HolidAILast updated: 26 September 2026
This policy explains what personal data the HolidAI iPhone app and this website collect, how we use it, who we share it with, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who we are
HolidAI is provided by Gareth Tuvnes, a sole trader trading as Cre-aTuv Media, based in the United Kingdom (“we”, “us”, “our”). We are the controller of the personal data described in this policy. You can contact us about anything in this policy at creatuvmedia@gmail.com.
2. What we collect, why, and our lawful bases
You can search for stays, open the map of stays and use Ask Holid-Ai without an account. You need an account to save favourite destinations and trips and to use your profile.
| Data | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|
| Account details: your email address, your name (if you give it) and your password. Passwords are handled by Firebase Authentication and stored in hashed form; we never see them. If you use Sign in with Apple, we receive an Apple account identifier and the name and email address you choose to share, which may be an Apple “Hide My Email” relay address. | To create and secure your account, sign you in and show your name in the app. | Contract: we need it to provide your account (Article 6(1)(b)). |
| Profile photo (optional): a photo you choose to add to your profile, stored as a small 512×512 image. | To show your photo in your profile and menu. Only you can see it. | Contract. |
| Favourites: the destinations you save (the destination’s name, for example “Lisbon, Portugal”, and when you saved it). | To keep your favourites in your account and in sync across your devices. | Contract. |
| Saved trips you add with “Save this trip”: the destination, your dates, the number of adults and when you saved it. (Accounts from earlier test versions may also hold booking requests for example stays.) | To show your trips in “My Trips” so you can come back to them. | Contract. |
| Reviews linked to your account, if any. | To show reviews you have left and reviews about you on your profile. | Contract. |
| Messages you send to the AI assistant: your questions, any preference chips you select (for example “Pool” or “Beach”) and the last few messages of the same conversation. | To generate a reply. See section 3. | Contract (providing the feature you asked for). |
| App integrity checks: Firebase App Check uses Apple’s App Attest service to confirm that requests come from a genuine copy of the HolidAI app on a genuine Apple device. | To protect our services and your account from abuse, fraud and automated attacks. | Legitimate interests: keeping HolidAI secure (Article 6(1)(f)). |
| Technical logs: for example the time of a request, error details and IP address, recorded by our cloud provider when the app or this website contacts our servers. | To run, secure and fix the service. | Legitimate interests. |
| Emails you send us. | To reply and help you, and to handle requests about your data. | Legitimate interests; legal obligation where the email is a data protection request (Article 6(1)(c)). |
Stay searches: when you tap “See stays” or open the “Map of stays”, the destination, dates and number of adults you chose go to Stay22 in the link or map request (see section 5), together with our affiliate ID and the name of the app screen. We do not store these searches unless you save a trip, and we do not send Stay22 your name, email address or account ID.
A copy of your favourites and your profile photo is also kept on your iPhone so the app works offline. These copies are removed when you delete your account in the app.
If you add a profile photo, the app only asks for camera access when you choose to take a photo. Choosing a photo from your library uses Apple’s photo picker, so HolidAI only receives the one photo you pick, not your photo library.
We do not ask for your location, contacts, payment details or health information, and we do not send you marketing.
3. The AI assistant (Ask Holid-Ai)
When you use Ask Holid-Ai, your question, selected preferences and the last few messages of the conversation are sent to our Cloud Function, which runs on Google Cloud in London (europe-west2). The function passes that text to OpenAI, which generates the reply. We do not send your name, email address or account ID to OpenAI.
We do not store your chat messages in our database or logs; the conversation stays on your iPhone until you close it. OpenAI processes the text on our behalf under its API terms. According to OpenAI’s published API data policy, data sent through its API is not used to train its models by default and may be kept for up to 30 days to monitor for abuse before it is deleted. See OpenAI’s privacy policy.
Please don’t include sensitive personal information (for example health details or card numbers) in your questions. AI replies can be wrong; see our terms of use. AI replies are suggestions only; we do not use them to make decisions about you.
4. Service providers and where data is stored
We use these providers to run HolidAI. They process personal data on our behalf and under contract (as our processors), unless we say otherwise.
- Google (Firebase and Google Cloud): Firebase Authentication (sign-in), Cloud Firestore (our database, located in London, europe-west2), Cloud Storage for Firebase (profile photos), Cloud Functions for Firebase (London, europe-west2), Firebase App Check (app integrity, using Apple App Attest) and Firebase Hosting (this website). Some Firebase services, including Firebase Authentication, may process data in the United States and other countries.
- OpenAI (United States): generates replies for the AI assistant.
- Apple: provides Sign in with Apple and App Attest. Apple handles that data as an independent controller under Apple’s privacy policy.
5. Booking partners, affiliate links and cookies
HolidAI is not a travel agent and does not take bookings or payments. To book a stay, you leave HolidAI and go to a partner’s website or app. Our affiliate partner is Stay22. Its “See stays” links open live search results on a booking site such as Booking.com, Agoda, Expedia, Hotels.com or Vrbo; which site you reach can vary from search to search. These links open in Safari or in a Safari view inside the app.
Map of stays. The “Map of stays” screen shows an interactive map provided by Stay22 inside the app. It loads content from Stay22 and from the services Stay22 uses to show it, such as its map-tile providers and the booking sites whose stays and prices appear. Stay22 may use cookies or similar technologies in the map, and these services receive standard technical information such as your IP address and device details. The app keeps the map’s cookies and website data only while the map is open and clears them when you close it. Anything you tap in the map that leads to a booking site opens in Safari. See Stay22’s privacy policy.
When you tap through to a partner, that partner’s own privacy policy, cookie policy and terms apply to everything you do there, including any details and payment information you enter. Those partners are independent controllers of that data; we do not control it and are not responsible for it.
Links to partners are affiliate links. So that we can be paid a commission if you book, Stay22 and the booking site may use cookies, similar technologies or information in the link (our affiliate ID and the app screen the link came from) to record that you came from HolidAI. When you follow a link they may also receive standard technical information such as your IP address and browser or device details. We do not add your name, email address or account ID to these links. See our affiliate disclosure.
6. No selling, no ads, no tracking
We do not sell or rent your personal data, and we do not share it for advertising. The HolidAI app shows no third-party ads and contains no advertising or analytics software, and we do not track you across other companies’ apps or websites. The only third-party web content inside the app is the Stay22 map described in section 5, which is not linked to your HolidAI account. This website does not use cookies or analytics.
7. International transfers
OpenAI is based in the United States, and some Google services may process data outside the UK. Where personal data is transferred outside the UK, we rely on the safeguards our providers offer, such as the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) where the provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
8. How long we keep data
- Account details, profile photo, favourites, saved trips (and any older booking requests) and reviews: while your account exists. They are deleted when you delete your account (see section 9), or earlier if you remove your photo, a favourite or a trip.
- AI assistant messages: not stored by us (see section 3 for OpenAI).
- Technical logs: normally about 30 days, as set by our cloud provider.
- Emails: as long as needed to deal with your enquiry, and generally no longer than two years.
We may keep information for longer only where the law requires it or it is needed to deal with a dispute. After deletion, our providers may take a short time to remove data from their systems and backups.
9. Deleting your account and data
In the app: open Profile and tap Delete Account. After you confirm with your password, or with Apple if you use Sign in with Apple, we permanently delete your account together with your profile photo, favourites, saved trips (and any older booking requests) and the reviews linked to your account, and remove the copies kept on your iPhone. This can’t be undone. If you use Sign in with Apple, we also ask Apple to revoke HolidAI’s access. You can check this at any time in your iPhone’s Settings under your Apple Account, then Sign in with Apple.
By email: if you can’t use the app, email creatuvmedia@gmail.com from the email address linked to your account and ask us to delete your account and data. We will do this within one month and confirm when it is done.
10. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected (you can change your name, photo and password in the app);
- have your data erased;
- restrict how we use your data;
- object to how we use your data where we rely on legitimate interests;
- receive the data you gave us in a portable format; and
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email creatuvmedia@gmail.com. There is normally no charge. We will reply within one month, and may need to confirm your identity first.
11. Security
Data is encrypted in transit between the app and our servers. Security rules make sure only you can read your profile photo, favourites and saved trips, and Firebase App Check helps block requests that don’t come from the genuine app. No system is completely secure, so please use a strong password that you don’t use anywhere else.
12. Children
HolidAI is for adults planning holidays. You must be 18 or over to create an account, and our booking partners only accept bookings from adults. HolidAI is not directed at children under 13, and we do not knowingly collect their personal data. If you think a child has given us personal data, please contact us and we will delete it.
13. Changes to this policy
We will update this policy when HolidAI or the way we use data changes. We will post the new version here with a new “last updated” date and, if the changes are significant, tell you in the app.
14. Contact and complaints
Email creatuvmedia@gmail.com with any questions or concerns about your personal data. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to help first, so please contact us before going to the ICO.