Full cookie notice
Cookie Policy
www.hotely.ai website and Hotely.ai platform — Art. 13 Regulation (EU) 2016/679 and Art. 122 Italian Legislative Decree 196/2003
Version of 17 October 2026
This is a translation of the Italian original; in case of discrepancy the Italian version prevails.
1. Data controller
| Controller | Aurora Technologies S.r.l. Registered office: Via Fornace 40, 20033 Solaro (MI), Italy VAT no. and tax code: 14056600969 |
| Contacts | Email: privacy@auroratechnologies.ai Certified email (PEC): auroratechnologies@pec.it |
This notice supplements the Privacy Policy and covers cookies and similar technologies used on www.hotely.ai and in the reserved area of the Hotely.ai platform.
2. What cookies are
Cookies are small text files that a website stores on the user's device and reads back on later visits. Similar technologies — the browser's local storage, pixels and scripts that read information from the device — follow the same rules and are also called "cookies" in this notice.
First-party cookies are set by hotely.ai; third-party cookies are set by another domain (for example Google, Microsoft or Meta) through services embedded in the site.
3. The categories we use and their legal basis
- Technical — needed to run the site and provide the services you request (sign-in, security, language, remembering your cookie choices). No consent required (Art. 122(1) Italian Privacy Code); legal basis: performance of a contract or of steps you requested, and our legitimate interest in a secure site (Art. 6(1)(b) and (f) GDPR).
- Statistics — measure how the site is used so we can improve it. We do not treat them as technical cookies: they are enabled only with your consent (Art. 122 Italian Privacy Code; Art. 6(1)(a) GDPR).
- Marketing — measure our advertising campaigns and allow Hotely ads to be shown on other websites. Enabled only with your consent (Art. 122 Italian Privacy Code; Art. 6(1)(a) GDPR).
Until you make a positive choice, statistics and marketing scripts are not loaded: no request is sent to their servers and none of their cookies is written. We do not use cookies for automated decisions producing legal effects concerning you.
4. Detailed list of cookies
The list below is generated from the same configuration the site uses to load these tools: what you read here is what the site actually does.
4.1 Technical cookies (always on)
Hotely.ai
| Provider | Aurora Technologies S.r.l. (controller) |
| Purpose | Running the website and platform: account sign-in, security, language, display preferences and remembering your cookie choices. |
| Where | Whole site |
| Name | Purpose | Duration | Type |
|---|---|---|---|
hotely_consent | Remembers your cookie choices | 6 months | First party |
| Sign-in session | Keeps you signed in (protected cookies, not readable by scripts) | Up to 30 days | First party |
| Security | Protects sign-in, forms and connecting external services against forged requests | Session or a few minutes | First party |
| Language | Remembers your language | 1 year | First party |
| Customer area preferences | Remembers the open workspace and panel layout | Up to 30 days | First party |
| Theme | Light or dark theme | Until cleared | Local storage |
| Session and accessibility | Keeps sign-in in sync across open tabs and remembers how the browser handles keyboard navigation | Until cleared | Local storage |
| Chat assistant | Resumes the assistant conversation you opened | Until cleared | Local storage |
Vercel Web Analytics
| Provider | Vercel Inc. (processor) |
| Purpose | Aggregated, anonymous visit counts — no cookies, nothing stored on your device, no individual visitor identified. |
| Where | Whole site |
| Non-EU | Possible transfer to the United States — EU-US Data Privacy Framework adequacy decision (10 July 2023, Art. 45 GDPR) and standard contractual clauses (Art. 46 GDPR) |
| Privacy | https://vercel.com/docs/analytics/privacy-policy |
No cookies: nothing is stored on the user's device.
Stripe
| Provider | Stripe Payments Europe Ltd (independent controller for payments) |
| Purpose | Secure subscription payment and fraud prevention. Loads only on payment pages. |
| Where | Payment pages |
| Non-EU | Possible transfer to the United States — EU-US Data Privacy Framework adequacy decision (10 July 2023, Art. 45 GDPR) and standard contractual clauses (Art. 46 GDPR) |
| Privacy | https://stripe.com/privacy |
| Name | Purpose | Duration | Type |
|---|---|---|---|
__stripe_mid | Fraud prevention | 1 year | First party |
__stripe_sid | Session fraud prevention | 30 minutes | First party |
m | Fraud prevention (m.stripe.com) | Up to 2 years | Third party |
4.2 Statistics (with consent)
Google Analytics 4
| Provider | Google Ireland Ltd |
| Purpose | Usage statistics (pages, referrer, device) to improve the site. Advertising features and Google Signals are off; IP addresses are not logged. |
| Where | Website and customer area |
| Non-EU | Possible transfer to the United States — EU-US Data Privacy Framework adequacy decision (10 July 2023, Art. 45 GDPR) and standard contractual clauses (Art. 46 GDPR) |
| Privacy | https://policies.google.com/privacy |
| Name | Purpose | Duration | Type |
|---|---|---|---|
_ga | Distinguishes visitors | 13 months | First party |
_ga_<ID> | Keeps session state | 13 months | First party |
Microsoft Clarity
| Provider | Microsoft Ireland Operations Ltd |
| Purpose | Heatmaps and pseudonymous session replays on public pages, to see where the site is unclear. Never runs in the customer area. |
| Where | Public pages only |
| Non-EU | Possible transfer to the United States — EU-US Data Privacy Framework adequacy decision (10 July 2023, Art. 45 GDPR) and standard contractual clauses (Art. 46 GDPR) |
| Privacy | https://privacy.microsoft.com/privacystatement |
| Name | Purpose | Duration | Type |
|---|---|---|---|
_clck | Random visitor ID | 1 year | First party |
_clsk | Joins page views into one visit | 1 day | First party |
CLID | Recognises the browser across sites using Clarity (clarity.ms) | 1 year | Third party |
MUID, MR, SM, ANONCHK | Identify the browser across Microsoft domains (bing.com, clarity.ms) and sync its ID | Session to about 1 year | Third party |
4.3 Marketing (with consent)
Meta Pixel
| Provider | Meta Platforms Ireland Ltd (joint controller for collection, Art. 26 GDPR) |
| Purpose | Measuring our Facebook and Instagram campaigns and showing Hotely ads to people who visited the site. |
| Where | Public pages only |
| Non-EU | Possible transfer to the United States — EU-US Data Privacy Framework adequacy decision (10 July 2023, Art. 45 GDPR) and standard contractual clauses (Art. 46 GDPR) |
| Privacy | https://www.facebook.com/privacy/policy/ |
| Name | Purpose | Duration | Type |
|---|---|---|---|
_fbp | Identifies the browser for campaigns | 3 months | First party |
fr | Advertising and measurement (facebook.com) | 3 months | Third party |
_fbc | Remembers the Meta ad click you arrived from | 3 months | First party |
Hotely campaign attribution
| Provider | Aurora Technologies S.r.l. (controller) |
| Purpose | Understanding which ad or campaign brought someone who later signs up, by linking the visit to the sign-up. |
| Where | Campaign landing pages |
| Name | Purpose | Duration | Type |
|---|---|---|---|
hly_vid | Random visit ID | 6 months | First party |
5. How to give, refuse or withdraw consent
- On your first visit a banner asks you to choose: Accept all, Reject all or Customize by category. The accept and reject buttons are equally prominent.
- Closing the banner with the X counts as a refusal: you keep browsing with technical cookies only. Scrolling or clicking elsewhere is not consent.
- Your choice is kept for 6 months in the technical cookie
hotely_consent. We won't show the banner again before then, unless the tools or purposes described here change significantly (in that case we update the version of this notice and ask you again). - You can change your mind at any time from the "Cookie preferences" link at the bottom of the pages, the cookie icon at the bottom left, or the button below. Withdrawal applies from that moment and does not affect the lawfulness of earlier processing; when you withdraw a category we delete its first-party cookies from your device.
You can also block or delete cookies in your browser settings: Chrome, Firefox, Safari, Edge. Blocking technical cookies may prevent access to the reserved area.
6. Record of choices
To be able to demonstrate consent (Art. 7(1) GDPR) we record every choice made in the banner: a random ID for the choice (the same one stored in your cookie and shown in the preferences panel), the date, the categories accepted or refused, the method (accept, reject, customize, closing with the X), the version of this notice, the page and the country derived from the network. We do not record IP addresses or browser data. Records are kept for 24 months and then deleted.
7. Third-party content
Some pages show YouTube videos (Google Ireland Ltd). We embed them in privacy-enhanced mode (youtube-nocookie.com) and the player only loads when you press play; from then on Google's privacy policy applies. The site's chat assistant is our own service and only uses the technical storage described in section 4.1.
8. Websites and pages of client properties
Booking pages, websites, chats and guest portals that accommodation businesses publish with Hotely.ai (including on their own domains) are the responsibility of the property, which is the data controller; Hotely.ai acts as data processor. We do not load our own statistics or marketing tools on those pages. Any cookies enabled by the property are governed by that property's own cookie policy.
9. Transfers outside the European Union
The providers listed in section 4 (Google, Microsoft, Meta, Stripe, Vercel) do not guarantee that data stays in the European Union: even when the contracting party is a European company, data may be transferred to its parent company in the United States. Transfers rely on the European Commission's adequacy decision of 10 July 2023 (EU-US Data Privacy Framework, Art. 45 GDPR), in which these providers participate, and on standard contractual clauses (Art. 46 GDPR) as an additional safeguard. Should the adequacy decision cease to apply, we will update this notice and the tools we use.
10. Your rights
You may at any time exercise your rights under Arts. 15–22 GDPR (access, rectification, erasure, restriction, portability, objection) and withdraw consent by writing to privacy@auroratechnologies.ai. To obtain the data of a recorded choice, quote the consent ID shown in the preferences panel. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the authority of your country of residence.
11. Updates
We update this notice when the cookies or tools we use change. If the change is significant we ask for your consent again through the banner. Version in force: 17 October 2026.