Privacy Policy

Who we are

HolidayWow is run by Orlero UG (haftungsbeschränkt) i. G., Gutenbergstraße 5, 67227 Frankenthal (Pfalz), Germany, represented by its managing director Shramish Kafle. Email: holidaywow@orlero.com. This notice explains what personal information we process when you use HolidayWow, why, who helps us, and the choices and rights you have.

Hosting and delivery

This website is delivered through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you open a page, Cloudflare processes technically necessary data such as your IP address, the date and time, the page requested and browser information, so the page reaches you securely and quickly.

The databases for accounts and saved trips run on servers of Hetzner Online GmbH in Germany.

Fonts, photos and videos

Fonts, videos and the photos of destinations and places come from our own domain; we do not use Google Fonts. Many photos are from Wikimedia Commons (Wikimedia Foundation, Inc., USA) and Pexels, some from Flickr via Openverse. Our server fetches each photo from its source, keeps a copy in the cache of our host Cloudflare and serves it from there. Your browser loads these photos only from our domain, so your IP address and browser information are not sent to Wikimedia, Pexels or Flickr. Authors and licences are named with every photo.

Trip planner and voice input

When you describe a trip or change one in the planner, we process your text to find matching trips and adapt your plan. For this we use AI services of Anthropic PBC (San Francisco, USA); the content of your request and the trip details it needs are sent to them, never your name or email address. Voice input and read-aloud use the speech features of your browser, so the audio is handled by your browser's maker.

Trips you plan without an account are saved as a draft and linked to your browser with a strictly necessary cookie. When you sign in, the draft moves into your account. If you share a trip by link, anyone with the link can view it but not change it; you can stop sharing at any time.

Travel mode: followers, location and flight status

In travel mode you can create a follower link. Anyone with the link sees, without an account, the plan of the current day, your status, your posts and photos and your first name. Where you stay, prices, bookings, notes and tickets stay private. You can end the link at any time; your posts, photos and positions are then deleted at once. At the latest seven days after your trip ends, we delete the link with all posts and photos automatically.

We share your live location only when you switch it on yourself, confirm it and pick a duration (8 hours, 24 hours or until the end of your trip). The app uses your location for this only while it is open and sends it after a noticeable move; the website only while the page is open. We keep each position for 24 hours at most, delete all positions as soon as you stop sharing or the duration ends, and sharing switches itself off no later than 12 hours after the last day of your trip. We record when you switched it on and off, as proof of your consent, for as long as the link exists. You can withdraw your consent at any time by stopping the sharing.

Followers with the app can turn on notifications for new posts; we then store which account follows which link until the link ends. For the live flight status, our server sends the flight number and date from your ticket to a flight data provider, never your name or other details.

Maps, place search and weather

The map loads tiles, terrain, fonts and the MapLibre library from our own servers. Only if our map cannot load does your browser fetch tiles from OpenFreeMap (openfreemap.org) instead, sending your IP address and browser information. For the place search, our server sends the search term to Photon by komoot GmbH (Germany), without your IP address. Weather forecasts come from MET Norway; only the coordinates of the destination are sent.

Your account

If you create an account, we store your email address, name, an encrypted password, and your trips and preferences. If you sign in with Google or Apple, we receive your name and email address (and, from Google, your profile photo). Emails to confirm your address or reset your password are sent through Resend, Inc. (USA), using servers in the EU. You can delete your account and export your data at any time in the settings.

Reviews, photos, comments and saved places

If you review a trip, we store the stars, text, tip, the place and the date with your account. Uploaded photos are stored with Cloudflare and shown publicly only after a check. Only your first name appears next to your posts. Comments and votes on a shared trip are visible to everyone with the trip's link. Your saved places are private. Reports of content are stored with the reason so we can handle them and explain our decision.

Newsletter

If you sign up, we store your email address, language, market and, if you choose one, your state. We always send a confirmation email first and add you to the list only after you confirm (double opt-in).

Every email carries our postal address and a one-click unsubscribe link (CAN-SPAM).

As proof of your consent we store the wording you agreed to, the time, a hash of your IP address (not the address itself), your language and your market. You can unsubscribe with one click in every email; it takes effect immediately. We see which links in our emails are clicked, so the newsletter fits you better.

Partner links

Some links lead to partners for stays, flights, tours, car hire or ferries. These links are labelled "Ad". If you book through them, we may earn a commission; your price stays the same. When you click, we pass the partner an identifier for the commission, never data from your account. The partner's own privacy policy applies on its site. Links to Orlero (connections) and Orbislo (eSIM) lead to offers of the same company that runs HolidayWow.

Search engines

When we publish or substantially change pages, we report their addresses to search engines such as Microsoft Bing through the IndexNow protocol. Only page addresses are sent, no personal information.

Cookies

We use strictly necessary cookies only: to keep you signed in and to link a draft trip to your browser. We use no tracking or advertising cookies and no analytics services. Details are on our cookies page.

Your California privacy rights (CCPA/CPRA)

In the last 12 months we collected these categories of personal information: identifiers (name, email address, IP address, account ID); internet or other electronic network activity (pages requested, browser information, links clicked in our emails); approximate geolocation derived from your IP address or a place you entered; customer records you give us (trips, preferences, reviews, photos); and inferences about travel preferences drawn from your answers.

Sources: you directly, your browser or device, and Google or Apple if you sign in with them.

Purposes: providing and securing the planner and your account, sending the emails you ask for, showing partner offers, preventing abuse, and meeting legal obligations.

We disclose personal information for business purposes only to the service providers named in this policy, under contracts that limit its use.

We do not use or disclose sensitive personal information for purposes that would give you the right to limit it.

We do not sell or share personal information

We do not sell your personal information and we do not share it for cross-context behavioural advertising. We have not done so in the last 12 months, and we do not knowingly collect personal information of anyone under 16.

Do not sell or share my personal information

Because we neither sell nor share personal information, there is nothing to switch off. If you still want to record an opt-out, email holidaywow@orlero.com with the subject "Do not sell or share", and we will apply it to your account and email address. We honour Global Privacy Control signals sent by your browser as an opt-out.

Your rights and how to use them

You have the right to know what personal information we collect, use and disclose; to access it; to delete it; to correct it; to opt out of sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights. Email holidaywow@orlero.com.

To protect your data, we verify your request by asking you to confirm it from the email address of your account or subscription. You can let an authorised agent make a request for you; we will ask the agent for your signed permission and may ask you to confirm your identity directly.

We answer within 45 days.

Privacy rights in other states

Residents of other states with consumer privacy laws (for example Colorado, Connecticut, Virginia, Texas and Oregon) have similar rights to access, correct, delete and opt out. Email holidaywow@orlero.com. If we decline a request, you can appeal by replying to our answer; if the appeal is declined, you can contact the attorney general of your state.

International transfers

We are based in Germany and our main servers are in Germany. Some providers named above are based in the USA (Cloudflare, Anthropic, Resend, Google, Apple). Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on standard contractual clauses.

How long we keep data

We keep data only as long as the purpose needs it or the law requires. Account data stays until you delete your account. Newsletter consent proof is kept for three years after your subscription ends. Our send log and email events are deleted after 13 months. Travel mode positions are kept for 24 hours at most and deleted when sharing stops; follower links with their posts and photos are deleted seven days after the trip.