1. What cookies are
Cookies are small text files that websites store in your browser to remember information about your visit: language, logged-in session, preferences and similar settings. They are also used to measure site usage and improve the experience.
Together with cookies, we use similar technologies such as localStorage and sessionStorage, which are governed by this same policy. We do not use tracking pixels.
2. Types of cookies we use
We classify cookies into three categories:
- Technical (essential): required for the website to work or to provide what you ask for: they keep the session active, remember the language you choose, protect against CSRF attacks, keep the booking you are preparing and record affiliate attribution when you land on LEBBO via a referral link. They are exempt from consent under Article 22.2 of the Spanish LSSI.
- Analytics: help us understand how the service is used (Google Analytics). They are enabled only if you give consent: until you do, no Google tag is loaded and no data is sent to Google's servers.
- Marketing / advertising: we do not use any at the moment. The option appears in the banner in case we measure advertising campaigns in the future: they would only be enabled with your consent and we would add them to this list first.
3. Detailed list
| Cookie / storage | Owner | Category | Purpose | Duration |
|---|---|---|---|---|
sb-ewfhtnmvkiadketvsweg-auth-tokensb-ewfhtnmvkiadketvsweg-auth-token.<n> | First-party (via Supabase) | Technical | Authentication session (Supabase Auth). It may be split into several cookies with a numeric suffix when the value exceeds the maximum size. | Up to 400 days, sign-out or session expiry |
NEXT_LOCALE | First-party | Technical | Remembers the language you choose in the language selector. | Session |
lebbo_consent | First-party | Technical | Stores your cookie preferences (localStorage). | 12 months; after that we ask you again |
lebbo:booking-draft:*lebbo:reservation-hold:* | First-party | Technical | Keep the booking you are preparing (date, time, people) and the payment in progress, so they are not lost if you reload the page or sign in halfway (sessionStorage). | Session |
lebbo-pwa-install-dismissedlebbo-onboarding-intro-seen-* | First-party | Technical (preferences) | Remember that you closed the install-the-app notice or already saw a company dashboard guide, so they are not shown again (localStorage). | Until you clear local storage |
lebbo_affiliate | First-party | Technical (affiliate attribution) | Records affiliate program attribution when you arrive at LEBBO through a referral link. Cookie signed with HMAC-SHA256 that only contains an opaque identifier. Required for the program to work correctly and only set when you voluntarily click a /r/<code> link. | 30 days |
lebbo_acquisition | First-party | Technical (booking origin) | Stores first-touch whether the visit started on the LEBBO marketplace or on a company's own link/QR code. For the own channel, it contains signed opaque HttpOnly evidence; the origin is validated again and frozen when the booking is created. It is used exclusively to apply the correct contractual commission and prevent manipulation. | 30 days |
g_contacts_oauth_state | First-party | Technical (security) | Only for companies that connect their Google Contacts account: protects that connection against CSRF attacks. | 10 minutes |
lebbo_internal_traffic | First-party | Technical | Only in browsers of the LEBBO team or of companies: marks their visits so they do not count in analytics (localStorage). | Until you clear local storage |
__stripe_mid__stripe_sid | Stripe | Technical (payment) | Payment fraud prevention, managed by Stripe during checkout. | 1 year / 30 minutes |
_ga_ga_NYLYD87H2J | Google (Google Analytics) | Analytics | Google Analytics 4: distinguishes users and sessions to measure aggregate site usage. Only set if you accept the analytics category (Consent Mode v2). With them accepted, when you confirm or cancel a booking, or join LEBBO Club, our server reports it to Google Analytics under that same identifier (reference and amount; never your name, email or phone). | 2 years |
ga_fired_* | First-party | Analytics | Prevents counting the same event twice (for example, a purchase) if you reload the page. Only with your analytics consent (sessionStorage or localStorage). | Session, or until you clear local storage |
4. Third-party cookies
These services are involved in the website. Only Stripe and Google set their own cookies, and Google's only with your consent:
- Stripe — payments; fraud-prevention cookies during payment. See its cookie policy.
- Google Analytics — usage analytics, only with your consent. See its privacy policy.
- Cloudflare (Turnstile) — bot protection when signing in and on some forms; it does not set cookies on our domain. See its privacy policy.
- Supabase — database and session; the session cookie is LEBBO's own. See its privacy policy.
- Vercel — hosting; it does not set tracking cookies. More information.
- Sentry — error monitoring; it does not set cookies. More information.
5. How to manage cookies
You can manage your consent at any time from the button available on this page and in the website footer. Withdrawing it is as easy as giving it: when you do, we delete the Google Analytics cookies. We keep your choice for 12 months; after that we ask you again.
In addition, all browsers allow you to block, limit or delete cookies from their privacy settings:
6. Consequences of rejecting them
You can reject non-essential cookies without affecting basic browsing. Blocking technical cookies may prevent sign-in, the booking process from working correctly or payment anti-fraud protection.
The affiliate attribution cookie (lebbo_affiliate) is only set when you voluntarily click a /r/<code> link and is required for the affiliate program to operate. If you don't want to be attributed to any affiliate, simply avoid those referral links: the rest of the site works without it.
7. Updates
This policy may be updated to reflect changes in the technologies we use or in applicable law. The last review date appears at the beginning of the document. For any questions, you can contact us at privacidad@lebbo.es.