This policy explains how Open Sky Labs Sdn Bhd (Suite 12-06, Binjai 8 Premium Soho, Lrg Binjai, Jalan Ampang, 50450 Kuala Lumpur, Malaysia) handles personal data when you use holidayos.ai and the HolidayOS application, in line with the Malaysian Personal Data Protection Act 2010 and, where applicable, the GDPR.
1. Data we collect
Account data — name, work email, phone, company, and login records when you register. Customer Content — the client records, inquiries, and itineraries you store in HolidayOS; for this data we act as a processor on your behalf. Usage data — product events (such as itineraries created and AI generations) used for metering, billing, and improving the Service. Website data — on holidayos.ai we use your IP address once to detect your country so pricing shows the right currency; the IP is not stored beyond a short-lived cache.
2. How we use data
To provide and secure the Service, process payments, meter usage, respond to support requests, send service emails (proposals you send, password resets, billing receipts), and improve the product. We do not sell personal data.
3. AI processing
When you use AI features, the relevant inquiry or itinerary text is sent to our AI providers (such as Anthropic, OpenAI, or OpenRouter) to generate the draft. We do not permit these providers to use your data to train their models under our agreements with them.
4. Google Workspace and Gmail data
If a workspace manager chooses to connect Gmail, HolidayOS accesses the connected mailbox address and Gmail Inbox message bodies, headers, attachments, thread identifiers, and labels. We use this information to import the recent conversations selected by the manager, synchronize new enquiries into the HolidayOS CRM, display the conversation to authorized workspace members, keep read status synchronized, and send replies that a workspace member explicitly composes through the connected account.
Gmail content and OAuth credentials are transmitted over encrypted connections. OAuth access and refresh tokens are encrypted at rest. Imported messages and permitted attachments are stored as tenant-scoped Customer Content for the connected workspace. We do not use Google user data for advertising, sell it, allow generalized or shared AI models to train on it, or permit employees to read it except with the user's explicit permission for support, for security investigation, or when legally required.
If a user deliberately starts an AI feature using an enquiry imported from Gmail, the relevant text may be sent to the AI providers listed above solely to produce the requested, visible HolidayOS output. It is not used to train a generalized model. This transfer is disclosed in the Gmail connection flow and occurs only to provide the user-facing feature.
Disconnecting Gmail revokes future access and removes the stored OAuth connection. A workspace manager may separately delete the Gmail message and attachment copies stored in HolidayOS, along with duplicate source notes and provider metadata, while retaining manually enriched CRM records. Neither action deletes or changes anything in the user's Gmail account. Complete account deletion remains available as described below. See our Google Data Management guide for instructions.
HolidayOS's use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Service providers
We use vetted subprocessors to run HolidayOS: cloud hosting (Hetzner, EU data centres), payments (Stripe), transactional email (Resend), AI model providers (as above), and IP-to-country lookup (ipinfo.io). Each receives only the data needed for its function.
6. Retention
Account data is kept while your account is active. Customer Content is retained until you delete it or your account closes, after which it is removed from live systems within 30 days and from backups on their rotation schedule.
7. Security
Data is encrypted in transit (TLS) and at rest, with field-level encryption applied to sensitive personal fields. Access is restricted to personnel who need it to operate the Service.
8. Your rights
You may access, correct, export, or delete your personal data, and object to or restrict certain processing. Email hello@holidayos.ai and we will respond within 30 days. If your clients contact us about data you store in HolidayOS, we will refer them to you as the controller.
9. Cookies
The marketing site sets no advertising or analytics cookies. The application uses strictly necessary cookies for sign-in sessions.
10. Changes and contact
We will post any changes to this policy here and update the date above. Privacy questions: hello@holidayos.ai.