← Back to App

Privacy Policy

1. Who We Are

Vacay ("we", "us", "our") is an employee time-off and leave-management platform provided as Software-as-a-Service (SaaS) for small businesses. Our platform is accessible at vacay.work. For privacy enquiries, contact us at support@vacay.work.

2. What Data We Collect

We collect the following personal data when you register or use Vacay:

• Identity data: full name
• Contact data: email address, and phone number if you choose to provide it
• Account data: password (stored encrypted), role, department, and company code
• Leave data: time-off requests, dates, leave types, days used, and sick-day records
• Usage data: notification read status, and login activity

We do not collect or store payment card details ourselves. When you subscribe to a paid plan, payment is processed by Stripe, a PCI-DSS certified provider.

3. How We Use Your Data

We use your personal data to:

• Provide and operate the platform (time-off requests, approvals, calendar, and notifications)
• Send transactional emails such as approval confirmations, team invitations, and weekly summary reports
• Enable your company administrator to manage requests and team schedules
• Operate, maintain, and support the service
• Improve the platform and diagnose technical issues

4. Platform Administrator Access

As the operator of Vacay, we maintain a super-admin level of access for service operation, abuse prevention, and technical support. This access is limited to:

• Viewing company-level information (company name, code, creation date, and employee count)
• Suspending or reactivating company accounts that violate our Terms of Service
• Editing company configuration for technical or support purposes

We do not routinely read individual employees' personal leave records. Any access to individual records is limited to specific support situations or where required by law.

5. Data Sharing and Sub-Processors

We do not sell your personal data. We share data only with the third-party processors needed to run the service:

• Google Firebase (Firestore & Authentication) — database and authentication infrastructure
• EmailJS — transactional and summary email delivery
• Stripe — payment processing for paid plans
• Meta (Facebook) and Google — analytics and advertising measurement on our public marketing pages only (see Section 9)

These processors are required to handle data securely and in line with applicable data-protection laws.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you request deletion of your account, we will remove your personal data within 30 days, except where we are legally required to retain it.

7. Your Rights

Depending on your location, you may have the following rights over your personal data:

• Access — request a copy of the data we hold about you
• Correction — ask us to correct inaccurate data
• Erasure — request deletion of your personal data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to certain types of processing

To exercise any of these rights, contact support@vacay.work. We will respond within 30 days.

8. Data Security

We use appropriate technical and organisational measures to protect your data, including encrypted transmission (HTTPS), Firebase security rules that restrict access by role and company, and limited platform-admin access. No system is perfectly secure, but we work to protect your information and to address issues promptly.

9. Cookies, Analytics & Advertising

Inside the Vacay application, we use only functional cookies and similar storage necessary for authentication and keeping you signed in.

On our public marketing pages (such as our homepage), we also use analytics and advertising-measurement technologies, including the Meta (Facebook) Pixel and Google Ads tags. These help us understand how visitors find Vacay and measure the performance of our advertising. They may set cookies and share limited event data (such as page views) with Meta and Google.

You can control or opt out of this tracking through your browser settings, your Meta ad preferences, and your Google ad settings. Where required by law, we will request your consent before setting non-essential cookies.

10. Children's Privacy

Vacay is intended for use by businesses and their staff, and is not directed at individuals under the age of 16. We do not knowingly collect personal data from anyone under 16.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any updated version on this page with a revised date. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact Us