Privacy Policy

Your account: email address, username, display name, and a securely hashed password. If you sign in with Google, we receive your Google account id, name, email and profile picture.

Your profile: profile photo and bio, if you add them, and your preferences (currency, language, email choices).

Bookings: for each traveller, title, first, middle and last name, gender and date of birth, plus an email address and (optionally) a phone number for adults. We also keep the flights, seats, fare, booking reference and e-ticket numbers, and the searches you run.

Payments: card payments go directly to Stripe. We keep only references to Stripe records (such as your Stripe customer id and payment ids), and show the card brand, last four digits and expiry that Stripe gives us for saved cards. Your coin balance and wallet history are stored with your account.

Community activity: posts (photos, videos, captions, locations, categories and hashtags), comments, likes, saved posts, follows, coin gifts, notifications and direct messages.

How you use the site (only if you allow analytics or advertising cookies): pages and ads you view, what you click, your browser and device, and your approximate location based on your IP address. See Cookies & Tracking.

Marketing emails (only if you’ve opted in): whether you opened them and which links you clicked.

• To create and secure your account and keep you signed in.
• To search, reserve, pay for and ticket your flights, and show them in My trips.
• To run the community: show posts, deliver messages and send you alerts.
• To process coin purchases and gifts.
• To keep VacationMe safe, fix problems, and meet legal and accounting duties.
• To understand how the site is used and improve it (analytics, with your permission).
• To show ads. Ads are personalised using your activity only if you allow advertising cookies; otherwise any ads you see are not personalised.
• To send you deals and travel ideas by email if you’ve opted in, and to learn which emails are useful from opens and clicks.

We use your data for advertising and marketing only as this policy describes, and only with your permission where the law requires it.

• Public: your username, display name, profile photo, bio, posts, comments, and follower and following counts. Anyone can see these, including people without an account.
• Private: your email, bookings, traveller details, payment details, wallet and direct messages (visible only to the people in the conversation).
• Coins you receive are shown only to you.

• Travelport and the airlines, to reserve and ticket flights (traveller names, dates of birth and contact details).
• Stripe, to take payments and save cards.
• Google, only if you choose to sign in with Google.
• Photon (komoot) and Open-Meteo: when you type a location for a post, the text you type is sent to them to suggest places. Open-Meteo also provides the weather on the home page.
• Advertising partners, if you allow advertising cookies, to show, measure and personalise ads: [ad partners to be listed]
• Analytics providers, if you allow analytics cookies: [analytics provider(s) to be listed]
• Our email provider, to send marketing emails you’ve opted in to: [email provider to be listed]
• Authorities, where the law requires it.

Opening a post’s location takes you to a Google search for that place; Google’s own privacy policy applies there.

We use essential storage in your browser (for example, to keep you signed in). Analytics and advertising cookies are used only if you allow them, and you can change your choice at any time with Cookie settings at the bottom of every page. See Cookies & Tracking for the details.

We keep your data while your account is open. Booking and payment records may be kept after that for legal and accounting reasons. The Data Deletion Policy explains exactly what happens when you delete your account.

• View and update your profile, email, password and preferences in Settings.
• Edit or delete your posts and comments at any time.
• Remove saved cards in Settings → Payment methods.
• Delete your account in Settings → Account.
• Change your cookie choices at any time with Cookie settings, at the bottom of every page.
• Stop marketing emails in Settings → Preferences (Deals & inspiration), or with the unsubscribe link in any marketing email.
• Opt out of personalised advertising — including where the law treats it as “selling” or “sharing” personal data — by turning off advertising in Cookie settings.
• Depending on where you live, you may also have the right to request a copy of your data, correct it, or ask us to delete or restrict it. Contact us at [support email to be added] to do so.

Passwords are stored hashed, never in plain text, and card numbers are handled by Stripe. No system is perfectly secure, so please use a strong password that you don’t use elsewhere.

We’ll update this policy when our practices change; the date at the top shows the latest version. Questions about your privacy? Contact us at [support email to be added].