Cookie Policy
Last updated: 28 October 2026 · Version 1.0
This policy explains the cookies and similar storage technologies used on the CortoCasa website (cortocasa.com) and in the CortoCasa application (app.cortocasa.com), who sets them, what they do and how long they last. It is issued by Teleport Dynamix, S.L. (NIF B21782743), whose full details are in our Legal Notice.
1. What cookies are
A cookie is a small file stored on your device when you visit a website, which lets the site recognise your browser on a later request. The same rules apply to comparable technologies that read or write data on your device — such as localStorage and sessionStorage — and this policy covers those too, whether or not they are technically cookies.
Cookies can be first-party (set by us) or third-party (set by another organisation through our site), and session (deleted when you close the browser) or persistent (kept for a defined period).
2. Our approach
We set no analytics or advertising storage unless you accept it, and you can accept one without the other:
- Analytics — Google Analytics 4 and Microsoft Clarity session recordings, on the website and in the application, to understand how they are used and improve them.
- Advertising — Google Ads, on the website only, to measure which of our ads lead to sign-ups and to show our ads to people who have visited the site.
Until you choose, we do not load the Google or Microsoft scripts and we do not write analytics or advertising storage to your device. We use Google Consent Mode v2 in its basic form, with all four signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) set to denied by default; each is granted only by the choice that covers it. The application itself contains no advertising technology.
3. Cookies and storage we use
3.1 Marketing website — cortocasa.com
Strictly necessary
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
cc_consent | localStorage, first-party | CortoCasa | Records your choice for each category, so we do not ask again on every page | Until you clear it or change your choice |
cc_lead_sent | sessionStorage, first-party | CortoCasa | Set only with analytics consent, on the page shown after the contact form, so a form submission is counted once | Until you close the tab |
Analytics — only with your consent to analytics
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
_ga | Cookie, first-party domain, set by Google | Google Ireland Ltd | Distinguishes one visitor from another so we can count unique visits | 400 days |
_ga_XERZ4X0R4W | Cookie, first-party domain, set by Google | Google Ireland Ltd | Holds session state for our Google Analytics 4 property (measurement ID G-XERZ4X0R4W) | 400 days |
_clck | Cookie, first-party domain, set by Microsoft | Microsoft Ireland Operations Ltd | Clarity: keeps the same anonymous visitor identifier across pages and visits | 1 year |
_clsk | Cookie, first-party domain, set by Microsoft | Microsoft Ireland Operations Ltd | Clarity: joins the page views of one visit into a single recording | 1 day |
MUID, MR, SM, SRM_B, ANONCHK | Cookies, third-party (clarity.ms, bing.com) | Microsoft | Set by Microsoft's own domains when Clarity runs, to identify the browser to Microsoft's services and check that cookies work | Up to 1 year |
Advertising — only with your consent to advertising
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
_gcl_aw | Cookie, first-party domain, set by Google | Google Ireland Ltd | Holds the click identifier (gclid) Google adds to the address when you click one of our ads, so a later sign-up can be attributed to that ad | 90 days |
_gcl_ag | Cookie, first-party domain, set by Google | Google Ireland Ltd | The same, for the identifier Google uses for clicks from iOS apps (gbraid) | 90 days |
_gcl_ls | localStorage, first-party, set by Google | Google Ireland Ltd | Google's own record of the same click identifiers | 90 days |
| Google advertising cookies | Cookies, third-party (doubleclick.net, google.com and country domains) | Google Ireland Ltd | Set by Google's advertising domains to measure ad results and build audiences of past visitors | As stated in Google's policy at policies.google.com/technologies/cookies |
With advertising consent, when you follow a sign-up link from our website to app.cortocasa.com, the website adds the click identifier to that link. The application then keeps it as described in 3.2 and section 8.2 of our Privacy Policy. Without advertising consent, nothing is added.
3.2 Application — app.cortocasa.com
The application is a private, authenticated workspace. It uses no advertising technology. It does use storage that is necessary to keep you signed in and the service secure, storage that remembers your own settings, and — only with your consent — analytics.
Strictly necessary and functional
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
__cf_bm | Cookie, third-party | Cloudflare, Inc. | Bot management: distinguishes automated traffic from real users and protects the application from abuse. Set by our hosting provider's network layer | 30 minutes |
sb-…-auth-token | localStorage, first-party | CortoCasa, through our authentication provider | Holds your authenticated session so you stay signed in between page loads | Until you sign out or the session expires |
cc_consent | localStorage, first-party | CortoCasa | Records your analytics choice in the application | Until you clear it or change your choice |
cortocasa.locale, cortocasa.theme, cc_properties_view, cortocasa.reminders.*, cortocasa.a2hs.dismissed, cortocasa.storage.migrated.v1 | localStorage, first-party | CortoCasa | Remember settings you chose: language, colour theme, list layout, reminders, and whether you dismissed the "add to home screen" hint | Until you change them or clear your browser storage |
cortocasa.import-draft, cortocasa.ota-oauth.result | localStorage, first-party | CortoCasa | Keep your progress while you connect a booking platform, so the step survives a page reload or the platform's sign-in window | Removed when the step finishes; the draft expires after 1 hour |
cc.choose_company, cc.legal_notice_dismissed, tsr-scroll-restoration-v1_3 | sessionStorage, first-party | CortoCasa | After sign-in, shows the workspace picker once; remembers that you closed the notice about updated terms; restores your scroll position when you go back to a page | Until you close the tab |
cc_acq | localStorage, first-party | CortoCasa | Present only if you arrived from our website with advertising consent and a click identifier: holds that identifier and campaign labels until your workspace is created, then removed | Removed when the workspace is created; never kept more than 90 days |
| Paddle checkout | Cookies and storage, third-party | Paddle.com | Set by Paddle only when you open checkout, to process the payment and prevent fraud, under Paddle's own policy | As stated by Paddle |
Strictly necessary storage does not require consent under Article 22.2 of Ley 34/2002 (LSSI-CE), because it is used solely to carry out the transmission of a communication or to provide a service you have expressly requested. You cannot switch it off and still use the application.
Analytics — only with your consent to analytics in the application
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
_ga, _ga_V53RFM6HZM | Cookies, first-party domain, set by Google | Google Ireland Ltd | Google Analytics 4 for the application (measurement ID G-V53RFM6HZM): counts users and sessions; receives page templates and a pseudonymous user identifier, not the content of your records | 400 days |
_clck, _clsk and Microsoft's own cookies | Cookies | Microsoft Ireland Operations Ltd | Microsoft Clarity session recordings. The whole screen is masked, so no text from your workspace is recorded | As in 3.1 |
cc_analytics_sub:… | localStorage, first-party | CortoCasa | Remembers your plan's subscription state so analytics report it without asking the server again | Until you clear it |
The application asks for this consent separately from the website, in its own banner, because it is a different site. Your choice on one does not carry over to the other.
3.3 Things that are not cookies
- Server logs. Our hosting providers keep standard access logs, which include IP addresses, for security and troubleshooting. These are not written to your device, so they are outside the scope of this policy — see section 2 of the Privacy Policy.
- Guest-kit pages. Pages shared with guests set no analytics or advertising storage.
- Email. Our emails do not contain tracking pixels.
4. Google and Microsoft in detail
- Google Analytics 4 measures how the website and the application are used. Google acts as our processor under the Google Analytics data processing terms we have accepted. Google signals and data sharing with other Google products are switched off, and Google states that it does not log or store IP addresses collected through Google Analytics 4. Data is kept for no more than 14 months.
- Microsoft Clarity records sessions and heatmaps. On the website it masks what you type into form fields; in the application it masks the whole screen. Microsoft Ireland Operations Limited is our contracting party; Microsoft stores the data in its Azure cloud and may transfer it to Microsoft Corporation in the United States under the EU Standard Contractual Clauses.
- Google Ads — website only, with advertising consent. It measures which ads lead to sign-ups and lets us show our ads to past visitors. For this, Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms. With your consent we also send Google the click identifier and the date and time of a sign-up, and nothing else, so it can count the sign-up as a result of the ad (Privacy Policy, section 8.2).
- Transfers. Google Ireland Limited may transfer data to Google LLC in the United States. Google states that it relies on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses for those transfers; its own description is at policies.google.com/technologies/cookies.
5. Your choices
Through our banner. When you first visit the website, our banner offers three equal choices: accept all, reject all, or choose by category in Settings, where analytics and advertising each have their own switch, both off until you turn them on. Rejecting takes a single click, the same as accepting, and has no effect on how the site works. You can change your choice at any time using the "Cookie settings" link in the footer of every page. In the application, the same choice for analytics is in its own banner and under Settings → Cookies.
If you accepted our earlier banner, which covered analytics only, we treat that as consent to analytics and not to advertising. Advertising stays off unless you turn it on.
Withdrawing consent stops any further collection immediately. Cookies already set are not deleted by the withdrawal itself — use your browser controls below, or Google's opt-out add-on.
Through your browser. Every major browser lets you view, block and delete cookies:
Blocking strictly necessary storage will prevent you from signing in to the application. Blocking analytics or advertising cookies has no effect on either the website or the application.
Google's own controls. The Google Analytics Opt-out Browser Add-on stops Google Analytics on every site you visit, not only ours, and My Ad Center (myadcenter.google.com) controls the ads Google shows you.
6. Legal basis and how long consent lasts
Analytics and advertising storage are used on the basis of your consent — Article 6(1)(a) of Regulation (EU) 2016/679 (the GDPR) and Article 22.2 LSSI-CE. Strictly necessary storage relies on the exemption in Article 22.2 LSSI-CE. For the underlying processing: on the marketing website we are the controller and rely on our legitimate interest in keeping the site available and secure (Article 6(1)(f) GDPR); in the application, session and network-security data belonging to a customer's workspace is processed on that customer's instructions, as their processor, under the Data Processing Agreement.
We keep your choice until you change it or clear your browser storage, and we ask again if we add a cookie that materially changes what we described here. You can change your choice at any time, as described in section 5.
7. Changes to this policy
We update this policy whenever we add, remove or change a cookie. Where a change is material — a new purpose, a new third party, a longer duration — we ask for consent again rather than relying on the old choice. The "last updated" date shows the current version, and previous versions are archived at cortocasa.com/legal/archive/.
8. Contact
Questions about this policy, or about the data collected through it: privacy@cortocasa.com.
You can also exercise your data protection rights at that address, and you have the right to lodge a complaint with the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).