Privacy policy

Last updated 10 October 2026

Who we are

Whole Class is a Highfold Group brand. Address: Office 10125, 321-323 High Road, Chadwell Heath, Essex RM6 6AX, United Kingdom. The "controller" of the personal data described here ("we", "us") is Highfold Group.

Questions about your data? Email hello@wholeclass.co.uk. We read every message and we'll get back to you as soon as we can.

Hosts and guests

A host is the parent or carer who makes an invitation. A guest is anyone who replies to it. For hosts' accounts and payments, we are the controller. For the replies guests send to a host, we act on the host's behalf to deliver the replies and party messages, and we also take responsibility as a controller for keeping that data secure and for deleting it on schedule.

What we collect

• Details you give us - hosts: your name, email address, an optional mobile number and the party details you enter; guests replying to an invitation: the child's first name, your name, your reply, siblings coming, whether you're staying, any allergy or dietary information you choose to share (with your explicit consent), an optional email address or mobile number, and any note to the host.
• Payment details - handled entirely by Stripe. We never see or store your card number.
• Messages - what you send us by email or through our contact form.
• Basic usage data - we count page views without cookies, using a one-way, daily-changing hash of your IP address and browser that can't identify you.
• Security logs - like most websites, our web server and mail server keep logs of each request: your IP address, the date and time, the page or service requested and your browser details (and, for emails, the sender and recipient addresses). We use them only to keep our services secure and working.
• Live chat - the messages you type into the chat assistant on our website and any details you choose to send through it (see Live chat below).

Allergy and dietary information

Allergy and some dietary information (for example "halal" or "vegan") can reveal health or religious information, which UK GDPR treats as special category data. We only store it when a guest chooses to share it and ticks a box giving their explicit consent (UK GDPR Article 9(2)(a)) so the host can keep children safe. It's visible only to the host, never to other guests, and it's deleted with the rest of the reply 60 days after the party. You can withdraw consent at any time by editing your reply or emailing us.

Children

Whole Class is used by parents and carers, not children. We collect only a child's first name (and age, if the host adds it) as part of an invitation or reply.

Why we use it, and our lawful basis

We never use guests' details to market Whole Class to them.

Who we share it with

We never sell your data. A guest's reply is shared with the host of that party. We also use the suppliers below, who help us run Whole Class. Suppliers that act for us may use it only on our instructions, under contracts that require them to protect it. Where a supplier also uses data for its own purposes (as the table says), its own privacy policy covers that use.

Some of these suppliers may process data outside the UK (for example in the USA). Where they do, the transfer is protected by UK adequacy regulations (including the UK–US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

How long we keep it

• Guests' replies (names, answers, allergies, contact details, notes): deleted automatically 60 days after the party. We keep only anonymous totals (for example "14 coming").
• Invitations: while the host's account exists, minus the venue address, host's mobile and message, which we remove 60 days after the party. Hosts can delete a party or their whole account at any time.
• Unsaved draft invitations: deleted after 7 days.
• Your account: until you delete it (you can do this yourself from your account page).
• Payment records: 6 years, for UK tax rules.
• Messages to us: 2 years.
• Emails to and from our hello@wholeclass.co.uk mailbox: deleted from our mail server 2 years after they arrive.
• Our log of the emails and texts we send (address, subject and whether it was delivered): 1 year, except that the lines addressed to a party's guests are deleted with their replies, 60 days after the party.
• Security logs on our servers: 14 days.
• Cookieless page-view and visitor counts: about 13 months (400 days).
• Backups: anything we delete stays in our nightly backups for up to 14 days, then it's gone.
• Live chat conversations: 180 days after the last message; details you send through the chat, with the recent part of the conversation, are kept like other messages to us.

Live chat

Our website has a chat assistant. It is an automated AI assistant, not a person: it answers questions using Whole Class's own web pages and information we've written for it, and it can make mistakes. If it can't help, it can take your details so our team can reply to you by email.

• What we keep - the messages you type, the assistant's replies, the page you started the chat on, when it happened, and a one-way hash of your IP address that changes every day (only to stop one connection using up the assistant - we don't use it to identify you). Please don't type card details or sensitive personal information into the chat; card numbers are removed automatically, from the chat and from details you send.
• AI processing - to write its replies, your messages and the relevant parts of our website are sent to Abacus.AI, Inc. in the United States, which acts as our processor under a contract that requires it to protect your data. The transfer is protected by UK adequacy regulations (including the UK–US data bridge), or the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
• Details you send us - if you choose to leave your details (for example your name, email address and phone number) they reach the Whole Class team in the same way as a message through our contact form, together with the recent part of your conversation (so the team has the context), we email you to confirm we've got them, and we reply by email. Nobody from the team joins the chat itself.
• Why (lawful basis) - legitimate interests (answering questions about our products), and steps you ask us to take before entering into a contract when you ask us to get back to you.
• How long - chat conversations are deleted 180 days after the last message. If you send your details, they and the recent part of the conversation that goes with them are kept like other enquiries (2 years).
• On your device - once you start a chat, your browser keeps the conversation (in local storage, not a cookie) so it stays open as you move between pages. It's cleared the next time you visit after 24 hours without using it, or straight away when you choose "Start a new chat" or clear this site's data. Once you've sent your details, your browser no longer keeps them.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Guests can change or remove a reply using the link in their confirmation email, from the same phone, or by asking the host or us. Hosts can delete parties and their account themselves. Email hello@wholeclass.co.uk for anything else and we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Changes

If we make important changes we'll update the date above and, where appropriate, tell hosts by email.