Version 2026-07
Privacy Policy
next-plans helps you plan holiday periods and receive matching offers. This policy describes which data is processed – in particular, what happens when optionally connecting your Google account.
- To create an account, all we need is an email address – a pseudonym as a display name is sufficient.
- Google Calendar and Gmail are only connected if you actively initiate this and give your consent.
- We do not broker bookings and we do not sell data.
- Any connection and any subscription can be revoked individually at any time.
1. Data Controller
The operator of next-plans is responsible for data processing.
J. Haitz, Feldstrasse, Hirzel (Switzerland) · info@next-plans.com
2. Account and profile
When you register, we process your email address and – if logging in with Google – also the name and profile picture from your Google account. You may voluntarily provide a display name (pseudonyms allowed), a holiday canton and a work canton. Purpose: Provision of the account and calendar defaults. Basis: Contract or your consent.
3. Planning data
Your holiday slots, planned holidays, preferred windows (period, regions, budget, guests, children, flexibility) and detected bookings are saved in your account and displayed only to you. Access is restricted to your account at database level.
4. Connection with Google (explicit consent)
The connection with Google Calendar and Gmail is optional and starts exclusively when you trigger it yourself in the settings. In the Google window, you will see the requested permissions and must explicitly agree to them. Without this consent, we do not access any Google data.
Which Google permissions next-plans uses – and why
- Google sign-in (email, name, profile picture)
- So you can sign in without an extra password. No access to your calendar or emails is involved.
- openid · .../auth/userinfo.email · .../auth/userinfo.profile
- Read and write Google Calendar
- next-plans writes your planned holiday windows as events into a dedicated calendar and picks up changes you make there, so your holiday planning stays current on every device. Other calendars and your contacts are never read.
- https://www.googleapis.com/auth/calendar
- See section b) Google Calendar sync below for details.
- Read Gmail (only when you explicitly start it)
- next-plans searches your inbox for booking confirmations and imports the accommodation plus check-in and check-out dates as a holiday slot. No emails are sent, deleted or modified, and no message content is stored permanently.
- https://www.googleapis.com/auth/gmail.readonly
- See section c) Gmail scan, and section 6 for the AI processing involved.
- Optional and revocable at any time
- You start both connections yourself in the settings and can disconnect them there at any time. The access tokens are deleted afterwards. next-plans does not sell data and does not use Google user data for advertising or for training AI models.
- See section d) Access tokens and revocation, and section 8 on deletion.
More details: Google API Services User Data Policy · Connected apps in your Google Account · Terms of use · Legal notice & contact
a) Google Login
When logging in with Google, we only receive your email address, name and profile picture. No access to calendar or emails.
b) Google Calendar sync
- We read events from your chosen calendar and write your next-plans slots as events there (two-way sync).
- We store calendar ID, event IDs, change markers (ETag) and a synchronisation token so that changes can be assigned correctly.
- Other calendars or contacts are not read.
- You can disconnect the sync at any time in the settings; after that, the access keys will be deleted. Events already created remain in your Google Calendar until you delete them there.
c) Gmail scan for bookings and holiday deals
- At your request, we search your inbox (read-only) for messages from known travel providers and senders you have added yourself.
- The contents of these messages are processed by an AI service for extraction (see Section 6). Only key details are saved: provider, title, period, location, price, reference and the message ID for duplicate detection.
- We do not send any emails from your account and do not delete or change anything in your inbox.
- The scan only runs if you start it or enable automatic scanning.
d) Access keys and revocation
The access keys issued by Google are stored encrypted on our server and are never shared with your browser or third parties. You can revoke access at any time via Settings → Disconnect, or additionally in your Google Account under 'Connected apps'.
e) Google API Services User Data Policy – Limited Use
next-plans' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In concrete terms:
- We use data from Google Calendar and Gmail solely to provide the user-facing features of next-plans (holiday calendar sync and detection of booking confirmations).
- We do not transfer this data to third parties except as necessary to provide those features, with your explicit consent, for security purposes, or to comply with applicable law.
- We do not use this data for advertising – neither personalised nor otherwise – and we do not sell it.
- We do not use this data to develop, train or improve generalised AI or machine learning models. For booking extraction the message content is only passed to the model at runtime and is never used for training.
- Humans do not read this data unless you have given explicit consent (for example in a support request), it is necessary for security or to resolve a technical issue, or we are required to do so by law.
6. Use of AI
To evaluate booking and deal emails, as well as for text suggestions and image generation in the accommodation section, we use AI models via the Lovable AI Gateway (including Google Gemini). Only the required content is transmitted; the models are not trained on your data. Processing takes place on servers in the USA.
7. Data processors and third countries
We use the following service providers as data processors. They process data exclusively on our behalf and according to our instructions:
Lovable Cloud / Supabase (database, sign-in, file storage)
Operation of the database, authentication and storage of uploaded images. The infrastructure runs on Amazon Web Services (AWS); servers are located in the EU, though access from the USA by the US parent company cannot be ruled out.
Data processing: EU / USA
Lovable AI Gateway (AI models, including Google Gemini)
Evaluation of booking and deal emails, text suggestions and image generation. Processing on servers in the USA.
Data processing: USA
Cloudflare (email forwarding to your personal inbox address, Turnstile bot protection, DNS)
Receiving and forwarding booking emails sent to your next-plans address, and protecting sign-in forms against automated access. Processing is distributed globally, including in the USA.
Data processing: USA / worldwide
Google Places API
Retrieval of public information about accommodations (name, address, reviews) for accommodation profiles. No user accounts are transmitted.
Data processing: USA
Google Maps Static API
Generation of map sections on accommodation profiles. The request is made via our server, so your IP address is not transmitted to Google.
Data processing: USA
Google Calendar and Gmail (only if you explicitly connect them)
Synchronisation of your holiday windows and detection of booking confirmations. See the section on Google permissions for details.
Data processing: USA
Email delivery via notify.next-plans.com (Lovable)
Sending sign-in, confirmation and deal emails.
Data processing: EU / USA
Legal basis for disclosure abroad: Some of these providers process data in the USA or in other countries without an adequacy decision by the Swiss Federal Council. The disclosure is based on Art. 16 para. 2 lit. d revFADP in conjunction with the EU Commission's Standard Contractual Clauses (in the version recognised by the FDPIC with Swiss amendments), supplemented by technical and organisational measures such as encryption in transit and data minimisation. For providers certified in the USA, the Swiss-U.S. Data Privacy Framework additionally applies. Where the Google Calendar or Gmail connection is concerned, the transfer is additionally based on your explicit consent (Art. 17 para. 1 lit. a revFADP), which you can withdraw at any time.
You can request an up-to-date list of the service providers used and copies of the Standard Contractual Clauses at info@next-plans.com.
8. Retention Period and Deletion
We store your data for as long as your account exists. You can delete individual slots, bookings and holiday deals at any time.
Delete your account and all data: You can delete your account yourself at any time – sign in and go to Settings → Delete account. This irreversibly removes your profile, holiday slots, bookings, subscriptions as well as all stored Google access tokens and the data imported from them. Alternatively, an informal email to info@next-plans.com is enough; we will then delete your account together with all associated data.
9. Your Rights
You have the right to access, rectification, erasure, restriction, data portability and objection, as well as the right to revoke any consent given at any time with effect for the future. To do so, please contact us at the address listed above.
Status: Version 2026-07. In the event of significant changes, we will request your consent again.