Privacy policy

Who this covers

The advisor who signs in and connects their mailbox is our user. Their travellers and suppliers do not have Holidr accounts, but their details appear in the mail Holidr reads, so this policy covers them too.

Google account data we access

Signing in with Google is both your login and how you connect your inbox. We request only the scopes the product needs:

• Your name, email address and profile (openid, email, profile) to create and identify your account.
• Reading your Gmail (gmail.readonly) to assemble your trips, file each message on the right one, read attachments, and draft replies.
• Sending mail as you (gmail.send) only when you approve a draft. Holidr never sends on its own.

We ask for nothing beyond these. We do not request access to your contacts, calendar, drive, or any other Google service.

How we use it

Gmail content is used solely to provide Holidr's features to you: sorting mail onto trips, reading invoices and documents, drafting replies and supplier chases for your approval, tracking commissions, and searching your own trips. Everything Holidr sends goes from your own address, under your name, and only after you approve it.

The Google Limited Use disclosure

Holidr's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, we use your Gmail data only to provide and improve the user-facing features described above. We do not use it for advertising, we do not sell it or transfer it to data brokers, we do not use it for creditworthiness or lending purposes, and we do not use it to develop, improve or train generalised or non-personalised AI or machine learning models. Humans at Holidr do not read your mail except where you ask us to for support, where it is necessary for security, or where the law requires it.

Where it is stored, and who else sees it

Your mail, trips, documents and settings are stored with our cloud infrastructure provider. Your Google refresh token is encrypted at rest and is only ever used to sync and send your mail.

To draft replies and understand documents, the relevant text is sent to our AI model provider for that single purpose. That provider processes the text to generate a draft and does not use it to train its models. Property searches may query the travel sites you have chosen as your sources. We do not otherwise share your data, and we never sell it. If you want the names of the providers we use, ask at privacy@holidr.com and we will tell you.

When something in Holidr fails, technical details of the error are sent to Sentry, our error-diagnostics provider, hosted in the EU, so we are told about the fault and can fix it. Sentry receives only technical details: what kind of error happened, where in Holidr's code it happened, and internal reference numbers that let us find the affected record ourselves. It never receives the content of your email or attachments, anything you type, names or email addresses, or payment card details.

Payment cards

Holidr does not keep payment card details. When a card number, its security code or its expiry date turns up in an email, an attachment, a file a supplier sends through their link, or something you type, Holidr removes those details before storing anything, keeps the rest, and tells you it did. A document or photo that contained card details, or that Holidr could not read well enough to check, is not stored at all; an email attachment stays in your own Gmail. Files are checked using our hosting provider's own tools, and card details are removed before any text reaches our AI model provider or goes out in an email Holidr sends.

The email demo

Anyone can email a holiday request to try@holidr.com (or a try+ address we use for a campaign) to see what Holidr does with it. We use that email only to build a demo board from it and to reply to the person who sent it. Card numbers, security codes and expiry dates are blanked out the moment it arrives, before anything is stored. Like the rest of Holidr, it passes through the providers described above (our hosting, our AI model provider and the travel sites searched for the trip), and nothing is shared or sold.

We keep the sender's address, the date of the request and the campaign it came through, so we can follow up about Holidr. Every reply and every follow-up has a link to stop; if you use it we keep only a scrambled copy of the address, so it stays off our list. The demo board, the email and the reply Holidr drafted are deleted after 48 hours.

Some email services do not sign who a message was sent to. Then we first email the sender a link to confirm the request, and nothing is built and no address is kept for follow-up until they do. A request that is not confirmed is deleted after 24 hours.

How we protect it

Gmail content is sensitive, so here is specifically what protects it rather than a promise that we take security seriously.

• Encrypted in transit. Every connection to Holidr uses HTTPS with a minimum of TLS 1.2, with HSTS enforced so a browser will not fall back to an unencrypted connection.
• Credentials encrypted at rest. Your Google refresh token is encrypted with AES-256-GCM before it is stored. The encryption key is held separately as a deployment secret, never in the database beside the data it protects.
• Your data is reachable only from your account. Every database query, document download and page is scoped to the signed-in advisor. A request for another advisor's trip, message or attachment returns the same "not found" response as a request for something that does not exist.
• Sessions are signed and revocable. Session cookies are cryptographically signed and carry a version number, so signing out invalidates every existing session on every device immediately.
• Independently assessed. Holidr passed a CASA (Cloud Application Security Assessment) Assurance Level 1 assessment with an accredited third-party assessor in September 2026, covering authentication, data handling, encryption, input validation and dependency management.
• Tested for vulnerabilities. We run automated dynamic security scanning against the live application and fix what it finds. The most recent baseline scan returned no failures.
• No third-party tracking. Holidr loads no advertising or analytics scripts. Fonts and assets are served from our own domain, so your use of the product is not visible to anyone else.
• Restricted human access. Nobody at Holidr reads your mail except where you ask us to for support, where it is necessary for security, or where the law requires it. Access to production systems is limited to the operator of the service.
• Deletable on demand. The Danger zone in Settings permanently erases every trip, message, document, booking and setting we hold and revokes our access to your Google account, in one action.

If you believe you have found a security problem in Holidr, please write to privacy@holidr.com and we will respond.

Keeping it, and deleting it

Holidr keeps your data for as long as your account is open, because the product is your working record of live trips. You can erase everything yourself at any time: Settings has a "Danger zone" that disconnects Gmail, revokes Holidr's access to your Google account, and permanently deletes every trip, message, document, booking and setting we hold. This cannot be undone. You can also revoke Holidr's access directly from your Google account permissions.

Changes and contact

If this policy changes in a way that affects how we handle your data, we will say so on this page and update the date above. Questions about your data, or a request to delete it on your behalf, go to privacy@holidr.com.