1. What we collect

Account information — name, email, hashed password when you register. Your account also holds the hotels and tours you save, your rewards points history, your in-app notifications and the places you recently viewed.

Hotel booking information — guest names, contact email and phone, room preferences, special requests.

Unfinished hotel bookings — if you reach hotel checkout and don’t finish, we keep your email, the hotel, your dates and party size so we can send you one reminder.

Tour booking information — the lead traveller’s name, email and (optional) phone, the number of adults and children, the date and time, any notes you add, and your answers to the guide’s questions.

Health and accessibility details — if you choose to tell us about an allergy, medication, mobility need or similar in a tour note or answer, we store it encrypted and use it only so your guide can run the trip safely.

Messages with your guide — the messages you and your guide exchange about a booking. Phone numbers, emails and links are masked before a message is stored. If either side reports a conversation, our staff can read it along with the reason given.

Reviews — the rating and text you leave after a tour, published with a display name made of your first name and last initial.

Payment information — credit/debit card details. Card numbers are processed directly by our payment processors (LiteAPI for hotels, Stripe for tours) and are never stored on our servers.

Guide and operator information — if you run tours with us: your name, business name, website, country, WhatsApp number, public profile (bio, photo, languages), and the compliance documents you upload (insurance certificates, business registrations, licences), with their issuer, reference number, dates and file. To pay you, Stripe collects your identity and bank details directly; we receive only the status of your payout account.

Guide sign-ups — if you sign up as a guide: your name, email, WhatsApp, country, company details and the tours you run. If you ask to be told when a tour opens (“notify me”): your email.

Support and feedback — what you write in a contact form, feedback form or support chat, your email if you give it, and the page and browser you sent it from. Support chat messages are read by the PalapaVibez support team.

Usage data — IP address, browser type, pages visited, search queries, device information collected automatically when you use the website.

Location data — approximate location inferred from your IP address to determine your region for cookie-consent preferences. We do not access precise GPS location.

Error and diagnostic data — when errors occur, our self-hosted error tracking service (BugSink) may collect technical details such as error messages, browser/device info, and IP address to help us identify and fix issues.

Where it comes from

• From you — most of the above, when you register, book, message or fill in a form.
• Google — your name, email and profile photo if you sign in with Google.
• Stripe and LiteAPI — whether your payment succeeded, and LiteAPI’s updates on the status of your hotel booking.
• Stripe — for guides, the status of your payout account.
• Your guide — whether you were checked in, and their replies to your messages and reviews.
• Cloudflare — your approximate country, from your IP address.

2. How we use it

• Process and confirm hotel bookings on your behalf.
• Take payment for tours, confirm them, give you a check-in code, send reminders before the trip and ask for a review afterwards.
• Share your tour booking details with your guide so they can run the trip.
• Pay our guides, check their compliance documents, and handle refunds and card disputes.
• Pass messages between you and your guide, and review conversations that are reported to us.
• Compare flight fares and refer you to the airline or travel agency to book and pay.
• Send booking confirmation emails.
• Notify you of schedule changes, cancellations, or status updates.
• Send you one reminder about a hotel booking you started but didn’t finish.
• Verify your identity and prevent fraud.
• Improve the platform with cookie-less analytics (Umami) and aggregated cross-domain analytics (Google Analytics 4 — only when you have consented).
• Measure and optimise our advertising with Meta (Facebook). The browser Meta Pixel loads only after you accept the advertising/analytics cookie category; with the same consent, completed hotel bookings are also reported to Meta server-side via its Conversions API using hashed identifiers.
• Diagnose and fix errors using our self-hosted error tracking (BugSink).
• Convert prices to your local currency via exchangerate-api.
• Offer an AI hotel assistant (“Concierge”), provided by LiteAPI, to help you find hotels.
• Comply with legal obligations.

3. Who we share with

We share your personal data only as necessary to provide the Service:

• Your tour guide — when you book a tour, the guide running it receives your name, phone number, party size, notes and answers, plus your messages. Guides may be outside your country, and may use your details only to run your booking.
• Other users and the public — reviews are public, with your display name (first name and last initial), along with any reply from the guide. Guide profiles are public.
• Travelpayouts / Aviasales — flight metasearch and affiliate network. When you click through to book, you leave our site and are subject to the airline’s or travel agency’s own privacy policy.
• Stripe — payment processing for tours, where PalapaVibez is the merchant of record. Tour checkout happens on a page Stripe hosts, so your card number is entered on Stripe’s systems and never touches ours. We see whether the payment succeeded and the amount; Stripe shows our staff the card brand and last four digits. Stripe also pays our tour guides and verifies who they are: to be paid, a guide completes Stripe’s own identity and bank-account checks through Stripe Connect, and the identity documents they submit go to Stripe, not to us — we hold only the resulting account reference and its status. Stripe is a US company and acts as a processor on our behalf. See Stripe’s privacy policy.
• LiteAPI — hotel booking technology and merchant of record for hotels. Guest data is transmitted to LiteAPI and onward to the hotel. Card details for hotel bookings are processed by LiteAPI’s payment processor and are never stored on our servers. When you complete a hotel booking we also send LiteAPI a small set of fraud-prevention signals about that request — your IP address, browser user-agent, browser language and country — so that a genuine payment is less likely to be declined. These are used to check the payment, not to profile you.
• LiteAPI Concierge — our AI hotel assistant is run by LiteAPI. What you type into it, and the page you are on, go to LiteAPI.
• Hotels and accommodation providers — your reservation details are shared with the property so they can prepare your room and contact you.
• Resend — transactional email provider. Your email is shared to deliver booking confirmations, order updates, and account notifications.
• Google (NextAuth + OAuth) — when you sign in with Google, your email and profile information are received from Google to authenticate your account.
• Google Analytics 4 — aggregated, cross-domain usage analytics (only when you have given analytics consent via the cookie banner). Pseudonymous identifiers and IP truncated to country level.
• Meta (Facebook) — advertising measurement, only when you accept the advertising/analytics cookie category. The Meta Pixel then sends page-view and event data to Meta. When you complete a hotel booking, our server also reports the purchase to Meta’s Conversions API with a hashed (irreversible) email, phone number, first and last name, plus your IP address, browser user-agent, Meta cookie identifiers and the order value, sharing an event ID with the pixel so Meta de-duplicates the two. Meta uses this to measure and optimise our ads and may match it to a Facebook or Instagram account. You can turn this off at any time via the cookie banner — see the Cookie Policy.
• exchangerate-api — no personal data is sent. Used server-side to fetch currency-conversion rates.
• BugSink (self-hosted at bugs.palapavibez.com) — error tracking. Technical error data may include IP address and browser info. Self-hosted on our own servers; not sent to third parties.
• Umami Analytics (self-hosted at analytics.palapavibez.com) — cookie-less site usage statistics. Does not set cookies, does not collect personal data, self-hosted on our own servers.
• Uptime Kuma (self-hosted at status.palapavibez.com) — uptime monitor. Only pings public endpoints; no customer data is shared.
• Cloudflare — DNS, WAF, edge routing. Sees standard request metadata (IP, user agent, requested URL). We do not deliberately share any customer-volunteered data with Cloudflare beyond what every HTTP request inherently contains. Cloudflare Turnstile also runs a bot check on some forms, which sees your IP address and browser signals.
• Cloud storage — photos on the site are stored with an S3-compatible storage provider. Guide compliance documents are kept in a separate, private bucket that only signed-in staff can open.
• Backblaze — our encrypted database backups are stored with Backblaze in the United States and kept for 30 days.
• OpenStreetMap — maps on hotel and tour pages load map tiles from OpenStreetMap, which receives your IP address.
• Professional advisers — lawyers, accountants, auditors, bankers and insurers, in the course of the professional services they provide to us.
• Business transfers — if we are involved in a merger, acquisition, financing, sale of assets, or an insolvency, your data may be disclosed to the prospective or actual counterparty and their advisers, or transferred to an acquirer, successor or assignee.
• Legal obligations — we may disclose information if required by law or court order.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Legal basis for processing (EU / UK)

If you are located in the European Union or United Kingdom, we rely on the following legal bases (GDPR Art. 6, and Art. 9 for health details):

Where we rely on consent, you may withdraw it at any time.

5. How long we keep it

We minimise data retention. Where a category below has a fixed lifetime, a scheduled job deletes the data once that window passes.

Delete your account yourself. Sign in and go to Account → Settings → Delete account. This removes your user record, sessions and profile. Your hotel bookings are unlinked from you, but the booking and guest details remain as financial records. On your tour bookings, your name, contact details, notes and answers are overwritten, and your messages to guides are replaced with “[message removed — account deleted]”. Your notifications, newsletter signup and guide sign-up entry are deleted.

If you have a tour still to come, deletion is refused until that booking is cancelled — your guide needs your name to check you in. Guide accounts are closed by email, because payouts and records have to be settled first.

If you can’t sign in or prefer email, contact [email protected] and we will process the request manually within 30 days.

6. Your rights

You have the following rights regarding your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — request deletion of your data, subject to legal obligations.
• Restriction of processing — ask us to limit how we use your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Self-service paths:

• Access & portability (GDPR Art. 15 & 20): sign in and use Account → Settings → Your Data & Privacy → Download my data. You get a JSON file covering your account, profile, addresses, hotel bookings and their guests and payments, tour bookings and their messages, unfinished hotel bookings, saved hotels and tours, points history, notifications, feedback, newsletter signups and a list of security events on your account. Credentials — your password hash and any linked-account tokens — are never included, and the file lists what it left out and why.
• Erasure (GDPR Art. 17): see Section 5 above.
• Rectification (GDPR Art. 16): update your name, phone, date of birth, addresses and display currency under Account → Settings.

• Objection to direct marketing (GDPR Art. 21): turn off Account → Settings → Travel deals at any time, or use the unsubscribe link in any marketing email. Booking confirmations, cancellations and security alerts are not marketing and continue regardless — you cannot be opted out of being told what happened to your own booking.
• Withdrawing cookie consent (GDPR Art. 7(3)): use Manage Cookies in the footer. It clears the stored decision and reopens the banner, so withdrawing is exactly as easy as giving.

For anything else (restriction of processing, or a question about a decision) email [email protected]. We will respond within 30 days (one calendar month as required under GDPR).

Before acting on a request we may ask you to confirm it from the email address on your account. If we refuse a request, we will tell you why, and you can appeal by replying to our decision. You may also make a request through an authorised agent.

EU/UK residents also have the right to lodge a complaint with your national data-protection authority. A list of EU DPAs is available at edpb.europa.eu. UK residents may contact the ICO.

7. Automated decisions

We make no decisions about you with legal or similarly significant effects by automated means alone. Some automated checks do run to protect the Service: Cloudflare Turnstile bot checks, rate limits, blocking IP addresses that behave abusively, and the fraud signals we pass to LiteAPI’s payment processor. A person reviews refunds, payouts and decisions about your account.

8. California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we collect, use, and share.
• Right to delete — request deletion of personal information we have collected from you (subject to exceptions).
• Right to correct — request correction of inaccurate personal information.
• Right to opt-out of sale/sharing — we do not sell your personal information. We do share limited data with Meta (Facebook) for cross-context behavioural advertising through the Meta Pixel and Conversions API described above. You can opt out at any time by declining the advertising/analytics cookie category in the banner or the “Manage cookies” footer link.
• Right to non-discrimination — we will not discriminate against you for exercising any CCPA right.

To submit a CCPA request, email [email protected] with the subject line “CCPA Request”. We will respond within 45 days. You can appeal a refusal by replying to our decision.

9. Cookies

We use cookies and similar technologies to operate the website, remember your preferences, and analyse traffic. See our Cookie Policy for full details.

10. Security

We use multiple layers of security to protect your data:

• Encryption in transit. All connections are over HTTPS (TLS 1.2+).
• Encryption at rest. Sensitive personal data — phone, date of birth, addresses, hotel-guest and tour-traveller contact details, tour notes and answers, messages between you and your guide, report reasons, and guide sign-up and notify-me contacts — is encrypted in our database using AES-256-GCM with a server-held key. The encryption key is stored separately from the database.
• Password hashing. Passwords are hashed using bcrypt (rounds = 12). Raw passwords are never stored, logged, or transmitted in any reversible form.
• Session security. JWT-based sessions with a per-user revocation marker so password changes invalidate all active sessions immediately.
• Webhook verification. All inbound webhooks are cryptographically verified before any business logic runs.
• Rate limiting, fraud monitoring, and CSP on all sensitive endpoints.

No method of transmission or storage is 100% secure and we cannot guarantee absolute security. We notify supervisory authorities within 72 hours of becoming aware of a qualifying breach (see Section 11).

11. Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33). If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay (GDPR Art. 34).

12. Children’s privacy

Accounts and bookings are for adults (18+). A tour booking can include children: we record only how many, unless you choose to tell us more in a note (for example an age or an allergy), which you give us as their parent or guardian. We don’t knowingly collect data directly from anyone under 18. If you believe we have, please contact us and we will delete it promptly.

13. International data transfers

Your data may be processed in countries outside your own. The recipients we use are located in:

• Travelpayouts / Aviasales — you leave our site to book; the airline or travel agency’s own privacy policy applies.
• LiteAPI (bookings and the Concierge assistant) — Hong Kong and the European Union.
• Stripe — United States.
• Your tour guide — wherever the tour runs, often in countries without an EU adequacy decision.
• Resend — United States.
• Google (OAuth, GA4) — United States.
• Meta (Facebook) — United States.
• exchangerate-api — United States.
• Cloudflare — global edge with US headquarters.
• Backblaze (database backups) — United States.
• Our database, Umami, BugSink, Uptime Kuma — self-hosted in the European Union (Germany).

When you give us your data directly we are receiving it, not transferring it. When we pass it on outside Europe we rely on the EU–US Data Privacy Framework where the recipient is certified, on the European Commission’s Standard Contractual Clauses, or — for passing your booking to your guide — on the transfer being necessary to perform the booking you asked for (GDPR Art. 49(1)(b)). Ask us for a copy of the safeguard used.

14. Changes

We may update this Privacy Policy. Material changes are recorded on the policy changelog, and where a change affects you, you will be asked to review it when you next sign in. The “Updated” date at the top reflects the most recent revision.

15. Contact

For privacy-related questions or requests: [email protected] or use our contact form.