Privacy Notice

Who we are

HolidayWow is run by Orlero UG (haftungsbeschränkt) i. G., Gutenbergstraße 5, 67227 Frankenthal (Pfalz), Germany, represented by its managing director Shramish Kafle. Email: holidaywow@orlero.com. This notice explains what personal information we process when you use HolidayWow, why, who helps us, and the choices and rights you have.

Hosting and delivery

This website is delivered through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you open a page, Cloudflare processes technically necessary data such as your IP address, the date and time, the page requested and browser information, so the page reaches you securely and quickly.

The databases for accounts and saved trips run on servers of Hetzner Online GmbH in Germany.

Fonts, photos and videos

Fonts, videos and the photos of destinations and places come from our own domain; we do not use Google Fonts. Many photos are from Wikimedia Commons (Wikimedia Foundation, Inc., USA) and Pexels, some from Flickr via Openverse. Our server fetches each photo from its source, keeps a copy in the cache of our host Cloudflare and serves it from there. Your browser loads these photos only from our domain, so your IP address and browser information are not sent to Wikimedia, Pexels or Flickr. Authors and licences are named with every photo.

Trip planner and voice input

When you describe a trip or change one in the planner, we process your text to find matching trips and adapt your plan. For this we use AI services of Anthropic PBC (San Francisco, USA); the content of your request and the trip details it needs are sent to them, never your name or email address. Voice input and read-aloud use the speech features of your browser, so the audio is handled by your browser's maker.

Trips you plan without an account are saved as a draft and linked to your browser with a strictly necessary cookie. When you sign in, the draft moves into your account. If you share a trip by link, anyone with the link can view it but not change it; you can stop sharing at any time.

Travel mode: followers, location and flight status

In travel mode you can create a follower link. Anyone with the link sees, without an account, the plan of the current day, your status, your posts and photos and your first name. Where you stay, prices, bookings, notes and tickets stay private. You can end the link at any time; your posts, photos and positions are then deleted at once. At the latest seven days after your trip ends, we delete the link with all posts and photos automatically.

We share your live location only when you switch it on yourself, confirm it and pick a duration (8 hours, 24 hours or until the end of your trip). The app uses your location for this only while it is open and sends it after a noticeable move; the website only while the page is open. We keep each position for 24 hours at most, delete all positions as soon as you stop sharing or the duration ends, and sharing switches itself off no later than 12 hours after the last day of your trip. We record when you switched it on and off, as proof of your consent, for as long as the link exists. You can withdraw your consent at any time by stopping the sharing.

Followers with the app can turn on notifications for new posts; we then store which account follows which link until the link ends. For the live flight status, our server sends the flight number and date from your ticket to a flight data provider, never your name or other details.

Maps, place search and weather

The map loads tiles, terrain, fonts and the MapLibre library from our own servers. Only if our map cannot load does your browser fetch tiles from OpenFreeMap (openfreemap.org) instead, sending your IP address and browser information. For the place search, our server sends the search term to Photon by komoot GmbH (Germany), without your IP address. Weather forecasts come from MET Norway; only the coordinates of the destination are sent.

Your account

If you create an account, we store your email address, name, an encrypted password, and your trips and preferences. If you sign in with Google or Apple, we receive your name and email address (and, from Google, your profile photo). Emails to confirm your address or reset your password are sent through Resend, Inc. (USA), using servers in the EU. You can delete your account and export your data at any time in the settings.

Reviews, photos, comments and saved places

If you review a trip, we store the stars, text, tip, the place and the date with your account. Uploaded photos are stored with Cloudflare and shown publicly only after a check. Only your first name appears next to your posts. Comments and votes on a shared trip are visible to everyone with the trip's link. Your saved places are private. Reports of content are stored with the reason so we can handle them and explain our decision.

Newsletter

If you sign up, we store your email address, language, market and, if you choose one, your state or territory. We always send a confirmation email first and add you to the list only after you confirm (double opt-in).

We send marketing email only with your consent; every email identifies us as the sender and carries a working unsubscribe link (Spam Act 2003).

As proof of your consent we store the wording you agreed to, the time, a hash of your IP address (not the address itself), your language and your market. You can unsubscribe with one click in every email; it takes effect immediately. We see which links in our emails are clicked, so the newsletter fits you better.

Partner links

Some links lead to partners for stays, flights, tours, car hire or ferries. These links are labelled "Ad". If you book through them, we may earn a commission; your price stays the same. When you click, we pass the partner an identifier for the commission, never data from your account. The partner's own privacy policy applies on its site. Links to Orlero (connections) and Orbislo (eSIM) lead to offers of the same company that runs HolidayWow.

Search engines

When we publish or substantially change pages, we report their addresses to search engines such as Microsoft Bing through the IndexNow protocol. Only page addresses are sent, no personal information.

Cookies

We use strictly necessary cookies only: to keep you signed in and to link a draft trip to your browser. We use no tracking or advertising cookies and no analytics services. Details are on our cookies page.

Australian Privacy Principles

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect it directly from you, for the purposes described here, and use it only for those purposes or ones you would reasonably expect.

Disclosure overseas (APP 8)

We are based in Germany. Your personal information is held in Germany and disclosed to service providers in the USA, named above, so they can run parts of the service for us.

Access, correction and complaints

You can ask to access and correct the personal information we hold about you. Email holidaywow@orlero.com. If you have a complaint, please contact us first; we answer within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC), oaic.gov.au.

International transfers

We are based in Germany and our main servers are in Germany. Some providers named above are based in the USA (Cloudflare, Anthropic, Resend, Google, Apple). Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on standard contractual clauses.

How long we keep data

We keep data only as long as the purpose needs it or the law requires. Account data stays until you delete your account. Newsletter consent proof is kept for three years after your subscription ends. Our send log and email events are deleted after 13 months. Travel mode positions are kept for 24 hours at most and deleted when sharing stops; follower links with their posts and photos are deleted seven days after the trip.