Sign in and recover access

Each person must use their own account. Sharing an account makes it impossible to know who performed an action and may expose information that person should not see.

Sign in#

1. Open https://holidario.com/auth/login.
2. Enter your email address and password.
3. Select Sign In.
4. If Holidario asks you to verify your email address, open the verification message and complete that step before continuing.
5. If you belong to more than one team, check the active team in your user menu.

Above the form you can also choose Google or Facebook. Holidario opens the account that uses the same email address as that provider; if none exists, it creates a new one. Choose the provider whose email matches your invitation so you do not end up with a second account.

If you are already signed in, opening the sign-in or registration page takes you to the dashboard. Dashboard access checks, including email verification and DPA acceptance when required, still apply.

If Holidario asks for DPA acceptance#

Acceptance of the Data Processing Agreement belongs to the active team, not to your personal account. When that team has not accepted the current version, Holidario displays the complete document before allowing access to private areas.

• If you have permission to manage the team, read the agreement, confirm that you can accept it on behalf of the organization, select the checkbox, and choose Accept and Continue. Holidario retains the team, accepting person, time, language, and exact document version.
• If you do not have that permission, the page reports that acceptance is pending. Contact a team administrator; do not share their account or try to bypass the review.

If another team is available to your account, select Switch team on this page and choose it. Only other teams where your membership is active and you have access are offered. The destination team still needs its own current DPA acceptance. Switching does not accept either team's agreement.

You can also select Log out without accepting the agreement. Signing back in keeps your selected team, so logging out alone does not resolve a pending DPA.

A new version can require a new acceptance. If the form rejects submission because the version changed while it was open, reload the document, review it again, and accept only the version currently displayed.

Two-step verification#

Two-step verification asks, as well as your password, for a 6-digit code from an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 1Password or another compatible app). Holidario never sends these codes by SMS.

To turn it on:

1. Open Profile > Settings > Account security and select Turn on. If you have not signed in within the last 15 minutes, Holidario first asks you to Confirm it's you.
2. Scan the QR code with the app, or type the key shown below it.
3. Enter the 6-digit code the app shows and select Turn on.
4. Keep the eight recovery codes somewhere safe. Each works once if you lose your phone, and they are not shown again.

From then on, after your password or Google sign-in, Holidario asks for the code. You can tick Don't ask again on this device for 30 days; changing your password or setting up another phone cancels that on every device.

Team admins, people who can manage a team and platform administrators need two-step verification. When Holidario sets a date, the dashboard says so; from that date these accounts must turn it on before continuing. A team can also require it of everyone from Account security.

Before some sensitive actions, such as changing roles, editing a company and its VeriFactu certificate, viewing or changing the SES.Hospedajes certificate, or editing provider credentials, Holidario asks you to Confirm it's you: the app code or, if you do not use two-step verification, your password. Signing in also counts. It does not ask again for 15 minutes. A form you open in that time, on its page or in a dialog, can be saved for 2 hours, even if the 15 minutes run out while you fill it in. If a dialog with such a form opens later, it shows Confirm it's you instead of the fields; after confirming you come back to the same page and can open it again.

If you sign in with Google or Facebook and do not use two-step verification, you can select Confirm with Google or Confirm with Facebook instead of typing a password. It only works with the same account you sign in to Holidario with. If you do not know your password and have no linked account, sign out and use Forgot your password?.

Certificate passwords are never shown after they are saved: leave the field empty to keep the saved one, or type the new one if you upload a certificate with a different password.

Reset your password#

1. On the sign-in screen, select Forgot Password.
2. Enter the email address for your account.
3. Open the link you receive. The link expires; request another one if it is no longer valid.
4. Set a new password and sign in again. For safety, a reset signs your account out of every open session.

If the message does not arrive, check your spam folder and confirm that you used the exact address you registered with. Never send your password to your agency or Holidario.

You are signed in but cannot see your work#

Signing in to Holidario and belonging to a team are separate things. Your administrator must also assign the appropriate roles and resources to you. First confirm the active team, then ask the administrator to review your access. Do not create another account in an attempt to solve the issue.

If you think someone knows your password#

Reset it immediately (every session will be signed out) and report the issue through the agreed support channel. Include the approximate time and any activity you do not recognize, but never include your old password or verification codes.