Cookies policy

1. What cookies are and what we do with them

2. Cookies we use

Technical (no consent needed)

Needed for a service you ask for: remembering your cookie choice, resuming your request from our email or keeping a session open.

• hm_consent

  Store your choice in our cookie notice (what you accept and what you reject), so we do not ask you again on every page.

  Retention: 13 months

  Owner: Hipotecas.me (first-party)

• lead_rec, lead_rec_activa

  Resume your assessment request from the link in the email we send you. Only set if you click that link.

  Retention: 30 minutes

  Owner: Hipotecas.me (first-party)

• aportal_session

  Keep you signed in to the affiliate portal (only if you sign in).

  Retention: 30 days

  Owner: Hipotecas.me (first-party)

• authjs.* (sesión, CSRF, retorno)

  Staff sign-in to our back office (app.hipotecas.me). Not set for visitors.

  Retention: Up to 7 days

  Owner: Hipotecas.me (first-party)

Our own statistics and attribution (only with your consent)

Set by hipotecas.me to count visits and to know which campaign or partner brought a request. Attributing a request to a campaign or partner is not needed to prepare your assessment, so we treat it as ad measurement: without your consent nothing is stored in your browser, and the source is only recorded if you send your request during the same visit in which you arrived.

• vid

  Random ID for our own visit statistics (pages viewed). Not shared with third parties. Without your consent it is not set: the visit is counted with an ID that only lives while the tab is open.

  Retention: 1 year

  Owner: Hipotecas.me (first-party)

• gclid, twclid, utm_source, utm_medium, utm_campaign

  Campaign that brought you (Google Ads or X click ID and UTM tags), to attribute a request you send.

  Retention: 30 minutes

  Owner: Hipotecas.me (first-party)

• aref

  Code of the partner that referred you (?ref= link), to attribute your request to them.

  Retention: 90 days

  Owner: Hipotecas.me (first-party)

Google: analytics and advertising (only with your consent)

We use Google Analytics (statistics) and Google Ads (measuring our ads). Until you accept, Google's tags run in consent-denied mode: they do not read or write these cookies. Names, purposes and retention as published in Google's official list of advertising cookies and its cookies page.

• _ga, _ga_*

  Google Analytics: distinguish visitors and keep the analytics session.

  Retention: 2 years

  Owner: Google Analytics

• _gcl_au, _gcl_aw

  Google Ads: measure how many clicks on our ads end in a request (conversions).

  Retention: 90 days

  Owner: Google Ads

• IDE

  Show and, if you accept, personalise Google ads on non-Google sites (doubleclick.net domain).

  Retention: 13 months

  Owner: Google (DoubleClick)

• DSID

  Recognise a signed-in Google user to respect their ad settings (doubleclick.net domain).

  Retention: 2 weeks

  Owner: Google (DoubleClick)

X (Twitter): advertising (only with your consent)

If you accept advertising cookies, we load the X pixel to see how many people who arrive from our ads on X send a request. If you do not accept them, nothing from X is loaded. Names as published on X's official cookies page, which caps their lifetime at 13 months in the European Union.

• _twpid, _twclid

  X (Twitter) pixel: measure how many clicks on our X ads end in a request (conversions).

  Retention: Up to 13 months

  Owner: X (Twitter)

• personalization_id, muc_ads, guest_id, guest_id_ads, guest_id_marketing

  X (Twitter): recognise your browser to measure and personalise its ads (x.com and ads-twitter.com domains).

  Retention: Up to 13 months

  Owner: X (Twitter)

Browser local storage

These are not cookies and never leave your browser. They keep what you do or ask for on the site, so they need no consent. You can clear them in your browser settings.

• leadform_draft, leadform_subrogacion_draft, leadform_inversa_draft: Draft of the form you are filling in, so you do not lose it if you reload (discarded after 48 hours).
• simulator-history, itp-history, hipotecas-me-favoritos: History of your simulations and transfer-tax calculations and the mortgages you mark as favourites in the comparison tool, until you clear it.
• hipo-chat-history, hipo-lead-sent, hipo-seen, hipo-lead-dismissed: Your conversation with Hipo, the AI assistant, and whether you already left your details or closed its prompt.
• hm_tu_caso: “Your case”: the figures you entered in the instant assessment (price, savings, income, age…), with no personal data, so the rest of the site can show your own repayments. Discarded after 6 months; you can delete it at any time with “Forget my case”.
• af_email: Your email on the affiliate portal sign-in, only if you choose to remember it.

3. Legal basis

• Technical cookies: exempt under article 22.2 LSSI-CE; they are strictly necessary for a service you ask for and need no consent.
• Our own statistics and attribution cookies: your consent. They are only set if you accept them in our cookie notice; if you withdraw it, we delete them from your browser.
• Google analytics and advertising cookies: your consent, category by category as you choose in the notice. Google acts as data processor for Google Analytics.

4. How to give, change or withdraw your consent

5. International transfers and contact