Privacy policy
Last updated:
In short: the website keeps almost nothing about you. We place your city in a cookie after looking up your IP address on our own server (the address itself is not stored), count views and shares with a daily-changing hash, keep server logs for 30 days, and keep your email only if you sign up for the weekly email. The WhatsApp assistant keeps your number, your messages and your trip details for as long as you use it. We never sell personal information. You can ask to see, correct or delete your data at any time.
1. Who we are
The VacayMatch website (vacaymatch.co) and the VacayMatch WhatsApp assistant at +1 (302) 662-3415 are operated by The VacayMatch team ("we", "us"), reachable at hello@vacaymatch.co and by mail at VacayMatch, Bograshov 44, Tel Aviv 6314508, Israel. Using the site or the assistant means you accept this policy.
2. What we collect on the website
- Your approximate location. To show trips from the city nearest you, we look up your IP address in a geolocation database (DB-IP City Lite) that runs on our own server: nothing is sent to anyone. Only the result, the nearest metro, is kept, in the
vm_origincookie. The IP address is not stored with it, and you can change the city at any time with the "Change city" control. - Cookies. Two, both first-party and set only by us:
vm_origin(your chosen or detected city, one year) andvm_voter(a random id so a poll counts one vote per browser, one year). No session cookies, no advertising cookies, no third-party cookies, no analytics, no tracking pixels. Blocking cookies breaks nothing except remembering your city and your poll vote. The poll builder keeps the trips you add in your browser's local storage (vm_poll), never sent to us. - Counts. Page views, shares, votes and requests are counted with a hash of the IP address and a salt that changes every day; the hash cannot be reversed and cannot be linked across days. Crawlers are flagged and excluded from the counts.
- Server logs. The web server keeps a technical log (IP address, browser type, time and page) for up to 30 days, for security and reliability only.
- Trip requests ("Ask"). The text you type, the city you chose and the daily hash. The resulting page is public and other readers see it; do not put personal details in the request.
- Polls. The trip pages you put in a poll, the poll's title if you wrote one, and the votes, each tied to the hashed
vm_voterid. - Weekly email. Your email address, your city, the time you signed up, the time you confirmed and the time you unsubscribed, when each email was sent, and the daily hash of your IP address at signup, used only to limit signups. Nothing else. Emails are sent through Amazon Simple Email Service from hello@vacaymatch.co; we do not track opens or clicks.
- Referral links. When you click a booking link we record the link id, the time, the browser type, the country of the IP address, the same daily hash of the IP address and the page you clicked from. The booking site and its referral network receive the link id (a "sub-id") so a booking can be matched to it; they do not receive your name, email or phone number from us. A booking site receives your details only if you choose to book there, under its own policy.
- Fonts. Fonts load from Google Fonts, so your browser contacts Google's servers under Google's privacy policy.
3. What we collect on WhatsApp
- Identification: your phone number and WhatsApp profile name, as WhatsApp passes them to us.
- Message content: text, voice notes, images, documents and locations you send, and the assistant's replies.
- Trip details: destinations, dates, travelers, budget and preferences.
- Links, feedback and alerts: the links the assistant sent and clicks on them, your answer to whether you booked, the price watches and reminders you asked for, and your STOP and START replies.
4. Why we use it
- To run the site: pick your city, show prices, count what readers look at and share, publish the trips readers ask for, and stop abuse.
- To run the assistant: understand the request, search and compare, reply, remember trip details, and send the messages you asked for.
- To send the weekly email you signed up for.
- To know which links led to a booking, so the booking site or its network can pay the referral fee.
- To improve the service, fix faults and meet legal obligations.
No duty to provide data: the website works without any of it. The assistant cannot work without your phone number and messages.
5. Who else processes it
We do not sell personal information, and we do not share it for cross-context behavioral advertising. Providers process data on our behalf under processing agreements:
| Provider | Role |
|---|---|
| Amazon Web Services | Hosting of servers and database; sending the weekly email (Simple Email Service). |
| Anthropic | The language model that reads trip requests, chooses among the priced finalists, drafts page text from the page data, and answers on WhatsApp. Requests and messages are sent to the model for processing only. |
| Meta Platforms (WhatsApp Business Platform) | Carries messages between your phone and the assistant, under the WhatsApp Business terms and WhatsApp's privacy policy. |
| Google (Gemini) | Transcription of voice notes to text. |
| Referral networks (today Stay22, Admitad and GetYourGuide; the list is kept current) and booking sites | Receive the link id only, when you click. |
| DB-IP, Open-Meteo, Openverse, Wikimedia Commons, Pexels | Data sources (the geolocation file, weather, licensed photos). No personal data is sent to them; the geolocation lookup runs on our server. |
We will disclose data to a competent authority when required by law, subpoena or court order.
6. How long we keep it
- Server logs: up to 30 days.
- Counts (hashed): up to 24 months, then only in aggregate.
- Trip requests and polls: the public pages stay; a poll closes after 14 days and its votes are kept with it.
- Weekly email: while you are subscribed; after you unsubscribe we keep the address on a suppression list so we do not email you again.
- WhatsApp history and trip details: while you use the assistant, deleted after 12 months without activity.
- Link and click records: up to 24 months for reconciliation with booking sites and networks, then only in aggregate.
7. Your rights
- Access: a copy of the data held about you.
- Correction of data that is inaccurate or out of date.
- Deletion of all your data.
- Opt out: every weekly email has an unsubscribe link; reply STOP on WhatsApp and proactive messages end.
- No sale: we do not sell personal information and do not share it for targeted advertising, so there is nothing to opt out of.
To exercise a right, email hello@vacaymatch.co or write on WhatsApp from the number you used. We respond within 45 days; if we need longer, we tell you why and when. We may ask you to verify your identity before releasing or deleting data. If you disagree with our answer, reply to it and say so: a person reviews the appeal and answers within 45 days. We never treat you differently for exercising a right.
State-specific notes
California: under the California Consumer Privacy Act you have the rights listed above (to know, delete and correct) and the right not to be discriminated against for using them. We do not sell or share personal information, so there is no sale or sharing to opt out of, and we have not done so in the past 12 months. Under the California Online Privacy Protection Act we state that this site does not respond to "Do Not Track" browser signals, and that no third party collects personal information about your activity on this site over time and across other sites.
Nevada: we do not sell covered information as defined by Nevada law.
Texas, Virginia, Colorado and Connecticut: residents have the rights to access, correct, delete and obtain a portable copy of their data, and to opt out of targeted advertising, the sale of personal data and profiling; we do none of those three. Use the contact methods above; appeals are handled as described above, and you may also contact your state attorney general.
8. Security
Data is stored on secured servers with encryption in transit and at rest, role-based access and monitoring. No security is absolute; if a security incident affects your data we will notify you as the law requires.
9. Age
The site and the assistant are for people aged 18 and over. We do not knowingly collect data from children under 13; if we learn that we have, we delete it.
10. International transfers
Our servers and providers are in the United States, the European Union and Israel, so your data may be processed outside the state or country you live in, with the protections described in section 8.
11. Changes
If we change this policy materially we will say so on this page, in the weekly email and in the WhatsApp conversation before the change takes effect. The date of the last update is at the top.
12. Contact
The VacayMatch team
Email: hello@vacaymatch.co · WhatsApp and phone: +1 (302) 662-3415
Mail: VacayMatch, Bograshov 44, Tel Aviv 6314508, Israel
Privacy requests (access, correction, deletion): the same email, subject "Privacy".