Cookie and browser-storage notice

The current consent model

We use essential browser storage to remember your choice and support features you request. With your permission, we keep the first and most recent bounded campaign labels and landing classifications for the fixed periods in the inventory below so our forms and booking handoff can carry campaign context. Google Analytics and advertising tags are not active in this release.

The browser removes unknown query parameters immediately and captures or discards the recognised campaign labels after your choice. That cleanup cannot undo the initial query-bearing request already received by the website host, which may remain in hosting logs under the controls described in the privacy notice.

Optional analytics starts denied. Advertising is not in use — off. The four consent signals analytics_storage, ad_storage, ad_user_data and ad_personalization default to denied. The site makes no Google or Meta request, including a cookieless measurement ping, before permission. There are no regional exceptions, URL passthrough or stored advertising consent.

Cookie preferences

This control lets you accept optional analytics, reject it or manage the analytics choice. The same control appears in every page footer. Core pages, forms and the scorecard remain available when optional analytics is rejected.

Complete active storage inventory

The records below are the complete allowlist for browser storage created by this release.

Necessary

Used only to remember and enforce the choice you make. This category cannot be switched off because the site otherwise cannot remember a rejection or withdrawal.

Necessary browser-storage records
Key and mechanism	Purpose and contents	Creation and retention
`ml-consent-v3` localStorage	Remember the optional-processing choice and enforce it on later page visits. Only schema_version, policy_version, analytics, advertising, decided_at, expires_at. The policy version is ml-consent-v3; the record contains no visitor identifier, attribution, URL or server receipt.	After Accept optional, Reject optional or Save choices is used. Kept: 180 days from the decision. Visiting the site does not extend it. Removed: When it is malformed, expired or on an unsupported/legacy policy version, or when a materially changed consent policy requires a new choice.

Requested functionality

Tab-only state created after you use or dismiss a feature. It is not used for analytics or advertising.

Requested functionality browser-storage records
Key and mechanism	Purpose and contents	Creation and retention
`ml_sc_state_v2` sessionStorage	Restore progress in the MTD Client-Chasing Readiness Scorecard within the same tab. Scorecard state-schema version, closed answers, current step and whether the result was shown. It contains no name, email, tier, reason code or other identity field.	After the visitor starts using the scorecard. Kept: For the current browser tab. Removed: When the tab closes, browser session storage is cleared, or the saved scorecard version is no longer valid.
`ml_sticky_cta_dismissed` sessionStorage	Keep a visitor-dismissed mobile action bar closed in the current tab. A fixed dismissal flag only.	After the visitor dismisses the mobile action bar. Kept: For the current browser tab. Removed: When the tab closes or browser session storage is cleared.

Analytics

Off by default. In this release it covers only one bounded first-touch and last-touch campaign-and-landing record, with each touch kept for no more than 30 days; no remote analytics tag is active.

Analytics browser-storage records
Key and mechanism	Purpose and contents	Creation and retention
`ml_attribution_v1` localStorage	Carry the first and most recent valid campaign and landing classifications into the documented forms and external booking handoff. The strict ml-attribution-v1 schema: first and last touch only; each touch contains the five bounded UTM labels, a build-defined canonical landing path and variant, and fixed capture/expiry times. It contains no visitor identifier, full URL, query string, referrer, click ID, form content or scorecard answer.	Only after analytics permission and a complete valid campaign touch containing utm_source. Kept: Each touch expires 30 days after capture. Visits do not extend it, and the record is removed sooner on rejection, withdrawal or invalid consent. Removed: When the stored schema is malformed, both touches have expired, consent is invalid, immediately on withdrawal or rejection, or when a material policy change requires a new choice.

Owner-approved browser policy · deployment verification pending

This owner-approved ML-017 browser policy still needs deployment verification and does not activate or approve a dormant analytics or advertising provider; any material provider change requires a new policy version, fresh choice and separate review.

The consent preference record

The first-party ml-consent-v3 local-storage record has schema version 1. It contains only the schema and policy versions, analytics state, fixed denied advertising state, UTC decision time and UTC expiry time. It contains no identifier, campaign attribution, URL or server receipt.

An acceptance or rejection follows the fixed lifetime in the inventory above and is not extended by return visits. A malformed, legacy, expired or differently versioned record is discarded and the site asks again. A material change to a provider, purpose, category, data field, retention period or cross-site processing also requires a new policy version and a fresh choice; an ordinary copy correction does not.

Withdrawal and inactive providers

Withdrawing optional analytics takes effect without a page reload. It stops future optional processing, clears the consent-bound first/last attribution record and retired source keys, blanks those fields in website forms, restores undecorated Cal links and removes precisely registered optional first-party identifier cookies if any are found. No analytics event is sent about the withdrawal.

The cleanup-only cookie allowlist is exact names _ga, _gid, _gat, _fbp, _fbc and prefixes _ga_*, _gat_*, _gac_*, _gcl_*. These entries cover removal only: this release does not create or permit any of them.

Google Analytics 4, Google Ads and Meta are dormant. This release contains no Google or Meta tag loader, transport or Content Security Policy origin, so accepting optional analytics does not activate them. Before any provider is activated, its actual purpose, data, retention, transfers and controls must be reviewed, this notice must change materially, and the site must ask again.

For personal-information processing outside browser storage, including Formspree enquiries, Cal bookings and host logs, read the website privacy notice.

Every browser record, in one place.