Cookies Policy
Cookies and similar technology
The Site uses cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Site is used.
Cookies are small pieces of information that a website stores on your device. Some cookies last only for your current browsing session and are deleted when you close your browser; others persist so we can recognise you on a later visit.
We use cookies to:
- keep you signed in as you move between pages;
- remember your language, currency, and colour theme preferences so you do not need to re-select them on every visit;
- remember that you have accepted our cookie notice;
- link requests from the same browsing session together, to help troubleshoot problems and protect the Site against automated abuse; and
- understand, in aggregate, how the Site is used so we can improve it.
The preference and session cookies listed below are set directly by us (first-party). We also use Google Tag Manager to load analytics tags, which may set Google Analytics cookies on your device — these are listed in the table below and explained under "Analytics". We do not use cookies for advertising or to build a behavioural profile of you across other websites. Other companies also load their own code on some pages and can store data on your device — our payment provider, our bot-protection provider, and the Google and Facebook sign-in buttons. They are listed under "Third-party services that can store data on your device" below.
Our cookies
| Cookie name | Purpose | Duration |
|---|---|---|
lang | Stores your preferred language and locale (e.g. en-gb, es-es) so you do not have to re-select it on every visit. | Persistent — 1 year. |
cur | Stores your preferred currency (e.g. GBP, EUR) so your chosen currency is remembered across sessions. | Persistent — 1 year. |
theme | Stores your chosen colour theme so the Site's appearance is consistent on return visits. | Persistent — 1 year. |
auth | Holds your first name and your account roles, so the Site can show you as signed in as soon as a page loads. It holds no password or security token — access to your account itself is separately secured. Deleted when you sign out. | Persistent — 30 days. |
correlation_id | A random identifier used to link the requests you make during your visit together, to help us troubleshoot problems and detect abuse. | Session — deleted when you close your browser. |
_ga | Set by Google Analytics, loaded through Google Tag Manager, to tell visitors apart so we can measure Site usage in aggregate. Only set while analytics tags are active. | Persistent — 2 years. |
_ga_* | Set by Google Analytics to keep the state of your visit for the property being measured. Only set while analytics tags are active. | Persistent — 2 years. |
_gid | Set by some Google Analytics configurations to tell visitors apart over a short period. Only set while such tags are active. | Persistent — 24 hours. |
Other technologies we store on your device
As well as cookies, we store a small amount of information in your browser's local and session storage. This is not a cookie — it is not sent to our servers with every request — but it is kept on your device, so we list our own storage here in full. The third-party services listed below store data of their own; because we do not control what they store, we describe them in that section rather than key by key.
Local storage stays on your device until you clear your browser's storage. Signing out removes the sign-in details it holds (in persist:travel and token-refresh-handoff), but the other entries below stay:
| Name | Purpose |
|---|---|
persist:travel | Keeps you signed in between visits and remembers your recent searches. It holds your name, email address and account permissions, the security tokens that identify you to us, and the search criteria you have used. |
persist:travel-recently-viewed | Remembers the hotels you have recently looked at so we can show them to you again. |
theme | Stores your chosen colour theme (this mirrors the theme cookie listed above). |
terms | Records that you have accepted this cookie notice, so the banner is not shown to you again. |
search | Remembers whether you last searched for hotels or transfers, so the search form opens on the right tab. |
token-refresh-handoff | A copy of your current security tokens, including the one that keeps you signed in. If you have the Site open in more than one tab, it lets each tab stay signed in without using a token another tab has already replaced. Kept until you sign out, then deleted. |
Session storage is deleted automatically when you close the browser tab:
| Name | Purpose |
|---|---|
persist:travel-session | Holds the booking you are in the middle of making — the hotel, rooms, dates and prices you have chosen, and any transfers you add with their flight numbers — so a page refresh does not lose it. |
persist:travel-transfer-search | Holds the transfer booking you are in the middle of making — the route, dates, flight number, passengers, vehicles and prices you have chosen — and what you enter at the transfer checkout: the lead passenger's name, email address and phone number, any requests, and the invoice details when you give them (who the invoice is for, the ID document type and number, and the address). When you are signed in, the invoice details are filled in from your account. These details are deleted once your transfer is booked, or when you sign out. They are used only while the same account is signed in (or, if you entered them without signing in, while nobody is); otherwise they are deleted. Once booked, it holds the booking reference and, if you booked without signing in, a booking access code; these are deleted when you sign out. |
booking-pending-…, transfer-pending-… | The details of a booking you are paying for, so it can be completed when you return from the payment provider. For a hotel booking: the hotel, rooms and price you chose, and the checkout form — the names of the lead guest and the other guests, children's ages, your contact details and address, any requests for the hotel, and invoice details including the recipient's tax or ID number (filled in from your account when signed in). For a transfer: the payment reference only. Your card details are never stored here — Stripe handles those. Deleted once the booking is completed, or when you close the tab. If the payment does not go through, the form is kept as the checkout draft described below, which signing out deletes. While a payment is going through, signing out does not delete it, but it is then used only for the account that started the payment. |
booking-session-…, transfer-session-… | The outcome of a booking you have just made, so the confirmation page can show it again when you return from the payment provider or reload the page. It holds the booking reference, your email address and, if you booked without signing in, a booking access code that opens your booking. For a transfer it also holds the lead passenger's name and phone number and the transfers you booked. When you sign out, your email address, the booking access code and the lead passenger's name and phone number are removed from it; the rest stays, so going back to the checkout cannot charge you twice. |
booking-draft-… | What you have entered in the hotel checkout form — the names of the lead guest and the other guests, children's ages, your contact details and address, any requests for the hotel, and invoice details including the recipient's tax or ID number (filled in from your account when signed in) — so going back from the payment step does not lose it. Your card details are never stored here. Deleted once your booking is made, or when you sign out. It is used only while the same account is signed in (or, if you entered it without signing in, while nobody is); otherwise it is deleted. |
transfer-received-… | Records that we have received your payment for a transfer (the payment reference only, never your card details), so going back to the checkout does not charge you a second time. |
price-change-pending-… | Holds your booking while you decide whether to accept a change in price: the hotel, rooms and price you chose, and the checkout form — the names of the lead guest and the other guests, children's ages, your contact details and address, any requests for the hotel, and invoice details including the recipient's tax or ID number (filled in from your account when signed in). Your card details are never stored here. Deleted once you accept or reject the new price, or when you close the tab. Signing out deletes it, unless an amount is held on your card for this booking. In that case it is kept, but used only for the account that started the booking; for anyone else it is deleted and the hold is released. |
guest-token-… | The access token from the booking link we emailed you, so you can move around your booking without opening the email again. |
view-booking-ref, claim-booking-ref | The booking reference from the booking link we emailed you. We take it out of the page address so it is not recorded with the pages you visit, and keep it here so refreshing the page still finds your booking. |
3ds-return-… | The payment reference and the result your bank sends back after checking your payment, so the page that completes your booking still has them if you refresh it. We take them out of the page address for the same reason. Never your card details. |
booking-error-pi-… | The payment reference shown on the page that tells you a booking could not be completed, so you can quote it to us. Kept here rather than in the page address, so it is not recorded with the pages you visit. |
confirm-email-link | The email address and confirmation code from the link we sent to confirm your email address, so refreshing the page does not lose them. Deleted once the link has been checked. |
reset-password-token | The code from the password reset link we emailed you, so refreshing the page does not lose it. Deleted once you have set your new password, or once the code is found to have expired. |
tab-identity | A random identifier for this browser tab, so two tabs open at once cannot interfere with each other's booking. |
flash-toast | A confirmation or error message waiting to be shown to you on the next page. |
admin-return-path | Staff accounts only. The admin page you were on when your session ended, so you return to it after signing in again. Deleted as soon as it is read. |
chunkReloadAttempted | Records that we have already reloaded the page once after part of it failed to download, so we do not reload repeatedly. |
under-construction | Records that you have dismissed our "site under development" notice. |
You can clear all of this at any time through your browser's settings. Doing so signs you out and discards any booking you have in progress.
Third-party services that can store data on your device
Some pages load code from companies we work with, and those companies can set their own cookies or store data in your browser. We use them to run the Site — to take payment, to keep bots out, and to let you sign in with an account you already have — not for advertising. Google Tag Manager and Google Analytics are covered separately under "Analytics" below.
| Service | Where it loads | What it stores | Who controls it |
|---|---|---|---|
| Stripe — takes your payment and checks it for fraud | The payment step of a hotel booking and of a transfer booking. | Stripe's script sets two cookies on our domain: __stripe_mid, which identifies the device so payments can be checked for fraud (persistent — 1 year), and __stripe_sid, which ties the steps of a single payment together (session — about 30 minutes). | Stripe. Stripe privacy policy |
| Cloudflare Turnstile — checks you are a person, not a bot | Creating an account, resetting your password, confirming your email address, asking us to resend a verification email, and the contact form. | The check runs in a frame served by Cloudflare (challenges.cloudflare.com) and may store data on your device under that domain. It does not set a cookie on our own domain. | Cloudflare. Cloudflare privacy policy |
| Google Sign-In — lets you sign in with your Google account | The sign-in and sign-up forms, and the page shown after a booking. The sign-in itself only happens if you use the Google button. | Google's script is loaded with the page. Signing in happens on Google's own pages, where Google reads and sets its own cookies, and a small amount of data may be left in your browser. | Google. Google privacy policy |
| Facebook Login — lets you sign in with your Facebook account | The same pages as Google Sign-In. The sign-in itself only happens if you use the Facebook button. | Facebook's script is loaded with the page. It can set cookies on facebook.com and keep a record of the login attempt in your browser. | Meta. Meta privacy policy |
You can block these services in your browser, but the feature they support then stops working: you will not be able to pay, submit a protected form, or sign in with Google or Facebook.
Analytics
We use Google Tag Manager (GTM) to load the analytics tags used on the Site. Depending on which tags are active, GTM may set additional cookies (for example, Google Analytics cookies) to help us understand, in aggregate and without identifying you individually, how visitors use the Site. You can control or delete these cookies through your browser settings, or opt out of Google Analytics using the Google Analytics opt-out browser add-on.
Most internet browsers accept cookies automatically, but you can usually change your browser settings to erase cookies or prevent them being set. If you choose not to accept our cookies, some features of the Site — such as staying signed in or having your preferences remembered — may not work correctly. You can learn more about cookies and how to manage them by visiting www.allaboutcookies.org.
This page was updated 21 October 2026.