Privacy Policy

Introduction

VacationMonitor ("Service", "we", "us", or "our") operates as a web-based price monitoring platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy. If you have additional questions or require more information about our Privacy Policy, please do not hesitate to contact us.

1. Information We Collect

Google Account Information

When you sign in using Google OAuth, we collect and store:

• Email address — used for account identification and communication
• Profile name — displayed in your VacationMonitor profile
• Profile picture — loaded from Google's servers; we store only the URL reference

We never store your Google password or authentication tokens beyond the OAuth session.

Search Data

When you add a vacation search to monitor, we collect and store:

• Booking.com URLs — parsed to extract destination, traveler details, dates, and search criteria
• Stop date for monitoring — when you want us to stop tracking this search
• Created/updated timestamps — for audit and activity tracking

Price Data

As we monitor hotel prices over time, we collect and store:

• Historical price points — hotel names, room types, rates, and currency
• Price timestamps — when each price was recorded
• Aggregated analytics — price trends, statistical summaries, and indexed data for search

Conversation Data

If you use our AI-powered insights feature, we store:

• Your messages — questions and requests about price trends and booking recommendations
• AI responses — summaries, insights, and analysis generated for you
• Conversation context — linked to your searches and price history for relevance

Usage and Log Data

We automatically collect certain technical information:

• IP address and browser fingerprint (for security and abuse prevention)
• Pages viewed and actions taken in the app (clicks, exports, preference changes)
• Session timestamps and duration
• Error logs and performance metrics

2. How We Store Your Data

Database: All personal data, searches, and prices are stored in Microsoft Azure Cosmos DB, a cloud-hosted NoSQL database. Cosmos DB is encrypted at rest and in transit using industry-standard protocols.

Data Processing: The Schedule runs within the Web API process and polls your searches. When a search is due for monitoring, we enqueue a job to Azure Service Bus, which is then picked up by a separate Worker service that:

• Scrapes price data from Booking.com or other sources
• Processes and aggregates the results
• Stores updated prices back to Cosmos DB

No third-party analytics: We do not share raw search or price data with third parties. We use only internal logging for debugging and performance optimization.

3. Third-Party Services

Google OAuth: We use Google's OAuth 2.0 for authentication. When you sign in with Google, you are subject to Google's Privacy Policy. We do not receive or store your Google password.

Microsoft Azure: Our infrastructure (Cosmos DB, Service Bus, hosting) is provided by Microsoft Azure. Your data is processed and stored on Microsoft's servers, subject to their privacy and security terms.

AI Services: Insights and analysis features may integrate with third-party AI services. Any data sent to AI providers is anonymized and aggregated; raw personal data is not shared.

4. How We Use Your Data

We use the information we collect to:

• Authenticate your account and maintain your sessions
• Store and retrieve your vacation searches and price history
• Monitor hotel prices on your behalf and schedule monitoring jobs
• Generate price trend reports and AI-powered insights
• Operate and improve the Service (debugging, performance monitoring)
• Detect, prevent, and address abuse, fraud, and security issues
• Comply with legal obligations and enforce our Terms of Service

5. Data Retention

Active Accounts: While your account is active, we retain all personal data, searches, and price history for the lifetime of the account.

Deleted Accounts: If you delete your account, we will remove your personal data, searches, and conversations within 30 days. Historical price data may be retained in aggregated, anonymized form for analytics purposes.

Logs: Technical logs and usage data are retained for up to 90 days, then deleted.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of your personal data
• Right to Correction: Request we correct inaccurate data
• Right to Deletion: Request we delete your account and associated data (via Settings page)
• Right to Portability: Request your data in a portable format (CSV export available)
• Right to Opt-Out: Disable price monitoring or delete specific searches

To exercise these rights, please contact us at support@evo.gl. We will respond to verified requests within 30 days.

7. Cookies and Tracking

We use secure session cookies to maintain your authentication state. These cookies are:

• HttpOnly (not accessible via JavaScript, preventing XSS attacks)
• Secure (only transmitted over HTTPS in production)
• SameSite (mitigating CSRF attacks)

We do not use third-party tracking pixels, analytics cookies, or advertisement tracking.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or by posting a prominent notice on our website. Your continued use of the Service following such notice constitutes your acceptance of the updated Privacy Policy.

9. Contact Us

If you have questions about this Privacy Policy or your personal data, please contact us at: