Security Policy
Last Updated: February 2026
Website Security
- All connections to our website use secure transport (TLS/SSL), ensuring data transmitted between your browser and our servers is encrypted.
- Our website is hosted on Vercel, which enforces HTTPS on all pages.
- Internal API endpoints are protected with bearer token authentication and request validation.
- We apply reasonable technical and organizational safeguards to protect your personal information and reduce the risk of unauthorized access, alteration, or destruction.
Payment Security
- Payments are processed securely through PayPal Commerce Platform. Your card details are entered directly into PayPal's hosted payment interface and never touch our servers.
- We only receive a PayPal order ID and capture ID — we never see, store, or transmit your full card number, CVV, or expiration date.
- When applicable, PayPal handles additional verification such as 3D Secure / Verified by Visa / Mastercard Identity Check automatically.
- All prices are verified server-side before payment capture to prevent tampering.
- PayPal webhook events are validated using cryptographic signature verification.
- We recommend reviewing PayPal's Privacy Policy to understand how they handle your information.
PCI-DSS and Card Data Handling
- Our payment flow is designed to align with PCI-DSS principles by relying on PayPal's compliant payment platform and never directly handling card data.
- Never share your full card number, CVV, or one-time codes outside the secure PayPal checkout.
- Use only the embedded PayPal checkout on our booking page to enter payment details.
- Keep your device and browser updated for the best security.
- We will never ask you to send card details by email, WhatsApp, or chat. If anyone requests this, treat it as suspicious and contact us immediately.
Common Payment Errors and How to Fix Them
- Card declined: Confirm available funds and that your card is enabled for online and international purchases.
- 3D Secure not completed: If your bank shows a verification prompt, approve it and retry.
- Billing details mismatch: Ensure the name and address match your bank records.
- Temporary bank blocks: Some banks block unusual travel purchases — call your bank to authorize the transaction and retry.
- Browser/device issues: Try another browser, disable any VPN or proxy, or use a different device.
- Multiple attempts: Avoid many rapid retries; wait a few minutes to prevent automatic blocks.
If a payment fails, you will see an on-screen error message. Most issues are related to bank authorization or verification and can be resolved quickly with the steps above.
Duplicate Charges, Pending Charges, and Disputes
- Pending charge: Usually a temporary authorization that disappears if the payment was not completed. This is normal and typically resolves automatically.
- Duplicate charge: Contact us so we can verify settlement records with PayPal.
- Chargeback/dispute: We recommend contacting us first so we can resolve it faster.
If you believe you were charged incorrectly, contact us with your booking details and the approximate time of the transaction so we can investigate.
Reporting Suspicious Activity
If you suspect unauthorized use of your card or receive suspicious communications claiming to be from HolaBayahibe, contact your bank immediately and notify us.
We will never request your CVV or one-time bank codes over email, WhatsApp, or social media.
Contact
If you need help with a payment issue, please include your name, booking reference (if available), date and time of the attempt, and the error message shown.
For payment or security questions, reach out to us through our website.
Quick Tips for a Smooth Checkout
- Use a stable internet connection and complete the payment in one session.
- If your bank requires verification, keep your phone nearby to approve the transaction.
- If you get stuck, stop retrying and contact us — multiple rapid attempts can trigger bank security blocks.