Cookie policy
Last updated: 2026-10-19
1. Which cookies we use
PEMESE uses strictly necessary and preference cookies, required for the application to work and to remember your settings. We do not use analytics, advertising or tracking cookies, we do not share information with third parties for advertising purposes, and we do not build profiles of anyone.
There is one exception and it is worth stating plainly: at the payment step of the booking engine, the Stripe gateway sets two cookies of its own to detect card fraud. They are not there when you arrive or while you browse: they are set only once you have asked to pay, on the screen where payment happens, and they serve only that. They are listed in the table in the next section.
Under Article 22.2 of the Spanish LSSI no prior consent is required for cookies that are essential to deliver the service you requested, and that covers all of the above: the application's, because without them there is no session, and the gateway's, because they are part of the payment you asked for. That is why the notice shown on entry is informational and not a consent barrier: at the moment it is shown there is no third-party cookie and no third-party code on the page.
2. Details
| Cookie | Purpose | Duration |
|---|---|---|
| __Secure-sh.session_token | Keeps you signed in. It is deleted when the browser closes, and the application also closes it after a while without use; each hotel sets how long under Team. In development, without HTTPS, it is simply named “sh.session_token”. | Browser session, closed on inactivity |
| sh_caducidad | Stores when the session expires through inactivity, so you can be warned before it closes. | Browser session |
| sh_actividad | Records when you last did something, so the session can be closed after a while unused. The server writes it on every navigation. | Browser session |
| active_company_id | Remembers the selected company when you belong to several. | 1 year |
| active_property_id | Remembers the selected property. | 1 year |
| NEXT_LOCALE | Remembers the chosen language. | Browser session |
| sidebar_state | Remembers whether the sidebar is collapsed. | 7 days |
| cookie_notice_ack | Remembers that you have already seen the cookie notice. | 1 year |
| __cf_bm | Set by Cloudflare, which serves the site, to tell a person from an automated program. It identifies nobody and is not used for advertising. | 30 minutes |
| cf_clearance | Set by Cloudflare once you have passed a security check, so it is not repeated on every page. | Up to 1 year |
| __stripe_mid | Set by Stripe, the payment gateway, when the property charges online: it is used to detect card fraud. It only appears on the pages where payment happens. | 1 year |
| __stripe_sid | Set by Stripe alongside the previous one and for the same purpose, but it only lasts as long as the payment. | 30 minutes |
| pemese:ultimo-error | Tab storage (sessionStorage), not a cookie: keeps the last error the application showed so it can be attached if you choose to report a bug. It does not leave the browser unless you report it. | Until the tab is closed |
3. The server's technical log
Besides cookies, the server records every request it receives: date and time, IP address, method, page requested —with the tokens in personal links and the address parameters masked—, response code, size, duration and the request headers, among them the browser and the language. It does not keep cookies or the referring page, not even when the request fails. It is a technical log, not a cookie and not a measurement tool: it does not follow anyone between visits, builds no profile, and is not cross-referenced with any account's data.
It serves two purposes: diagnosing an incident and spotting abuse —someone trying passwords, for instance—. The legal basis is legitimate interest in the security and correct operation of the service. It has no period in days but a size cap: about 50 MB, and once it is full the oldest entries are discarded. How many days fit depends on traffic, so we cannot give a figure: with little traffic it can be months (privacy policy, section 6).
4. How to disable them
You can block or delete these cookies from your browser settings. Bear in mind that, as they are strictly necessary cookies, blocking them will prevent you from signing in or using the application normally; and if you block the gateway's, you will most likely be unable to complete a payment.
5. Changes
If in the future we add analytics, advertising or tracking cookies, or any other that is not essential to deliver the service you ask us for, we will update this policy and ask for your prior consent through a panel where accepting and rejecting cost the same and sit at the same level. For any questions, write to us at [email protected].