Security

All connections use TLS encryption, card payments are handled by a PCI-DSS certified processor (Stripe) so we never store full card numbers, and access to production data is restricted to authorised personnel. Full details and our responsible-disclosure policy are on the Security page.

Privacy & compliance

• GDPR — we honour access, erasure, rectification, portability and objection rights for EEA/UK individuals.
• CCPA/CPRA — California residents can exercise know, delete, correct and opt-out rights; we do not sell personal information.
• Cookies — a consent panel lets you control non-essential cookies at any time.
• Clear, dedicated Privacy, Cookie, GDPR and California notices are published and kept current.

Payment protection

Payments are processed by Stripe over encrypted connections. Your full card number never touches our servers. Refunds are returned to your original payment method under the cancellation terms shown at booking.

Honest booking practices

Prices, cancellation windows and any non-refundable portions are shown before you pay. Cancellation and refund terms are computed per supplier and booking by our cancellation engine — there are no hidden platform-wide penalties. If a booking cannot be confirmed, the payment is reversed in full.

AI trip planning

Our AI assistant offers suggestions and guidance to help you plan. It is a helper, not a guarantee: recommendations do not create a binding booking or price, and availability and terms are always confirmed against the real product before you pay.

Availability & reliability

The platform runs on managed infrastructure with routine backups, patching and monitoring so that bookings and account access remain available. We aim for high availability and continuously improve resilience; we do not publish a contractual uptime figure we have not committed to.

Accessibility

We target WCAG 2.1 Level AA and treat accessibility as an ongoing effort. See our Accessibility Statement for details and how to get help if you encounter a barrier.

Data location & transfers

Holiday Lydian is headquartered in the United States and uses reputable service providers that may process data internationally. Where required, transfers of EEA/UK personal data rely on appropriate safeguards such as Standard Contractual Clauses.