Your data
Privacy Policy
In plain language
We collect the minimum data we need to book your flights, hotels, and shop orders — and to keep your account safe. We never sell your data and we never share it for advertising. You can download, correct, or delete everything we hold about you from your account settings.
This Privacy Policy explains how PalapaVibez LLC, an Oregon limited liability company (“we”, “us”, “our”) operating at palapavibez.com and shop.palapavibez.com, collects, uses, stores, and protects your personal information when you use our flight booking platform, hotel booking platform, and online merchandise shop (collectively, the “Service”).
By using the Service you agree to the collection and use of information described in this policy.
1. What we collect
Account information — name, email, hashed password when you register.
Flight booking information — passenger names, dates of birth, passport/ID numbers, contact phone, and billing address collected at checkout.
Hotel booking information — guest names, contact email and phone, room preferences, special requests.
Shop order information — name, email, shipping address, and phone collected when you purchase merchandise.
Payment information — credit/debit card details. Card numbers are processed directly by our payment processors (Stripe for flights and shop; LiteAPI for hotels) and are never stored on our servers.
Usage data — IP address, browser type, pages visited, search queries, device information collected automatically when you use the website.
Location data — approximate location inferred from your IP address to personalise flight search results (nearest airport) and determine your region for cookie-consent preferences. We do not access precise GPS location.
Error and diagnostic data — when errors occur, our self-hosted error tracking service (BugSink) may collect technical details such as error messages, browser/device info, and IP address to help us identify and fix issues.
2. How we use it
- Process and confirm flight, hotel, and shop bookings on your behalf.
- Send booking confirmation, itinerary, e-ticket, and order confirmation emails.
- Notify you of schedule changes, cancellations, or status updates.
- Send shop order status changes and shipping updates.
- Verify your identity and prevent fraud.
- Personalise your experience (e.g. show flights from your nearest airport).
- Improve the platform with cookie-less analytics (Umami) and aggregated cross-domain analytics (Google Analytics 4 — only when you have consented).
- Diagnose and fix errors using our self-hosted error tracking (BugSink).
- Convert prices to your local currency via exchangerate-api.
- Provide live chat support via our self-hosted Chatwoot widget.
- Provide visa-requirement guidance on flight search results via the Travel Buddy API.
- Comply with legal obligations.
4. Legal basis for processing (EU / UK)
If you are located in the European Union or United Kingdom, we process your personal data under the following legal bases (GDPR Art. 6):
- Contract performance — processing booking information, passenger details, and payment to fulfil your booking or shop order.
- Legitimate interests — fraud prevention, security monitoring, and platform improvement.
- Legal obligation — retaining financial records as required by applicable law.
- Consent — analytics cookies and marketing communications (where you have opted in). You may withdraw consent at any time.
5. How long we keep it
We minimise data retention. Each category of data has a specific lifetime — once that window passes, we delete or anonymise the data automatically through a scheduled retention job.
| Data category | Retention period |
|---|---|
| Account record (name, email, hashed password) | For the life of your account; deleted on closure |
| Booking records (flights + hotels) | 7 years (US tax + audit requirements), then deleted |
| Passenger PII (passport numbers, DOB) on closed bookings | Deleted at account closure (or sooner on request) |
| Saved passengers | For the life of your account; you can delete individual entries any time |
| Search history (departures, dates, queries) | 90 days, then deleted |
| Price-history aggregate (no user identifiers) | 30 days |
| Security event log (LOW / MEDIUM severity) | 90 days |
| Security event log (HIGH / CRITICAL — fraud, breach attempts) | 180 days (forensics window) |
| Newsletter signup (Lead table) | 2 years from signup, or until you unsubscribe |
| Shop abandoned-cart (email used for recovery emails) | 90 days |
| Raw IP addresses in error reports | 90 days, then truncated to /24 (network range only) |
| Marketing email list | Until you unsubscribe (one-click in every marketing email) |
| Payment records (Stripe metadata, no card numbers) | 7 years (US tax) |
Delete your account yourself. Sign in and go to Account → Settings → Delete account. This calls our DELETE /api/user/delete-account endpoint, which removes your user record, sessions, saved passengers, and profile, and anonymises associated bookings (order numbers preserved for accounting; PII stripped). A confirmation email is sent and your session is revoked immediately.
If you can’t sign in or prefer email, contact [email protected] and we will process the request manually within 30 days.
6. Your rights
You have the following rights regarding your personal data:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure(“right to be forgotten”) — request deletion of your data, subject to legal obligations.
- Restriction of processing — ask us to limit how we use your data in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests or for direct marketing.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Self-service paths:
- Access & portability (GDPR Art. 15 & 20): sign in and visit Account → Settings → Export my data to download a JSON file containing every record we hold about you — bookings, payments, profile, addresses, and password version (not the hash).
- Erasure (GDPR Art. 17): see Section 5 above.
- Rectification & preferences: update your name, email, phone, address, currency, and language under Account → Settings.
For all other requests (restriction, objection, withdrawal of consent) email [email protected]. We will respond within 30 days (one calendar month as required under GDPR).
EU/UK residents also have the right to lodge a complaint with your national data-protection authority. A list of EU DPAs is available at edpb.europa.eu. UK residents may contact the ICO.
7. California residents (CCPA)
If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:
- Right to know — request disclosure of the categories and specific pieces of personal information we collect, use, and share.
- Right to delete — request deletion of personal information we have collected from you (subject to exceptions).
- Right to correct — request correction of inaccurate personal information.
- Right to opt-out of sale/sharing — we do not sell or share your personal information for cross-context behavioural advertising.
- Right to non-discrimination — we will not discriminate against you for exercising any CCPA right.
To submit a CCPA request, email [email protected]with the subject line “CCPA Request”. We will respond within 45 days.
9. Security
We use multiple layers of security to protect your data:
- Encryption in transit. All connections are over HTTPS (TLS 1.2+).
- Encryption at rest. Sensitive personal data — passport numbers, date of birth, phone, passport expiry, nationality, shipping address, billing address, and hotel-guest contact info — is encrypted in our database using AES-256-GCM with a server-held key. The encryption key is stored separately from the database and protected by a 2-person recovery procedure.
- Password hashing. Passwords are hashed using bcrypt (rounds = 12). Raw passwords are never stored, logged, or transmitted in any reversible form.
- Session security. JWT-based sessions with a per-user revocation marker so password changes invalidate all active sessions immediately.
- Webhook verification. All inbound webhooks from Stripe, Duffel, Printify, and LiteAPI are cryptographically verified before any business logic runs.
- Rate limiting, fraud monitoring, and CSP on all sensitive endpoints.
No method of transmission or storage is 100% secure and we cannot guarantee absolute security. We notify supervisory authorities within 72 hours of becoming aware of a qualifying breach (see Section 10).
10. Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33). If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay (GDPR Art. 34).
11. Children’s privacy
The Service is not directed to children under 18. We do not knowingly collect personal data from minors. If you believe we have collected data from a child, please contact us and we will delete it promptly.
12. International data transfers
Your data may be processed in countries outside your own. The processors we use are located in:
- Duffel — United Kingdom.
- LiteAPI — Hong Kong and the European Union.
- Stripe — United States and Ireland (depending on the Stripe entity responsible for your region).
- Printify — United States, with print partners in the US, EU, UK, and other regions depending on destination.
- Resend — United States.
- Google (OAuth, GA4) — United States.
- exchangerate-api, Travel Buddy — United States.
- Cloudflare — global edge with US headquarters.
- Our database, Umami, BugSink, Chatwoot, Uptime Kuma — self-hosted in the European Union (Germany).
Transfers are carried out using appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission where applicable, ensuring your data receives an equivalent level of protection wherever it is processed.
13. Changes
We may update this Privacy Policy. Material changes are tracked in the policy changelogand we will notify you by email or by displaying a notice on the website. The “Updated” date at the top reflects the most recent revision.
14. Contact
For privacy-related questions or requests: [email protected] or use our contact form.