Cookie Policy

Last updated: July 2026

This page tells you, plainly, which cookies the site uses and what you get to decide. The short version: the technical cookies that make it work are always there; the analytics and marketing tools are active, but they write nothing until you say yes through the banner.

Today: technical cookies always, the rest only with your yes

The site loads the technical cookies, the ones it needs to work, for which no consent is required. Google Analytics, Google Ads, the Meta Pixel with its Conversions API and the Google Tag Manager container are active in Google Consent Mode, with every signal denied by default: on your first visit a consent banner appears, and analytics and marketing cookies arrive only after you accept. If you refuse, only the technical ones remain — and the site works all the same.

What cookies are, in a nutshell

Small files your browser saves on your device while you browse; similar technologies, such as the browser's local storage, do the same job. They make the site work, remember a few preferences and — if and when activated, with your consent — count visits and tell us whether campaigns are working.

Three families

Technical (necessary): they make the site work — language, session, security. No consent needed; without them, some features would stop working.
Analytics: with your consent, they tell us in aggregate form how the site is used, so we can improve it. They arrive only if you consent through the banner.
Marketing: with your consent, they measure whether our Google and Meta campaigns work and make messages more relevant. They arrive only if you consent through the banner.

The list, one by one

NEXT_LOCALETechnical
Provider
This site (next-intl)
What it's for
Remembers the language you chose, so we don't ask on every page.
Duration
12 months
nos_consent_choiceTechnical
Provider
This site
What it's for
Keeps your cookie choice, so you never have to repeat it. It appears when you make your choice in the consent banner.
Duration
12 months
Turnstile (Cloudflare)Technical
Provider
Cloudflare
What it's for
Cloudflare's anti-bot check on our forms (e.g. booking) may set a short-lived technical token or cookie to tell people from bots and stop spam and abuse. No marketing involved.
Duration
Session / short-lived
nos_click_idsMarketing
Provider
This site
What it's for
Notes down, first-party, the advertising parameters carried by the link (e.g. gclid, fbclid, utm) to attribute the booking to the right campaign. It is a marketing identifier, not passed to third parties; the value may also live in the browser's local storage. It is noted down only with your marketing consent.
Duration
90 days
Session and security cookiesTechnical
Provider
This site
What it's for
Keep the session standing and protect browsing (e.g. anti-abuse).
Duration
Session
Plateform widget cookiesTechnical
Provider
Plateform
What it's for
Technical cookies from the booking widget, when shown: it needs them to work.
Duration
Variable (set by Plateform)
Bedzzle widget cookiesTechnical
Provider
Bedzzle
What it's for
Technical cookies from Palazzo Scotto's availability-search widget on the "Beyond the Table" page: it loads only when you use the form, and it needs them to work.
Duration
Variable (set by Bedzzle)
_ga, _ga_VMKT4HEVGHAnalytics
Provider
Google Analytics
What it's for
Aggregate statistics on site use. Set only with analytics active and with consent.
Duration
Up to 24 months
_gcl_*Marketing
Provider
Google Ads
What it's for
Attributes Google campaign conversions. Set only with marketing active and with consent.
Duration
Up to 90 days
_fbp, _fbcMarketing
Provider
Meta
What it's for
Measurement and attribution of Meta (Facebook/Instagram) campaigns. Set only with marketing active and with consent.
Duration
Up to 90 days

Name	Provider	What it's for	Category	Duration
NEXT_LOCALE	This site (next-intl)	Remembers the language you chose, so we don't ask on every page.	Technical	12 months
nos_consent_choice	This site	Keeps your cookie choice, so you never have to repeat it. It appears when you make your choice in the consent banner.	Technical	12 months
Turnstile (Cloudflare)	Cloudflare	Cloudflare's anti-bot check on our forms (e.g. booking) may set a short-lived technical token or cookie to tell people from bots and stop spam and abuse. No marketing involved.	Technical	Session / short-lived
nos_click_ids	This site	Notes down, first-party, the advertising parameters carried by the link (e.g. gclid, fbclid, utm) to attribute the booking to the right campaign. It is a marketing identifier, not passed to third parties; the value may also live in the browser's local storage. It is noted down only with your marketing consent.	Marketing	90 days
Session and security cookies	This site	Keep the session standing and protect browsing (e.g. anti-abuse).	Technical	Session
Plateform widget cookies	Plateform	Technical cookies from the booking widget, when shown: it needs them to work.	Technical	Variable (set by Plateform)
Bedzzle widget cookies	Bedzzle	Technical cookies from Palazzo Scotto's availability-search widget on the "Beyond the Table" page: it loads only when you use the form, and it needs them to work.	Technical	Variable (set by Bedzzle)
_ga, _ga_VMKT4HEVGH	Google Analytics	Aggregate statistics on site use. Set only with analytics active and with consent.	Analytics	Up to 24 months
_gcl_*	Google Ads	Attributes Google campaign conversions. Set only with marketing active and with consent.	Marketing	Up to 90 days
_fbp, _fbc	Meta	Measurement and attribution of Meta (Facebook/Instagram) campaigns. Set only with marketing active and with consent.	Marketing	Up to 90 days

Analytics and marketing cookies appear on your browser only after your consent through the banner: until you accept, they do not exist. The durations shown are typical values set by the respective providers.

Google Tag Manager

It is a tag container and runs in Google Consent Mode with every signal denied by default: it sets no analytics or marketing cookie until you say yes through the banner.

Server-side measurement, in plain words

To understand which campaigns truly bring bookings — and only with your marketing consent — the site notes down, first-party, the advertising parameters carried by the link (Google's gclid, Meta's fbclid) and passes them, together with a few contact identifiers, to a component working on the servers (a Worker on Cloudflare). It is this component that reports conversions to the advertising platforms, server to server: Meta's Conversions API and Google Ads' Enhanced Conversions. Email and phone leave only in hashed form (SHA-256): the platforms receive an encrypted fingerprint, never the data in the clear. And the actual purchase conversion never starts from your browser: it is born server-side from the confirmed booking, with an identifier that prevents double counting. Without your marketing consent, none of this happens at all.

Changing your mind, any time

On your first visit a banner lets you choose: accept all non-essential cookies, reject them all, or decide category by category (the necessary ones stay always on). Your choice is recorded, and you can revisit or withdraw it at any moment through the "Cookie preferences" link at the bottom of the site. At any time you can also block or delete cookies from your browser settings — knowing that, without some technical ones, a few site features might limp along.

Outside Europe

Some providers of the tools in use (Google, Meta) are based in the United States. Any transfers — only with your consent — rest on the Standard Contractual Clauses (EU Dec. 2021/914) and, where the provider is certified, on the EU-US Data Privacy Framework. The full picture is in the Privacy Policy.

If this page changes

It will change when the site does — for instance if new tools arrive. The date at the top always tells you where we stand.