Privacy Policy

Last updated October 02, 2026

This Privacy Policy explains how we process personal data when you visit our website, create an account, use the holidays.rest API, the dashboard, the official SDKs or the MCP server, or buy a subscription (together, the "Services"). It is based on the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Table of Contents

1. Controller
2. Visiting Our Website: Hosting, Server Logs and Cloudflare
3. Cookies and Consent Management
4. Google Analytics
5. Account Registration and Login
6. Using the API
7. Payments
8. Emails
9. Contacting Us and Cancellation Requests
10. Recipients and Transfers Outside the EU
11. How Long We Keep Your Data
12. Your Rights
13. Right to Lodge a Complaint
14. Further Information
15. Changes to This Privacy Policy

1. Controller

The controller responsible for processing your personal data is:

Mustafa Serhat Dündar
Bergstraße 70
10115 Berlin
Germany
Email: [email protected]

We are not legally required to appoint a data protection officer. For all privacy questions and requests, please contact us at the address above. Further details are in our Impressum.

2. Visiting Our Website: Hosting, Server Logs and Cloudflare

Hosting and server logs

Our website, API and database are hosted by Hetzner Online GmbH on servers in Germany. When you access the website or the API, our servers automatically record the following data in log files: IP address, date and time of the request, requested URL, HTTP status code, amount of data transferred, referring URL, and browser and operating system (user agent).

We process this data to deliver the Services, to keep them secure and stable, and to detect and fix errors and misuse. The legal basis is our legitimate interest in the secure and reliable operation of the Services (Art. 6 (1) (f) GDPR). Log files are deleted after 14 days at the latest, unless we need to keep specific entries longer to investigate a security incident.

Cloudflare

All traffic to holidays.rest passes through the network of Cloudflare, Inc. Cloudflare delivers our content quickly, terminates the encrypted (TLS) connection, and protects the Services against attacks such as DDoS. To do this, Cloudflare processes your IP address, the content of the requests and technical connection data. The legal basis is our legitimate interest in a fast and secure website (Art. 6 (1) (f) GDPR).

We also use Cloudflare Web Analytics to measure page views and loading times in aggregated form. Cloudflare Web Analytics does not set cookies, does not use local storage and does not create user profiles. The legal basis is our legitimate interest in understanding how our website is used and improving its performance (Art. 6 (1) (f) GDPR).

3. Cookies and Consent Management

We use cookies and similar technologies only where they are strictly necessary to provide the Services you request, or where you have consented.

• Strictly necessary: session cookies from our login provider Clerk, which keep you signed in and protect your account, and a cookie that stores your consent choices. These are permitted without consent under § 25 (2) No. 2 TDDDG; the processing of the related data is based on Art. 6 (1) (b) GDPR (providing the Services you have requested) and Art. 6 (1) (c) GDPR (documenting consent).
• Analytics: cookies from Google Analytics (see Section 4). These are only set after you have consented (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).

We use the consent management platform of Termly, Inc. to obtain, store and document your consent. Termly processes your IP address (shortened), the consent choices you make, the date and time, and browser information.

You can change or withdraw your consent at any time with effect for the future by clicking Consent Preferences in the footer of every page.

4. Google Analytics

If you consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics is not loaded before you consent.

Google Analytics uses cookies (such as _ga and _ga_*, stored for up to 2 years) to recognize your browser and to analyze how the website is used, for example which pages are visited, how long visits last, the referring website, the approximate location (country or city), and the device and browser used. Google Analytics 4 does not log or store IP addresses for users in the EU. We use the reports to improve our website and offering. We have not enabled Google signals or advertising features.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Google stores the analytics data for 14 months. Data may be transferred to Google LLC in the USA (see Section 10). For more information, see the Google Privacy Policy.

5. Account Registration and Login

To use the API, you need an account. Registration and login are handled by Clerk, Inc. When you register, we and Clerk process your email address, your name (if provided), your password (stored only as a hash by Clerk), your account ID, and technical session data such as IP address, browser and login times.

You can also sign in with Google, GitHub or LinkedIn. In that case, the respective provider sends us your name, email address, profile picture and a user ID, as permitted by your settings with that provider. We do not receive your password for that provider. The providers are Google Ireland Limited (Ireland), GitHub, Inc. (USA) and LinkedIn Ireland Unlimited Company (Ireland). They process data under their own responsibility and privacy policies.

The legal basis is the performance of the contract for the use of the Services (Art. 6 (1) (b) GDPR). Processing to protect accounts against misuse is based on our legitimate interest in secure Services (Art. 6 (1) (f) GDPR).

6. Using the API

When you use the API, we process your API keys, your plan, and the number of requests you have made in the current billing period, so that we can authenticate requests, apply your plan's quota and show your usage in the dashboard. The holiday data you query (for example, countries and dates) is not personal data. The API is not designed for personal data, so please do not include personal data in your requests.

The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

7. Payments

Payments for paid plans are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). You enter your payment details directly on Stripe's checkout page; we never receive your full card details.

Stripe processes your name, email address, billing address, payment method details, transaction data and technical data for fraud prevention. We receive your customer and subscription data from Stripe (plan, billing interval, status, billing periods and invoices) to manage your subscription. Stripe processes some data as an independent controller, for example to comply with financial regulations and to prevent fraud. For details, see the Stripe Privacy Policy.

The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR) and our legal obligations under tax and commercial law (Art. 6 (1) (c) GDPR).

8. Emails

We send emails through Resend (Plus Five Five, Inc.). We process your email address, the content of the email, and technical delivery data (such as delivery status).

• Service emails: welcome email after registration, order and contract confirmations, payment confirmations, cancellation confirmations and other messages needed to run your account. Legal basis: performance of the contract and legal obligations (Art. 6 (1) (b) and (c) GDPR).
• Product information: as a registered user, you may receive a small number of emails about our paid plans and offers. Legal basis: our legitimate interest in informing users about our own similar services (Art. 6 (1) (f) GDPR, § 7 (3) German Act Against Unfair Competition, UWG). You can object at any time, without incurring any costs other than the basic transmission costs, by replying to any such email or by writing to [email protected].

9. Contacting Us and Cancellation Requests

If you contact us by email, we process your email address, your name and the content of your message to answer your request. If you use our Cancel contracts here page, we process the information you enter in the form (type of termination, reason if given, name, account email, contract, requested date and confirmation email address), the time of receipt and your IP address (to prevent misuse), and we send the confirmation to you and a copy to us by email.

The legal basis is the performance of the contract or pre-contractual measures (Art. 6 (1) (b) GDPR), our legal obligation to confirm cancellations (Art. 6 (1) (c) GDPR in conjunction with § 312k BGB), and, for general inquiries, our legitimate interest in answering them (Art. 6 (1) (f) GDPR).

10. Recipients and Transfers Outside the EU

We only share personal data with the service providers listed below, to the extent necessary for the purposes described in this Privacy Policy. Where they act as our processors, we have concluded data processing agreements with them (Art. 28 GDPR). We also disclose data to authorities where we are legally required to do so. We do not sell your personal data.

Some of these providers are located in the USA or may access data from the USA. For transfers to companies certified under the EU-U.S. Data Privacy Framework, the European Commission has determined that an adequate level of data protection exists (adequacy decision of 10 July 2023, Art. 45 GDPR). In addition, or where a recipient is not certified, transfers are based on the Standard Contractual Clauses adopted by the European Commission (Art. 46 (2) (c) GDPR). You can check a company's certification at dataprivacyframework.gov, and you can request a copy of the Standard Contractual Clauses from us.

If you sign in with GitHub, your data is exchanged with GitHub, Inc. in the USA at your request. GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework.

11. How Long We Keep Your Data

We delete personal data as soon as it is no longer needed for the purposes for which it was collected, unless statutory retention obligations apply. In particular:

• Account and API data: for as long as your account exists, and deleted when you delete your account.
• Invoices and accounting records: for the statutory retention period, currently up to 8 years (§ 147 German Fiscal Code, AO; § 14b German VAT Act, UStG).
• Business correspondence, including cancellation requests: up to 6 years (§ 147 AO, § 257 German Commercial Code, HGB).
• Server logs: 14 days at the latest (see Section 2).
• Google Analytics data: 14 months.
• Consent records: for as long as we need to be able to prove consent.

12. Your Rights

Under the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a structured, commonly used and machine-readable format (data portability, Art. 20 GDPR);
• withdraw any consent you have given at any time with effect for the future (Art. 7 (3) GDPR), for cookies via Consent Preferences in the footer.

To exercise your rights, please email [email protected]. You can view and update your account data and delete your account in your dashboard.

13. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin, Germany
www.datenschutz-berlin.de

14. Further Information

Obligation to provide data: You are not legally required to provide personal data. However, without the data required for registration and payment, we cannot conclude or perform a contract with you.

No automated decision-making: We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Children: Our Services are aimed at developers and businesses and are not directed at children under 16. We do not knowingly collect personal data from children.

Users outside the EU: We process the data of all users as described in this Privacy Policy. We do not sell personal information and do not share it for cross-context behavioral advertising.

15. Changes to This Privacy Policy

We update this Privacy Policy when our processing or the legal requirements change. The current version is always available on this page. The postal address for privacy requests is Mustafa Serhat Dündar, Bergstraße 70, 10115 Berlin, Germany.