What this policy covers
This site sets two kinds of cookies. Necessary cookies keep you signed in, let you confirm an offer, remember your language and remember what you decided about the rest; they need no permission, because article 22.2 of the Spanish LSSICE exempts cookies strictly required to provide a service you asked for. Analytics and advertising cookies are set by third parties — Google, Meta and Microsoft — and only if you have agreed to them.
If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, a banner asks you before any of the second kind is set. It has two equal buttons, *Accept all* and *Reject all*, and a *Preferences* panel with one box per category, none of them pre-ticked. Closing nothing, scrolling and carrying on reading set no cookies. Elsewhere in the world these cookies are set without asking, as the law of those places allows; the preferences panel is still available to you.
Necessary cookies
| Cookie | What it does | How long |
|---|---|---|
| `abh_signup_email` | Carries the address you typed on the home page to the sign-up screen, so you do not repeat it | 10 minutes |
| `abh_signin` | Remembers that you asked for a verification code when creating the account or recovering access, so you can type it even after a reload. It does not contain the code | 10 minutes, or 30 while creating the account |
| `abh_operator` | Keeps your seller session open | 30 days |
| `abh_next` | Remembers which of your artworks an email button was taking you to, so signing in takes you there. It contains no secret | 30 minutes |
| `abh_bid` | Remembers the offer you are confirming while you type the code. It does not contain the code | 10 minutes |
| `abh_bidder` | Remembers that you have already verified your email, so you do not repeat it on every artwork at the same fair | 30 days |
| `abh_me` | Remembers that you asked for a code to open your bidder page. It does not contain the code | 10 minutes |
| `abh_contact` | Remembers that you asked for a code to confirm your address on the contact form. It does not contain the code | 16 minutes |
| `abh_consent` | Remembers what you decided about analytics and advertising cookies, so we do not ask again | 6 months |
| `abh_oauth` | Remembers your language and the advert you came from while you sign in with Google or Apple, so the return lands where you were | 10 minutes |
| `NEXT_LOCALE` | Remembers whether you prefer the site in English or Spanish | 1 year |
All but `abh_consent` and `NEXT_LOCALE` are session and authentication cookies: without them you could not sign in, confirm an offer or write to us. They are `httpOnly`, meaning no script can read them, and they contain no readable personal data — except `abh_signup_email`, which carries your own address for ten minutes so that it does not have to travel in the URL. `abh_consent` is readable by scripts, because the scripts it governs have to read it; it holds two yes-or-no answers and a date. The service's administration panel, used only by the people who run it, has two equivalent cookies (`abh_admin_signin` and `abh_admin`) that are never set in any browser but theirs.
Analytics cookies
Set only with your consent to Analytics. They tell us which pages are read, in what order, and where people give up, so we can improve them. They are never used for advertising.
| Cookie | Provider | What it does | How long |
|---|---|---|---|
| `_ga` | Google Analytics | Distinguishes one browser from another | 2 years |
| `_ga_*` | Google Analytics | Keeps the state of the current visit | 2 years |
| `_clck` | Microsoft Clarity | Identifies the browser for Clarity's recordings and heat maps | 1 year |
| `_clsk` | Microsoft Clarity | Groups the pages of one visit into one recording | 1 day |
| `CLID` | Microsoft Clarity | Identifies the first visit to a site using Clarity | 1 year |
| `ANONCHK`, `MR`, `MUID`, `SM` | Microsoft | Set on Microsoft's own domains when Clarity loads; used by Microsoft to detect fraud and count visits | Up to 1 year |
Clarity records how a page is used — scrolls, taps, where the cursor goes. Text typed into any form field is masked in the recording, as are the email addresses and telephone numbers of collectors shown to sellers. The pages where a collector makes an offer, the collector's own page and the administration panel load no third-party script of any kind, whatever you agreed to.
Advertising cookies
Set only with your consent to Advertising. They let us show our own adverts, on Meta's and Google's platforms, to people who have visited this site, and measure whether an advert led to an account or a purchase. We do not sell advertising, and we do not use these cookies for anything but our own campaigns.
| Cookie | Provider | What it does | How long |
|---|---|---|---|
| `_fbp` | Meta | Distinguishes one browser from another for Meta's advertising | 3 months |
| `_fbc` | Meta | Remembers that you arrived from a Meta advert | 3 months |
| `_gcl_au` | Google Ads | Remembers that you arrived from a Google advert, for conversion measurement | 3 months |
| `_gcl_aw`, `_gcl_gb` | Google Ads | Carry the click identifier of a Google advert across pages | 3 months |
With your consent to Advertising, when you create a seller account or pay for credits we tell Google Ads that it happened, from your browser, and Meta, from our server as well, together with your email address hashed with SHA-256 so that Meta can match it to a person who saw an advert. No email address, hashed or not, is ever sent to Google. Without that consent, nothing that identifies you is sent to either of them: Meta receives nothing at all, and Google Ads receives only an anonymous signal that a sign-up or a purchase happened — without cookies and with the identifier of the advert you arrived from removed before it leaves your browser. The privacy notice explains this processing in full.
Google's tag is loaded, with what Google calls Consent Mode, before you have decided. Until you accept, it sets no cookies and sends no identifier; it only counts, without a cookie, that a page was shown, which Google uses to estimate what the people who said no would have done. If you reject, it stays that way.
Withdrawing your consent
You can change your decision at any time from the "Cookie preferences" link at the foot of every page, which reopens the panel. Withdrawing consent stops the scripts on the next page and deletes the cookies of that category that were set on this site; cookies the providers set on their own domains are yours to delete from your browser's settings, and their policies explain how: Google, Meta and Microsoft.
You can delete every cookie from your browser settings at any time. Deleting the session ones simply means identifying yourself again. To end your bidder session from the site itself, open "My details" on the artwork page and press "Not me: sign out of this device".
Third parties we send you to
When a seller pays, we send them to Stripe's checkout, which is a different site with its own cookies and its own policy. We set no cookies on their behalf and receive none of theirs.
If a seller signs in with Google or Apple, where offered, the sign-in passes through that provider's site, with its cookies and its policy. While that takes place the browser holds one short-lived cookie of ours, `sb-*-code-verifier`, that proves the return is the same browser that left; on return the provider's session is closed at once and only `abh_operator` remains.