← Back to App

Privacy Policy

1. Who We Are

Vacay ("we", "us", "our") is a leave management platform operated as a Software-as-a-Service (SaaS) product. Our platform is accessible at vacay.work. For privacy enquiries, contact us at support@vacay.work.

2. What Data We Collect

We collect the following personal data when you register or use Vacay:

• Identity data: Full name
• Contact data: Email address, phone number
• Account data: Password (encrypted), role, department, company code
• Leave data: Leave requests, dates, leave types, days used, sick day records
• Usage data: Notifications read/unread status, login activity

We do not collect payment card data directly. Payment processing (when applicable) is handled by Stripe, a certified PCI-DSS compliant provider.

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide and operate the Vacay platform (leave management, approvals, notifications)
• To send transactional emails (approval confirmations, invite emails, weekly reports)
• To allow your company administrator to manage leave requests and team schedules
• To allow Vacay platform administrators to maintain and support the service
• To improve the platform and diagnose technical issues

4. Platform Administrator Access

As the operator of the Vacay platform, we maintain a super-admin level of access to the platform for service operation, abuse prevention, and technical support. This access is limited to:

• Viewing company-level information (company name, code, creation date, employee count)
• Suspending or reactivating company accounts that violate our Terms of Service
• Editing company configuration for technical or support purposes

We do not routinely read individual employees' personal leave records. Any access to individual records is limited to specific support situations and is logged internally.

5. Data Sharing

We do not sell your personal data. We may share data with the following third-party processors:

• Google Firebase (Firestore & Authentication) — database and authentication infrastructure
• EmailJS — transactional email delivery
• Stripe — payment processing (when applicable)

All third-party processors are contractually required to handle your data securely and in compliance with applicable data protection laws.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you request deletion of your account, we will remove your personal data within 30 days, except where we are required to retain it for legal purposes.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to access — request a copy of the data we hold about you
• Right to correction — request that we correct inaccurate data
• Right to erasure — request deletion of your personal data
• Right to portability — receive your data in a structured, machine-readable format
• Right to object — object to certain types of processing

To exercise any of these rights, contact us at support@vacay.work. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted data transmission (HTTPS), Firebase security rules limiting data access by role and company, and restricted platform admin access.

9. Cookies

Vacay uses only functional cookies necessary for authentication and session management. We do not use advertising or tracking cookies.

10. Children's Privacy

Vacay is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by posting the new policy on this page with an updated date. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact Us