Legal
Privacy Policy
Last updated: 9 August 2026
1. Who we are
Holvario ("we", "us", "our"), based in the United Kingdom, provides a connected personal and business organisation platform. Holvario is the data controller for the personal data described in this policy. For any questions about this policy or your data, contact us at info@holvario.com.
2. What we collect
- Account data — your name, email and sign-in credentials, used to create and secure your account.
- Content you create — the records, notes, finances, tasks, documents and preferences you add across your hubs, stored so we can provide the service to you.
- Vault items — anything you store in the Vault is encrypted on your device before it reaches us. This is zero-knowledge: we only ever store ciphertext, cannot read your Vault, and cannot recover it if you forget your Vault passphrase.
- Usage & device data — basic technical information needed to run and secure the service.
We do not sell your personal data, and we do not use third-party advertising or cross-site tracking.
3. How we use it & our lawful basis
- To provide the service (store and show your data, authenticate you) — basis: performance of our contract with you.
- To keep the service secure and prevent abuse — basis: our legitimate interests.
- To contact you about your account or important changes — basis: contract / legitimate interests.
4. Who we share it with
We don't sell your data. We rely on trusted processors to run the service:
- Supabase — database, authentication and hosting. Your data is stored in the EU/UK (London region).
- Google (Gemini API) — used only when you send a message to Holly. See section 6.
Processors act only on our instructions.
5. International transfers
Your account data is stored and processed within the UK / European Economic Area (Supabase, London region).
One exception: when you choose to use Holly, the content of that request is sent to Google's Gemini API for processing, which may take place outside the UK/EEA. This happens only for messages you send to Holly — it does not happen in the background, and it never includes your Vault, which is encrypted on your device and which Holly cannot read. If you never use Holly, none of your data leaves the UK/EEA.
6. Holly (AI assistant)
Holly is powered by Google's Gemini API. When you send her a message, that message and the relevant workspace information needed to answer it are sent to Google for processing. Google does not use it to train their models.
Holly can read your Finance, Home, Adventures, Health, Hobby Tracker, Business and Trading data. She cannot read your Vault — that is encrypted on your device with a passphrase we do not hold. It is never sent to Holly; Holvario stores only the encrypted ciphertext. Holly drafts changes for your approval and does not act without your confirmation. See the Holly page for detail.
7. Storage & security
Data is transmitted over encrypted connections (TLS) and protected at rest, with access restricted per-user by row-level security. Optional two-factor authentication is available, and the Vault uses zero-knowledge encryption performed in your browser. See the Security page.
8. Retention
We keep your data for as long as your account is active. You can export everything or permanently delete all your data at any time from within Holvario.
9. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, object to processing, and data portability, and to withdraw consent at any time. You can self-serve export and deletion in Holvario, or contact us at info@holvario.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
10. Children
The service is not intended for anyone under 18, and we do not knowingly collect data from children.
11. Cookies
See our Cookie notice for how we use cookies and similar technologies.
12. Changes
We'll update this policy as the product develops and post the date of the latest version above.