spafindo

Legal

Cookie Policy

How Spafindo uses cookies — the strictly necessary ones needed to run the platform, and analytics or marketing cookies only if you allow them.

Last updated: 22 September 2026. This policy explains the cookies and similar technologies used by the Platform and its third-party services.

Current services: Google Analytics 4 is available only with your analytics consent. No advertising tool is active. Google Maps is a separate embedded service, described in section 5.

1. Who we are

This Cookie Policy applies to the website and booking platform operated by PRIVA SPA, S.L. (sociedad unipersonal), trading as "Spafindo" ("we", "us"), registered office Cl. Inglaterra – Faro Calaburra, 71, 29649 Mijas (Málaga), Spain, NIF B93940922. Contact: info@spafindo.com. Full identification is in the Aviso legal; what we do with the personal data behind these cookies is in the Privacy Policy.

2. What are cookies?

Cookies are small text files that a website stores on your device (computer, tablet or smartphone) when you visit. They let a site recognise your device, keep you signed in and understand how the platform is used. Similar technologies such as local storage can store information in the same way; in this policy we refer to them all as "cookies". This policy follows the AEPD Guía sobre el uso de cookies (2023) and Article 22.2 of Law 34/2002 (LSSI-CE).

4. Cookies we use

The entries below describe our platform cookies and storage, and the optional analytics and advertising tags. Embedded Google Maps is described separately in section 5.

  • Strictly necessary — always active, no consent required (Art. 22.2 LSSI). sb-…-auth-token, the Supabase sign-in cookie that keeps you signed in to your bookings or your spa dashboard (first party, session, refreshed for up to 12 months); lang, which remembers whether you chose English or Spanish (first party, 12 months); spafindo-consent, which stores your cookie choices so we do not ask again (first party, 12 months, set only once a banner exists); and the security and fraud-prevention cookies our payment provider Stripe sets on its own checkout page while you pay.
  • Campaign source — only with analytics consent. We store UTM campaign labels, the referring site’s origin and the landing path in sf_attribution (session storage and local storage, up to 12 months from collection). This can accompany a form or booking you submit and be stored with that request; campaign source and campaign name can also accompany Google Analytics events. We do not collect advertising click IDs in this record. Withdrawal deletes this browser record.
  • Analytics — only with your consent. Google Analytics 4, provided by Google Ireland Ltd., uses first-party _ga and _ga_* cookies to distinguish browsers and sessions. We set their expiry to 12 months, renewed on use while consent remains valid. Events measure public page views, suite views, searches and booking activity. We exclude query strings and URL fragments from event page URLs and do not send account or sign-in page views, guest contact details, payment tokens or gift redemption codes. A session-storage flag (sf_purchase:…) prevents duplicate purchase events after consent. Google also receives technical connection data, such as your IP address and browser information; this is not anonymous collection.
  • Marketing — inactive. Meta Pixel and advertising cookies are not enabled. There is no marketing switch while no marketing tool is configured. If we enable advertising in future, we will update this policy and request the corresponding consent before loading it.

5. Third-party cookies and processors

Stripe, our payment provider, sets security and fraud-prevention cookies on its own checkout page while you pay. Google Analytics loads on our platform only after analytics consent. No Meta advertising tag is active.

Where a provider is outside the EEA, the transfer is protected by the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework — set out in full in section 4.3 of the Privacy Policy. Each provider operates under its own policies: Stripe, Google, Meta.

Google Maps

When enabled, embedded Google Maps connects to Google as a map loads. This is separate from Google Analytics and Meta Pixel. Our Privacy Policy explains when maps load and the technical data Google receives. Google's cookie information and Privacy Policy describe the technologies used by its services and the available controls.

6. Managing cookies

You can change your choices at any time from "Cookie settings" in the footer — turning analytics off stops new measurement immediately and clears the analytics cookies and campaign storage we control. Most browsers also let you block or delete cookies from their settings (Chrome, Firefox, Safari, Edge); Google offers a browser add-on to opt out of Google Analytics. Disabling strictly necessary cookies may stop parts of the booking flow, including signing in, from working. Consult your browser's help pages for step-by-step instructions.

7. Changes to this policy

We may update this Cookie Policy to reflect changes in technology, the providers we use or applicable law. The "last updated" date shows the latest revision. If we introduce a new non-essential cookie, we will update this list and ask for your consent again beforehand.

Related: Privacy · Terms · Legal notice