Privacy Policy

1. Who we are

HoliDNA Ltd is the data controller for personal data processed through HoliDNA. We are a company registered in England and Wales. You can reach us at talktous@holidna.app.

2. What we collect

We collect only what we need to run HoliDNA:

• Account details — your email address, display name and password (stored as a one-way hash). If you sign in with Apple or Google we receive a unique account identifier and, with your permission, your name and email.
• Your holiDNA — the swipes (love / pass / must-visit) you make on destinations and experiences, and the travel-trait profile we derive from them.
• Saved items — destinations, holidays, collections and trip plans you save, plus your budget and filter preferences.
• Price alerts — the holidays you choose to watch and their price history, so we can tell you when a price drops.
• Device push token — only if you enable notifications, so we can deliver price-drop alerts to your device.
• Subscription status — whether your trial or membership is active. Payments are handled by Apple, Google or Stripe; we never see or store your card details.
• Optional profile photo — if you add one from your camera roll.
• Technical data — standard server logs (such as request timestamps and app version) needed to keep the app secure and working. We don't use crash-reporting or analytics SDKs in the app.

3. How we use your data

• To create and secure your account and let you sign in.
• To personalise your destination feed, matches and Daily picks based on your holiDNA.
• To generate AI trip plans you request. We send your travel preferences and chosen destination to our AI provider — never your name, email or account identifiers.
• To find real holiday packages and imagery from third-party sources for destinations you're interested in.
• To send price-drop alerts (in-app and, if enabled, push notifications) for holidays you watch.
• To manage your free trial and subscription, and to honour purchases you restore.
• To send essential account emails such as password-reset links. We do not send marketing email without your consent.
• To keep HoliDNA safe, prevent abuse and fix bugs.

4. Legal bases (UK GDPR)

• Performance of a contract — providing the app, your account and your subscription.
• Consent — push notifications, camera-roll access for a profile photo and any optional features you switch on. You can withdraw consent at any time in your device settings or in the app.
• Legitimate interests — improving and securing HoliDNA, in ways you would reasonably expect and that don't override your rights.
• Legal obligation — keeping records we are required to keep, e.g. for tax and accounting.

5. Who we share data with

We don't sell your personal data. We share it only with service providers who help us run HoliDNA, under contracts that protect it:

• Apple and Google — sign-in and in-app subscriptions.
• RevenueCat — manages subscription entitlements across app stores.
• Stripe — payment processing for web subscriptions.
• AI providers (e.g. Anthropic, OpenAI, Google) — trip-plan generation from your anonymised preferences.
• Unsplash and Brave Search — destination imagery and live holiday listings.
• Email and push-notification delivery providers — password-reset emails and price-drop alerts.
• Cloud hosting and database providers that store and serve the app.

Holiday packages shown in HoliDNA are provided and sold by third-party travel operators. When you tap through to book, you leave HoliDNA and the operator's own privacy policy applies.

We may also disclose data where required by law or to protect our rights, users or the public.

6. International transfers

Some of our providers are based outside the UK, including in the United States. Where data leaves the UK we rely on safeguards recognised under UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep data

• Account and holiDNA data — for as long as your account exists.
• If you delete your account (Profile → Delete account) we erase your profile, swipes, saved items and price alerts within 30 days, except records we must keep for legal or accounting reasons.
• Price-alert history — deleted when you stop watching a holiday or delete your account.
• Server logs — typically kept for no more than 90 days.

8. Your rights

Under UK data-protection law you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data — you can edit your name and photo in Profile.
• Delete your data — use Delete account in Profile, or email us.
• Object to or restrict certain processing, and withdraw consent at any time.
• Receive a portable copy of your data.
• Complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we handle your data. We'd appreciate the chance to help first — email us at talktous@holidna.app.

9. Children

HoliDNA is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, please contact us and we will delete it.

10. Security

We protect your data with encryption in transit (HTTPS), hashed passwords, access controls and regular reviews. No system is perfectly secure, so please use a strong, unique password and keep your device up to date.

11. Changes to this policy

We'll post any changes here and update the date at the top. For significant changes we'll also let you know in the app.

12. Contact

Questions or requests about your data: talktous@holidna.app.