.

Team browsers. The people who run GotMyNumber can mark their own browsers so that their visits are left out of our counts. That sets a cookie called gmn_team, for a year, from a page only they can open. Visitors never receive it.

Google advertising cookies. Set by Google, and only if you agree in its consent message: they help choose adverts and measure them. Google lists them and how long each lasts at policies.google.com/technologies/cookies. If you do not agree, Google may still show adverts that use no cookies. Your answer itself is stored by the consent message so it is not asked again. Change it at any time with “Your advert choices” at the foot of any page, or below.

Google Analytics. Only if you say yes to analytics in Google’s consent message: Google Analytics sets two cookies, _ga and _ga_95TCE2TQX8, which recognise this browser on later visits for up to 2 years. Change your answer at any time with “Your advert choices”; after a no, Analytics is not loaded on the next page. To remove the cookies, or the visit-counting ID above, clear this site’s data in your browser settings.

Your advert choices

You can ask for a copy of your data, and ask us to correct it, delete it, restrict what we do with it, move it, or stop using it (objection). Where we rely on consent, you can withdraw it at any time.

To change your answer about advertising cookies or Google Analytics, use “Your advert choices” at the foot of any page. To stop adverts being chosen for you anywhere Google shows them, use Google’s My Ad Center.

Email privacy@gotmynumber.co.uk. We will reply within one month. That covers anything held about you in the Towpath Hub as well.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to put it right first.

Connections to the site are encrypted (HTTPS). Database access is restricted by row-level security, so the public site can read only what it is meant to show. We keep one-way hashes of IP addresses, never the addresses themselves, and delete the hash kept with a lookup after 31 days. More on the security page.

Privacy contact
Towpath Digital Ltd
Email: privacy@gotmynumber.co.uk
Registered in England and Wales, company no. 16913912
ICO registration ZC210106