Courtesy translation. In the event of any discrepancy, the Spanish version shall prevail.
1. What this policy is
This policy explains which cookies and similar technologies korurent.com (the public website and the Customer account) uses, what they are for, who sets them, how long they last and how to accept them, reject them or change your decision.
It is issued by KORU, the data controller identified in the Privacy Notice for Customers, in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”), which requires disclosure of the use of technologies that obtain data automatically. It supplements that Privacy Notice.
Those who offer vehicles on KORU (“Partners”) also have the Cookie Policy for Partners, which covers Partner registration and their dashboard.
2. In brief
- Necessary cookies and those that remember your preferences work without asking for your permission: without them you could not log in, hold a vehicle or pay.
- Analytics cookies (Google Analytics) and advertising cookies (Meta Pixel) are only activated if you accept them. They are off by default.
- Rejecting them does not affect your browsing, your bookings or your payments.
- You may change your decision at any time with the “Cookie preferences” button in the page footer.
3. Which technologies we use and how we classify them
- Cookies: small files that the website stores in your browser and that are sent to the server on each visit.
- Local storage: data that the browser stores on your device and that is not sent to the server on its own. It remains until it expires or is deleted.
- Session storage: the same as the above, but it is deleted when you close the tab.
- Third-party tags: small programs from Google and Meta that, depending on your decision, measure visits or ads.
Categories:
- Necessary: they make login, booking, payment, security and the referral programs work. They do not require your consent.
- Functional: they remember choices you make, such as currency, your favorites or your searches. They are stored only on your device and do not require your consent.
- First-party measurement: KORU anonymously counts interactions with the home page, using a random identifier that is deleted when you close the tab. It does not use cookies or identify you.
- Analytics: they measure how the website is used in order to improve it. They require your consent.
- Advertising: they measure which KORU ads on Facebook and Instagram work and allow KORU ads to be shown to you. They require your consent.
4. Cookies and storage used by the website
| Name | Provider | Purpose | Category | Duration | Consent required? |
|---|---|---|---|---|---|
| sb-…-auth-token | KORU (Supabase) | Keep you securely logged in | Necessary | Up to 400 days or until you log out | No |
| sb-…-auth-token-code-verifier | KORU (Supabase) | Protect login with Google or Apple | Necessary | While login is being completed | No |
| koru_hold | KORU | Hold the vehicle while you complete payment | Necessary | 30 days | No |
| koru_didit_return | KORU | Return you to the correct screen after verifying your identity | Necessary | 1 hour | No |
| koru_ref | KORU | Remember the affiliate link through which you arrived, to credit the referral | Necessary | 30 days | No |
| koru_provref | KORU | Remember the referrer link through which you arrived, to credit the referral | Necessary | 30 days | No |
| koru:cookie-consent (local storage) | KORU | Store your decision about cookies | Necessary | Until you change it or delete the site data | No |
| koru-map-chunk-reloaded (session storage) | KORU | Prevent repeated reloads if a map fails to load | Necessary | Until you close the tab | No |
| koru_currency (local storage) | KORU | Currency in which you prefer to see prices | Functional | Until you change it | No |
| koru:saved (local storage) | KORU | Vehicles you saved as favorites | Functional | Until you remove them | No |
| koru:recent-searches (local storage) | KORU | Your last two searches, so you can pick up where you left off | Functional | 7 days | No |
| koru:recent-viewed (local storage) | KORU | Up to 12 vehicles you viewed recently | Functional | 30 days | No |
| koru:last-search and koru:recent-destinations (local storage) | KORU | Your last search and up to 3 recent destinations, to fill in the search bar | Functional | 30 days | No |
| koru:reading-since (local storage) | KORU | Reference date for rotating the travel guides on the home page | Functional | Until you delete the site data | No |
| koru:home-session (session storage) | KORU | Random identifier of the visit and source of arrival, for first-party measurement of the home page | First-party measurement | Until you close the tab | No |
| koru:meta-source (local storage) | KORU | Record whether you arrived from Facebook, Instagram or Messenger. Only used if you later register as a Partner (see section 6) | Partner ad measurement | 28 days | No |
| _ga | Google (Google Analytics) | Distinguish visitors pseudonymously | Analytics | 2 years | Yes |
| _ga_… | Google (Google Analytics) | Maintain the state of the visit | Analytics | 2 years | Yes |
| _fbp | Meta (Meta Pixel, on KORU’s domain) | Distinguish your browser pseudonymously to measure your visits and link them to our ads | Advertising | 90 days | Yes |
| _fbc | Meta (Meta Pixel, on KORU’s domain) | Store the click identifier if you arrived from a Meta ad | Advertising | 90 days | Yes |
| koru:meta-purchases (local storage) | KORU | Prevent the same payment from being counted twice in Meta (stores the identifier of your last 20 paid bookings) | Advertising | Until you delete the site data | Yes |
If you log in, your recent searches and your favorites are also saved to your account, so you can see them on other devices.
5. Google Analytics and first-party measurement
- Google Analytics loads on every page with Google Consent Mode set to “denied”. Until you accept the analytics category, it does not write cookies or store identifiers; it may send cookieless signals (for example, that a visit occurred), which Google uses in aggregate form.
- If you accept, it measures pages viewed, time on the website, source of the visit, device and browser type, approximate city or country, searches by city and service, and clicks to share or to message us via WhatsApp. We do not send it your name, email address, phone number or payment data.
- Within your Customer account, Vercel Web Analytics measures page performance without cookies and without identifying you.
- For security purposes, our servers log the IP address, the date and the page requested, in order to prevent abuse and resolve failures.
6. Meta Pixel (advertising)
- Until you accept the advertising category, the Meta Pixel is not loaded: the website does not write the _fbp or _fbc cookies and does not send anything to Meta.
- If you accept, it measures pages viewed and actions on the website: searches, vehicles viewed, starting a booking or a payment, completed payments (only their amount and currency), Partner sign-ups and clicks to message us via WhatsApp. With each event, your browser sends Meta your IP address and data about the browser and the device.
- We never send Meta your name, email address, phone number, CURP, CLABE or card data. The pixel works without automatic configuration: it does not read buttons, forms or page content.
- The pixel does not measure your account, the Partner dashboard, login, identity verification, contract signing or pages whose address contains personal data or single-use links.
- The same advertising permission activates the advertising signals of Google Consent Mode.
- If you withdraw your consent, the pixel stops sending data and the website deletes the _fbp and _fbc cookies.
- Arrivals from Meta: the website records on your device (koru:meta-source) whether you arrived from Facebook, Instagram or Messenger, with Meta’s click identifier, the campaign tags or the referring page. That record does not leave your device unless you register as a Partner; in that case, the Cookie Policy for Partners and the “Ad measurement with Meta” section of the Privacy Notice for Providers apply.
7. Third-party services
When you use these features, the provider may set its own cookies on its domain, in accordance with its policy. KORU does not control those cookies:
- Meta (facebook.com): if you accept advertising, the pixel communicates with facebook.com, where Meta may read or set its own cookies, such as fr, if you are logged in to Facebook or Instagram in that browser.
- Google Maps: the Google maps on the contact page and in some guides only load if you click “Load map” or if you accepted analytics cookies.
- Stripe: to pay, you are taken to Stripe’s payment page, which uses cookies to prevent fraud.
- Google and Apple: if you log in with your Google or Apple account.
- Didit: identity verification is carried out on Didit’s platform.
- CARTO and OpenStreetMap: they serve the vehicle search maps; the website only downloads map images from them.
8. Transfers to Google and Meta
- Google LLC, in the United States, receives Google Analytics data if you accept the analytics category, and the cookieless signals described in section 5.
- Meta Platforms, Inc., in the United States, receives Meta Pixel data if you accept the advertising category, for the purposes of section 6. Meta also processes it in accordance with its own privacy policy.
- These transfers require your consent, which you grant by accepting each category and may withdraw at any time.
Policies of each provider:
- Google, privacy: https://policies.google.com/privacy
- Google, how it uses data from sites that use its services: https://policies.google.com/technologies/partner-sites
- Google Analytics, browser add-on to opt out on all websites: https://tools.google.com/dlpage/gaoptout
- Meta, privacy: https://www.facebook.com/privacy/policy
- Meta, cookies: https://www.facebook.com/privacy/policies/cookies
9. How to accept, reject or change your decision
- On your first visit you will see a “Cookies” banner with two buttons of the same size, “Reject” and “Accept”, and the “Configure” link. “Accept” activates analytics and advertising; “Reject” leaves both off.
- “Configure” opens a panel with one switch for “Analytics” and another for “Advertising”, which remain off until you decide. You may accept one and reject the other and confirm with “Save preferences”. “Recent searches” appears as “Always on” because it is functional.
- To change your decision, use the “Cookie preferences” button at the foot of each public page or “Change my cookie preferences” in this policy. The change applies immediately, without reloading the page.
- The banner does not appear during identity capture from your phone or during contract signing; you may decide on any other page.
- Your decision is stored in that browser. If you use another device, delete the site data or we change the cookie categories, we will ask you again.
You may also delete or block cookies from your browser:
- Chrome: Settings > Privacy and security > Cookies and other site data.
- Safari (iPhone): Settings > Safari > Advanced > Website Data.
- Safari (Mac): Settings > Privacy > Manage Website Data.
- Firefox: Settings > Privacy & Security > Cookies and Site Data.
- Edge: Settings > Cookies and site permissions.
If you have a Facebook or Instagram account, you may also decide in the ad settings of your Meta account whether Meta uses your activity on other websites to show you ads. If you block necessary cookies, you will not be able to log in or complete a booking.
10. Visitors from the European Economic Area and the United Kingdom
If you book or browse from the European Economic Area or the United Kingdom, in addition to the Law the General Data Protection Regulation (GDPR) may apply to you. In that case:
- Analytics and advertising cookies are based on your prior consent, which you may withdraw at any time without affecting processing carried out before; necessary cookies are based on their being essential to provide the service you request.
- You have the right to access, rectify and erase your data, to restrict or object to its processing and to its portability, by writing to legal@korurent.com, and to lodge a complaint with the data protection authority of your country.
- Google and Meta transfer data to the United States in accordance with their own international transfer mechanisms, such as the EU-U.S. Data Privacy Framework.
11. Changes to this policy
We review this policy every time we add or remove a cookie or a provider. The current version and its date are shown at the top of this page. If we add a category that requires your consent, we will ask you for it again.
12. Contact
For questions about cookies or to exercise your rights of access, rectification, cancellation or objection, write to legal@korurent.com. More information in the Privacy Notice for Customers.