Privacy policy

Last updated 25 September 2026

This policy explains what personal data Holiday Routes processes when you use holidayroutes.eu and app.holidayroutes.eu, why, who helps us, and what your rights are. We keep it as plain as we can.

1. Who is responsible

The controller of your personal data is Network Consulting & Development SRL (Network Consulting EU), registered with the Romanian Trade Register under no. J2011000342131 (EUID ROONRC.J2011000342131), VAT number RO28040056, with its registered office at Aleea Afinei 14, Constanța, Romania.

For anything about your data, write to hello@holidayroutes.eu.

2. What we collect and why

Data	Why we use it	Legal basis (GDPR)
Account data — email address, password (stored only as a secure hash), name, and optionally country, date of birth, your car and preferences such as language and units	To create and run your account and personalise your trips	Contract (Art. 6(1)(b))
Trip content — your itineraries, notes, and bookings you add to the bookings vault, including attachments	To provide the planner, travel pages, booklets and sharing	Contract (Art. 6(1)(b))
Payment data — plan, billing status and the customer / subscription references from our payment provider. Card details go directly to Stripe; we never see or store them	To sell and manage subscriptions and passes, and keep accounting records	Contract; legal obligation (Art. 6(1)(c))
Security and technical data — IP address, login attempts and times, browser type, and error reports from the app	To keep accounts secure, prevent abuse (rate limiting), and fix bugs	Legitimate interest (Art. 6(1)(f))
Emails you receive — service messages (vouchers, password resets, security notices)	To run the service	Contract (Art. 6(1)(b))
Product news and surveys	To tell you about new features and ask for feedback	Consent (Art. 6(1)(a)) — withdraw any time
Usage statistics — pages visited, device and browser type, approximate location (country / city), via Google Analytics cookies — only if you accept them	To understand how the website and app are used and improve them	Consent (Art. 6(1)(a)) — withdraw any time via "Cookie settings"
Messages you send us — feedback and support requests	To answer and improve the app	Legitimate interest (Art. 6(1)(f))

We do not sell your data, we do not use advertising cookies or trackers, and we do not build advertising profiles.

3. Travel agencies and their clients

When a travel agency uses Holiday Routes to plan trips for its clients, the agency decides what client information goes into those trips and is responsible for it; we process it on the agency's behalf. Agency clients should contact their agency about their data first.

4. Services that help us run Holiday Routes

We use carefully chosen providers. They receive only what they need for their task:

Provider	What for	What they receive
Our hosting in Romania	Servers running the website, app, database and email	All data above
Google Cloud (EU region, Belgium)	Encrypted off-site backups	Database and file backups
Stripe	Payments and subscriptions	Email, payment details you enter at checkout
Google (Gemini API)	AI trip drafts, day ideas and trip photos	The trip details in your request (places, dates, travellers' ages, diet, vehicle) — not your email or name
DeepL	Translating trip text into English, Spanish or French	The trip text being translated
Mapbox, OpenStreetMap (Nominatim and map tiles), OpenCampingMap	Place search, routes, maps and campsites	Place names and coordinates; your IP address when your browser loads maps
Open-Meteo	Weather forecasts	Coordinates of the stops
Google Analytics (Google Ireland Ltd.)	Usage statistics — only after you accept analytics cookies	Pages visited (in the app: the page address without any codes or links in it), device, browser and approximate location; Google does not log or store IP addresses in Google Analytics 4. Advertising features and Google signals are switched off
Google Fonts, unpkg, Unsplash	Fonts, map software and example photos loaded by your browser	Your IP address and browser information

Some providers are based outside the European Economic Area (for example in the United States). Where data leaves the EEA, the transfer is covered by an adequacy decision (such as the EU–U.S. Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.

5. Sharing your trips

Nothing you plan is public unless you share it:

A travel page (short link) shows the trip itself — days, places and photos. It does not include your email, booking codes or attachments. Anyone with the link can view it, so share it with care. Travel pages are not indexed by search engines.
A read-only planner link shows the full trip including its bookings vault, so that travel companions or an agency's client can reach their vouchers. Only send it to people you trust with those details.

6. Cookies and similar technology

Always on (strictly necessary, no consent needed):

a session cookie that keeps you signed in;
browser storage for your sign-in token, language, units and a cached copy of your profile;
an hr_consent cookie that remembers your cookie choice for holidayroutes.eu and app.holidayroutes.eu (6 months);
on the demo account, a small cookie counting AI requests.

Only if you click "Accept": Google Analytics cookies (_ga, _ga_*, up to 2 years) that count visits and show how the website and app are used. Until you accept, the Google Analytics script is not loaded at all. You can change your choice at any time via Cookie settings in the website footer or the app menu; declining removes these cookies.

We use no advertising or social-media tracking cookies. If you install the app on your device, it stores copies of your trips on that device so they work offline; signing out removes them.

7. How long we keep data

Account and trips — while your account exists. When you ask us to delete your account, we delete it and its trips.
Backups — copies are kept for up to 14 days on our servers and up to 90 days off-site, then deleted automatically.
Payment and invoice records — as long as Romanian accounting law requires.
Security and error logs — kept for up to 90 days, then deleted automatically.
Google Analytics data — kept by Google for 14 months, then deleted automatically.

8. Your rights

Under the GDPR you can ask us to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. Write to hello@holidayroutes.eu; we answer within one month.

You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or the authority in your own EU country.

9. Security

Connections are encrypted (HTTPS), passwords are stored only as secure hashes, stored API keys and payment secrets are encrypted, access to trips is limited to their owner and the people they share them with, and we keep automatic backups.

10. Age

Holiday Routes is intended for adults planning trips. You must be at least 16 years old to create an account.

11. Changes

We will update this policy when the app or the law changes, and show the date of the last update at the top. Important changes will be announced by email or in the app.