Holafly

Is Holafly safe?

Yes, for buying travel data. Holafly is an Irish company, we found no breach, fine or advertising ruling against it, and its refund window of up to six months is long for the industry. It scores 65/100, five points below Airalo. The gap comes from advertising and security disclosure: Holafly shares more of your personal details for marketing, and it publishes less evidence about how it protects them.

What Holafly does with your data

Apple's privacy label is short. Your email, name, phone number, a user ID and a device ID are linked to you, and "other usage data" is used to track you across other companies' apps and websites. Coarse location is collected but not linked to you.

Google Play tells a fuller story. Holafly's data safety section says your name, email address, home address, phone number, payment information, approximate location and app interactions may be shared with other companies, each for purposes that include advertising or marketing. The privacy policy, reviewed in July 2026, confirms the direction. If you buy a plan or accept tracking cookies, Holafly builds a marketing profile from your product interests to target ads. It passes data to "programmatic advertising third party vendors" listed in its cookie banner, acting as both publisher and advertiser. Customer service calls may be recorded, including your voice.

Because the policy discloses more sharing than the App Store label, we score privacy on the policy. Two points count in Holafly's favour. It says it treats Global Privacy Control and Apple's App Tracking Transparency as valid opt-outs, and it says the local networks that carry your data see only technical identifiers (IMSI, MSISDN and IP address), not your name or payment details.

Some plans bundle extras such as AirHelp flight claims or Meeting Doctors telehealth and vet calls. When you switch one on, Holafly passes your name, email and plan dates to that company, which then handles your data under its own policy.

The "unlimited" question

Holafly's App Store name is "Holafly eSIM: Unlimited Data", and most of its plans are sold that way. The terms explain what that means: there is no fixed allowance that stops your data, but "your data coverage and speed may be subject to a network service provider's fair use policy". The operator can restrict speed or usage if it decides your use is excessive.

Holafly's help centre adds two limits. A slowdown under a fair-use policy lasts no more than one day, and your speed returns the next day. Hotspot sharing is not unlimited at all: each destination has its own hotspot allowance in the plan's technical specs. If you plan to share data with a laptop, check that number before you buy.

None of this is hidden, but it sits in the terms and help pages, not on the label. We found no ASA ruling on Holafly's ads. We score it as a consumer risk under scams and harmful content, not as a privacy problem.

Refunds

The refund policy is one of the better ones we have read. An eSIM bought from the website or app and never activated can be refunded in full for up to six months. If your phone is locked or incompatible, you get a full refund as long as you have not scanned the QR code or used data. Connection failures caused by Holafly or the local network can earn a full or partial refund, but only if you report them during the trip. Other cases may get a partial refund with a US$3.50 administrative fee. In the UK, the terms also point to the remedies under consumer law.

Security

Holafly's trust centre lists one certification, PCI DSS 4.0.1, which covers card payments. It says the company aims to gain more certifications "in the coming months". Airalo, by comparison, publishes ISO 27001 and SOC 2 Type II reports. We found no public bug bounty for Holafly on HackerOne or Bugcrowd and no reported breach. The trust centre lists Google Cloud, Adyen for payments and CrowdStrike among its subprocessors.

The policy says all communications use "end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary (HTTPS, SFTP, SSH)". Those are encryption in transit between two systems, not end-to-end encryption in the sense used by messaging apps. That is a small thing, but it is the kind of wording that makes a reader trust security claims less.

How to use Holafly more safely

1. Refuse tracking when the iPhone prompt appears, or turn off "Allow Apps to Request to Track" in Settings, which Holafly treats as an opt-out.
2. Decline marketing cookies on the website if you buy there.
3. Check the hotspot allowance and the fair-use note for your destination before paying.
4. Install the eSIM only when you are sure you will travel, since activation ends the easy refund.
5. Report any connection problem to support while you are still abroad, or the refund is not guaranteed.

How we scored it

Regulatory record (86) is the strongest factor, with no fine, order or advertising ruling found. Privacy (50) is the weakest, because Holafly shares contact, payment and location data for advertising. Security (66) and transparency and control (66) are held back by a single published certification and form-based rights requests. For an eSIM with stronger privacy tools, see Saily.