Privacy policy

Last updated 10 November 2026

Who we are

Kindly Sent is a trading name of Highfold Group Ltd (company number 17521208, registered in England and Wales). Registered office: Office 21848, 182-184 High Street North, East Ham, London, E6 2JA. The "controller" of the personal data described here ("we", "us") is Highfold Group Ltd. We are registered with the Information Commissioner's Office (ICO) under reference ZC280583.

Questions about your data? Email hello@kindlysent.co.uk. We read every message and we'll get back to you as soon as we can.

What we collect

• Details you give us - your name, email address and password (stored as a secure hash); the cards you make: the name for the card, your message, your sign-off, an optional photo and the colours you chose; the people you send cards to: the name that appears in each card and, if you ask us to email it, their email address. You give us these; we are responsible for them (we are the controller) and use them only to deliver that card; when each card was sent and when it was first opened (recorded once, when they tap Open), so you can see it arrived; a thank you note someone sends back to you; your Date Book: the names, relationships and dates you save (these can include other people's birthdays); your orders and, for a Membership, when it renews.
• Payment details - handled entirely by Stripe. We never see or store your full card number.
• Messages - what you send us by email or through our contact forms.
• Basic usage data - we count page views without cookies. To count unique visitors we use a one-way, daily-changing hash of your IP address and browser; we can't use it to identify you and it resets every day. For each visit we keep the pages viewed, the kind of device, the country (worked out from your IP address, which isn't stored) and whether the visit ended in a purchase, chat or message, for 90 days, without cookies. To leave robots out of our counts we also compare a similar one-way daily code of your IP address between our own websites for up to two days, and for nothing else.
• Security logs - like most websites, our web server and mail server keep logs of each request: your IP address, the date and time, the page or service requested and your browser details (and, for emails, the sender and recipient addresses). We use them only to keep our services secure and working.
• Live chat - the messages you type into our chat assistant and any details you choose to send through it (see Live chat below).

Why we use it, and our lawful basis

Who we share it with

We never sell your data. We share it only with the suppliers below, who help us run Kindly Sent. Suppliers that act for us may use it only on our instructions, under contracts that require them to protect it. Where a supplier also uses data for its own purposes (as the table says), its own privacy policy covers that use.

Some of these suppliers may process data outside the UK (for example in the USA). Where they do, the transfer is protected by UK adequacy regulations (including the UK-US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

How long we keep it

• Cards you send: online for 12 months after sending. Then the card's page says it has been put away, and its message, photo and the email address it went to are deleted. Your history keeps the occasion, the date and a first name.
• Drafts you never sent: deleted 90 days after you last touched them. A card that was due to go and could not (for example while an account was paused) is cancelled after 90 days.
• Date Book entries (names and dates you typed, which may include relatives' birthdays, and a year if you typed one): until you remove them or delete your account. If the card pack or Membership that came with your Date Book ended 12 months ago, we email you and then clear it a month later.
• The stop list: a keyed, scrambled fingerprint of each address that asked for no more cards (never the address itself), kept until that person asks us to lift it, so the request is always honoured. When someone stops cards, their address is also removed from the cards they were already sent.
• Our log of emails sent (the address, the subject line and whether it was delivered): 1 year.
• Account and order data: while you're a customer, then 6 years (UK tax and limitation rules).
• A photo you add to a card is kept with that card and deleted with it (12 months after the card is sent, or sooner if you delete your draft or your account).
• Enquiries that don't lead anywhere: 2 years.
• Emails to and from our hello@kindlysent.co.uk mailbox: deleted from our mail server 2 years after they arrive.
• Our log of the emails we send you (address, subject and whether it was delivered): 1 year.
• Security logs on our servers: 14 days.
• Cookieless page-view and visitor counts: about 13 months (400 days).
• Backups: anything we delete can stay in our backups (nightly copies, plus weekly and monthly encrypted off-site copies) for up to about 3 months, then it's gone.
• Live chat conversations: 180 days after the last message; details you send through the chat, with the recent part of the conversation, are kept like other enquiries.

Live chat

Our website has a chat assistant. It is an automated AI assistant, not a person: it answers questions using Kindly Sent's own web pages and information we've written for it, and it can make mistakes. If it can't help, it can take your details so we can reply to you by email.

• What we keep - the messages you type, the assistant's replies, the page you started the chat on, when it happened, and a one-way hash of your IP address that changes every day (only to stop one connection using up the assistant - we don't use it to identify you). Please don't type card details or sensitive personal information into the chat; card numbers are removed automatically, from the chat and from details you send.
• AI processing - to write its replies, your messages and the relevant parts of our website are sent to Abacus.AI, Inc. in the United States, which acts as our processor under a contract that requires it to protect your data. The transfer is protected by UK adequacy regulations (including the UK-US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
• Details you send us - if you choose to leave your details (for example your name, email address and phone number) they reach us in the same way as a message through our contact form, together with the recent part of your conversation so we know what you asked. We reply by email. Nobody joins the chat itself: the assistant stays automated.
• Why (lawful basis) - legitimate interests (answering questions about our cards), and steps you ask us to take before entering into a contract when you ask us to get back to you.
• How long - chat conversations are deleted 180 days after the last message. If you send your details, they and the recent part of the conversation that goes with them are kept like other enquiries (2 years).
• On your device - once you start a chat, your browser keeps the conversation (in local storage, not a cookie) so it stays open as you move between pages. It's cleared the next time you visit after 24 hours without using it, or straight away when you choose "Start a new chat" or clear this site's data. Once you've sent your details, your browser no longer keeps them.

If someone sent you a card

You did not sign up to anything. Someone with a Kindly Sent account chose a card for you and paid to send it. They gave us the name to put in the card and, if they asked us to email it to you, your email address. We are responsible for those details (in data protection law we are the "controller"), and we use them only to deliver that one card. Kindly Sent is run by Highfold Group Ltd; you can reach us at hello@kindlysent.co.uk.

• Where we got your details: from the person who sent you the card. Their name is on the card and in the email.
• What we hold about you: the name in the card; your email address, only if the card was emailed; when the card was sent and when it was first opened; a few words back if you choose to send them; a report if you make one; and our log of the email we sent you (your address, the subject line and whether it was delivered).
• What the sender can see: that the card was opened and when it was first opened (recorded once, when you tap Open; the sender is told by email unless they have switched that off), and your words back if you send any. Nothing else.
• What we never do: add you to a mailing list, email you about anything other than the card (one email for a card, with no reminders), show you adverts on the card, or sell or share your details. No AI reads the card.
• Our lawful basis: legitimate interests, ours and the sender's, in delivering a personal greeting that someone chose for you, which you can stop at any time.
• How long: a card stays online for 12 months after it is sent. Then its page says it has been put away, and we delete its message, its photo and the email address it went to; the sender's history keeps the occasion, the date and your first name. Our log of the email is kept for 1 year. If an email to you bounces, the bounce message reaches our mailbox and is kept with our other mail for up to 2 years.
• The card's page: a private link that is not listed in search engines, carries no advertising tags and no chat, and is not counted in our visitor statistics.
• Who else handles it: the companies listed under "Who we share it with" on this page (hosting, email delivery and backups), on our instructions and for nothing else.

Your rights. You can ask us for a copy of what we hold about you, to correct it, to delete it sooner or to stop using it, and you can object to our using it at all: email hello@kindlysent.co.uk, or use the stop link below. To complain about how we have used your details, email the same address: we will acknowledge it within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk).

Stopping cards: the stop list

Every card email, and every card's page, has a link that says "Don't send me cards from Kindly Sent". It opens a page with one button, and your mail program's own unsubscribe button does the same in one click. Your address then goes on our stop list, which applies to every sender: nobody can email a card to that address through us, and a sender who tries is told only that the address does not accept cards.

To honour that without keeping your address on a list, we store a keyed, scrambled fingerprint of it (a one-way code), never the address itself, and we remove your address from the cards you were already sent. We keep the fingerprint until you ask us to lift it. A stop made by mistake can be undone on the same page for half an hour; after that, email us from that address and we will take it off.

Your Date Book, and the people in it

If you use the Date Book, we keep the names, relationships and dates you type into it, and a year if you type one. These can include other people's birthdays and anniversaries, and children's. We use them only to send you a reminder a week before each date. We never contact the people in your Date Book, and we do not tell them they are in it, because we have no way to reach them and hold only a name and a date. Every reminder has links to stop reminders for that date or for all of them. Entries are deleted when you remove them or delete your account, and a Date Book that can no longer be used (its card pack or Membership ended 12 months ago) is cleared after we have emailed you.

If you think you are in someone's Date Book and want the entry removed, email us and we will remove it.

Your words and photos

The message you write is shown only on the card's own page; it is never put in an email. A photo you add is resized, has its hidden details (such as where it was taken) removed, is kept with that card and is shown only on that card's page. Only add a photo of other people if they would be happy for it to be shared with the person you are sending it to. Web addresses are removed from messages. An automatic check of the wording (a fixed list of words, not AI) can hold a card for us to look at before it goes, and we look at any card that is reported. Otherwise nobody at Kindly Sent reads your cards, and no AI does.

Children

Accounts are for adults (18 or over). A card may be made for a child and opened by one: the card's page asks a child for nothing, shows no adverts and has no chat. The "few words back" box is optional and goes only to the person who sent the card.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. You can withdraw consent at any time. If you have an account you can delete it yourself from your account page. Email hello@kindlysent.co.uk for anything else - we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Changes

If we make important changes we'll update the date above and, where appropriate, tell you by email.