Skip to main content

Policy

Cookie policy

Version 1.4 · Effective from 29 October 2026

This policy explains the cookies and similar technologies used on the Sanghyang Indah Spa Resort website. It forms part of our Privacy Notice.

1. What cookies are

Cookies are small text files that your browser stores when you visit a website. Similar technologies, such as browser storage (local storage and session storage), work in a comparable way. Cookies can be set by the website you visit (first party) or by other services loaded on that page (third party).

2. No consent pop-up

This website does not display a cookie consent pop-up. On the basis of our legitimate interests, we use cookies that are needed for the website to work, analytics cookies that help us understand and improve the website, and advertising cookies that measure the results of our advertising and let us show our ads to people who have visited this website (section 5). You can still refuse or delete cookies at any time through your browser settings and turn off ad personalisation (see section 7).

3. Necessary cookies

  • NEXT_LOCALE (first party, expires when the browser is closed): remembers the website language you are using.
  • sh-visited (session storage, expires when the tab is closed): marks your visit so the opening animation is not replayed on every page.
  • Session and security cookies for the staff area (/resortanyer and the Outlet Console /outlet), such as payload-token and shr_staff_hint (a marker so page edit buttons load only for staff): set only for signed-in staff and never used for visitors.

4. Analytics cookies

  • Google Analytics 4 — _ga and _ga_<ID> (first party, up to 2 years): count visits, traffic sources and pages viewed. Google retains analytics data for 14 months.
  • Microsoft Clarity — _clck and _clsk (first party) store a pseudonymous ID and link pages within a session, _cltk (session storage) links pages within a tab, plus Microsoft third-party cookies (CLID, ANONCHK, MR, MUID, SM and SRM_B) that recognise the browser across Microsoft services: help us understand how visitors interact through click maps and session recordings. Form inputs are always masked so they are not recorded, and Clarity is not loaded on the booking page.

5. Advertising cookies

  • Google Ads, through the Google tag and Google Tag Manager — _gcl_au (first party, 90 days) links a visit that came from a Google ad to an enquiry or booking on this website; Google's third-party cookie IDE (doubleclick.net, up to 400 days) is used by Google to measure and personalise ads, including showing our ads again to people who visited this website (remarketing).
  • TikTok Pixel — _ttp, _tt_enable_cookie, ttcsid and ttcsid_<pixel ID> (first party, up to 13 months), plus TikTok's third-party cookie _ttp (tiktok.com, up to 13 months): record visits to our pages so TikTok can measure our ad campaigns and show our ads to people who visited this website.
  • Google Tag Manager and the TikTok Pixel are not loaded on outlet reservation forms, and e-ticket pages load no analytics or advertising tags at all. The details you type into forms are not sent to advertising partners. Google and TikTok process this data under their own privacy policies.

6. Third parties on the booking page and forms

  • The booking page loads the Exely booking engine. Exely sets first-party functional cookies TLV_<hotel ID> (up to 30 days) and TLBF_<language> (less than a day), its own Google Analytics cookie _ga_875TYKVDCP (up to 2 years), and browser storage keys tl:* (local storage) and TL;* (session storage) to run the booking session, under Exely's policies.
  • Our payment partner's pages (Xendit) may set cookies for transaction security and fraud prevention.
  • Cloudflare Turnstile verification on forms processes browser signals to tell humans from bots, not for advertising.

7. Managing cookies

  • Use your browser settings to block or delete cookies. If you block necessary cookies, some parts of the website may not work properly.
  • Use private browsing so cookies are deleted when the window is closed.
  • Install Google's Google Analytics Opt-out Browser Add-on to opt out of Google Analytics on all websites.
  • Turn off personalised ads from Google in My Ad Center (myadcenter.google.com). If you use TikTok, manage ad personalisation in the TikTok app under Settings and privacy. Blocking third-party cookies in your browser also limits remarketing.

8. Changes and contact

The list above was verified with a browser scan on 29 October 2026. We may update this policy when the cookies we use change; the version and effective date are shown at the top of this page. Questions can be sent to reservation@sanghyang.com. Full information about your rights is available in our Privacy Notice. If the English and Indonesian versions differ, the Indonesian version prevails.