Cookie Policy

What the website uses

The website code uses functional browser storage for a language you choose and for continuity of an inquiry when changing language or following an inquiry link. It does not include analytics, advertising cookies, tracking pixels, third-party font requests or embedded maps.

The static pages do not create a website session cookie on an ordinary visit. A security session cookie is used only if an enabled contact form initiates its server-side security process. While the form is unavailable, it does not initiate that process. Separate hosting or network services may maintain technical records; the Privacy Policy explains the information involved.

Language preference — local storage

Name: holidayair-language. The test version under /codetest/ uses holidayair-language/codetest. Contents: en or es. Purpose: remember the language you manually select.

Duration: there is no programmed expiry. It remains until you change it, clear the site’s stored data, or your browser removes it. Reading the browser’s language to choose an initial version does not itself save a manual preference. This record is not an advertising identifier.

Inquiry continuity — session storage

Name: holidayair-transfer, or holidayair-transfer/codetest in the test version. Contents: the selected service, aircraft or operation and any inquiry fields already filled in, which can include name, email, telephone and message. Purpose: avoid losing your draft when you switch language or move through an inquiry link.

Duration: the destination page reads and removes this transfer record when restoring the draft. If navigation is interrupted, the browser’s session-storage lifetime and restoration behavior apply. It is not given a fixed expiry in minutes. Locally saved fields are not sent to Holiday Air merely by saving them; sending requires an available form and a deliberate submission. Avoid leaving personal drafts on a shared device.

Contact form security — conditional session cookie

Name: holidayair_session. Purpose: associate a security token with an inquiry attempt and help prevent forged submissions. It is a first-party browser-session cookie restricted to the contact API path (/api/, or /codetest/api/ in the test version), with Secure, HttpOnly and SameSite=Strict attributes.

Duration: a browser session; browser restoration settings may affect when session cookies disappear. The security token has a separate validity of 30 minutes, which is not a 30-minute expiry for the cookie. This cookie is conditional on an enabled form and its security request; it is not used for analytics or advertising.

The form service also maintains server-side abuse counters using a pseudonymous IP-derived identifier. Their counting window is ten minutes; this does not mean the associated server files are automatically erased after ten minutes. Those files are not cookies or browser storage.

Your controls

You can change the language with the language selector and clear or block this site’s cookies and storage in your browser’s site-data or privacy settings. Blocking storage can prevent the language choice or a draft from being preserved; blocking the security cookie can prevent an enabled form from sending. You can still use the published telephone and email channels.

There is no optional analytics or advertising category to enable in this website version. Browsing does not constitute consent to future tracking. If optional technologies are added, they require an updated notice and the choice or prior consent required by applicable law before activation.

External services, contact and updates

Maps, social networks, WhatsApp and other external services open only when you follow their links. They may use their own cookies and identifiers under their own policies. Sending email through your mail application is also governed by that provider’s settings; using Google Workspace for our business mail does not embed Google tracking scripts in this site.

Questions about these technologies or your information: info@holidayair.net. The responsible organization is Holiday Airlines Costa Rica S.A., trading as Holiday Air. See the Privacy Policy for contact details and rights. We will update this policy if the website’s technology changes.

Optional reCAPTCHA v3 security

When enabled for the inquiry form, Google reCAPTCHA v3 helps detect automated abuse. A notice beside the form identifies its use. Google loads only when you submit an inquiry, and may receive your IP address, browser, device and interaction information and use cookies, including _GRECAPTCHA. We verify the security result before accepting the inquiry. When disabled, the website does not load this service or request Google verification; the other form protections remain active.

Google determines how information collected by its service is handled and retained under its Privacy Policy and Terms of Service. You may use our published telephone or email instead. Enabling this integration requires review of applicable privacy and cookie requirements; reading a privacy notice does not itself provide consent where consent is required.