Cookie Policy
3.1. What a cookie is
Cookies are small text files that a website stores in your browser. In this policy, "cookie" also covers similar technologies such as local storage (localStorage, sessionStorage).
3.2. Categories we use
| Category | Purpose | Consent |
|---|---|---|
| Strictly necessary | Session and security, keeping booking steps, Stripe payment and fraud-prevention cookies, storing your cookie choice, favourites you add | Not required. The site cannot work without them |
| Functional | Language, country, currency preference and chat history | Without consent, kept only for the duration of your visit. With consent, kept for 12 months |
| Analytics | Measuring how the site is used, in aggregate, with Google Analytics (pages viewed, device and browser type, approximate location) | Loaded only if you consent. Without consent, or once you withdraw it, Google Analytics is not loaded and its cookies are deleted |
| Marketing and advertising | Not used | - |
If marketing cookies or a new analytics tool are added, this policy will be updated and your consent will be asked again.
3.3. Cookie list
This list is compiled from the site's code and updated with every release.
Strictly necessary
| Name | Type | Purpose | Provider | Duration |
|---|---|---|---|---|
oy_consent | Cookie | Stores your cookie choices (accept/reject, version, date) so they are applied without asking again. | Otelyar (first party) | 12 months |
otelyar-session | Cookie | Session cookie (HttpOnly): recognises your signed-in account and secures form submissions. | Otelyar (first party) | 2 hours (of inactivity) |
XSRF-TOKEN | Cookie | Security token against cross-site request forgery (CSRF). | Otelyar (first party) | 2 hours |
oy_locale · oy_market · oy_currency | Cookie | Your language, market (nationality) and currency. Prices depend on the market, so these keep the same price from search to hotel to payment. | Otelyar (first party) | Browser session (12 months with your consent — see functional) |
oy_bt:* · oy_checkout:* · oy_bq:* | Session storage | Booking steps: guest form, booking access key and quote, so payment resumes after the 3D Secure redirect. | Otelyar (first party) | Until the tab is closed |
oy_search:* | Session storage | Key of the hotel search in progress, so results survive a page reload without searching again. | Otelyar (first party) | Until the tab is closed |
oy_favorites | Local storage | Hotels you save with ♡ without signing in. Written only when you add a favourite; moved to your account and deleted when you sign in. | Otelyar (first party) | Until you remove it |
__stripe_mid · __stripe_sid | Cookie | Payment pages only: card fraud prevention. Card details are handled in Stripe's secure fields. | Stripe (payments) | 1 year · 30 minutes |
Functional
| Name | Type | Purpose | Provider | Duration |
|---|---|---|---|---|
oy_locale · oy_market · oy_currency | Cookie | Remembers your language, market and currency on later visits. | Otelyar (first party) | 12 months |
oy_support_thread | Local storage | Access key of your support chat, so the conversation reopens on a later visit. Without consent it is kept for this tab only. | Otelyar (first party) | Until you remove it |
Analytics
| Name | Type | Purpose | Provider | Duration |
|---|---|---|---|---|
_ga | Cookie | Google Analytics: a random ID to tell visitors apart, for aggregate statistics on how the site is used. Written only if you allow analytics cookies; deleted when you withdraw consent. | Google (Google Ireland Ltd / Google LLC) | 2 years |
_ga_150CX4N6RM | Cookie | Google Analytics: keeps the state of your visit (session), so page views are counted to the same visit. Written only if you allow analytics cookies; deleted when you withdraw consent. | Google (Google Ireland Ltd / Google LLC) | 2 years |
Marketing
We currently use no cookies for this purpose.
3.4. Third-party requests
The payment form is provided by Stripe, which uses its own cookies.
If you consent to analytics cookies, Google Analytics is loaded. The provider is Google Ireland Ltd (Ireland); data may be transferred to Google LLC (USA) and to Google's servers in other countries. Google Analytics runs only if you consent to analytics cookies; the transfer abroad relies on a standard contract with Google, notified as required by law (KVKK Art. 9/4). We do not send your name, email address, telephone number, booking number or guest names to Google Analytics; the addresses of booking, payment and account pages are sent without identifiers or access keys. Advertising and personalisation signals are switched off. When you withdraw your consent, Google Analytics is stopped and the _ga cookies are deleted.
Please see these providers' websites for their policies (Google: policies.google.com/privacy).
3.5. Managing your preferences
On your first visit, a banner offers "Accept all", "Reject" and "Preferences" with equal prominence. You can change your choice at any time via the "Cookie preferences" link at the bottom of the site. You can also delete or block cookies in your browser settings; if you block strictly necessary cookies, booking may not work.
3.6. Consent record
Your choice is recorded with the date, time, chosen categories, banner version and your IP address hashed with a secret key. A hashed IP address is still personal data. The record is kept for 3 years after your choice expires and is used to prove your consent. You are asked again every 12 months.
3.7. Contact
Questions: destek@otelyar.com. Details about your personal data are in the Privacy Policy and the KVKK Information Notice.
3.8. Banner and preferences window texts
Banner: "We use strictly necessary cookies to run our site. If you allow us to remember your language, country and currency on future visits, we also use functional cookies, and if you allow us to measure how the site is used, Google Analytics cookies. We do not use advertising cookies. Details: Cookie Policy." Buttons: "Accept all" · "Reject" · "Preferences".
Preferences window: "Strictly necessary (always on): Required for session, security, payment and booking." · "Functional: Remembers your language, country, currency and chat history for 12 months. If off, kept only for this visit." · "Analytics: Measures how the site is used, in aggregate, with Google Analytics (pages viewed, device, approximate location). If on, data is transferred to Google, including abroad (the USA). If off, Google Analytics is not loaded." Buttons: "Save my choice" · "Accept all" · "Reject".