Cookie and browser-storage notice

The current consent model

We use essential browser storage to remember your choice and support features you request. If you accept optional processing, Google Analytics 4 measures page use and registered interactions, and we keep the first and most recent bounded campaign labels and landing classifications for the fixed periods below so our forms can carry campaign context. Google Analytics may then create the two first-party cookies listed below. Advertising tags are not active.

The browser removes unknown query parameters immediately and captures or discards the recognised campaign labels after your choice. That cleanup cannot undo the initial query-bearing request already received by the website host, which may remain in hosting logs under the controls described in the privacy notice.

Optional analytics starts denied. The Google Analytics tag does not load, make a Google request or set an analytics cookie until you accept. After acceptance, only analytics_storage is granted; ad_storage, ad_user_data and ad_personalization remain denied. Advertising is not in use — off.

Cookie preferences

This control lets you accept optional analytics, reject it or manage the analytics choice. The same control appears in every page footer. Core pages, forms and the scorecard remain available when optional analytics is rejected.

Complete active storage inventory

The records below are the complete allowlist for browser storage created by this release.

Necessary

Used only to remember and enforce the choice you make. This category cannot be switched off because the site otherwise cannot remember a rejection or withdrawal.

Necessary browser-storage records
Key and mechanism	Purpose and contents	Creation and retention
`ml-consent-v7` localStorage	Remember the optional-processing choice and enforce it on later page visits. Only schema_version, policy_version, analytics, advertising, decided_at, expires_at. The policy version is ml-consent-v7; the record contains no visitor identifier, attribution, URL or server receipt.	After Accept optional, Reject optional or Save choices is used. Kept: 180 days from the decision. Visiting the site does not extend it. Removed: When it is malformed, expired or on an unsupported/legacy policy version, or when a materially changed consent policy requires a new choice.

Requested functionality

Tab-only state created after you use or dismiss a feature. It is not used for analytics or advertising.

Requested functionality browser-storage records
Key and mechanism	Purpose and contents	Creation and retention
`ml_sc_state_v3` sessionStorage	Restore progress in the Client-Chasing Readiness Scorecard within the same tab. Scorecard state-schema version, closed answers, current step and whether the result was shown. It contains no name, email, tier, reason code or other identity field.	After the visitor starts using the scorecard. Kept: For the current browser tab. Removed: When the tab closes, browser session storage is cleared, or the saved scorecard version is no longer valid.
`ml_sticky_cta_dismissed` sessionStorage	Keep a visitor-dismissed mobile action bar closed in the current tab. A fixed dismissal flag only.	After the visitor dismisses the mobile action bar. Kept: For the current browser tab. Removed: When the tab closes or browser session storage is cleared.

Analytics

Off by default. Once accepted, this covers Google Analytics 4 browser measurement, its two first-party cookies, and one bounded first-touch and last-touch campaign-and-landing record, with each campaign touch kept for no more than 30 days.

Analytics browser-storage records
Key and mechanism	Purpose and contents	Creation and retention
`ml_attribution_v1` localStorage	Carry the first and most recent valid campaign and landing classifications into the documented website forms. The strict ml-attribution-v1 schema: first and last touch only; each touch contains the five bounded UTM labels, a build-defined canonical landing path and variant, and fixed capture/expiry times. It contains no visitor identifier, full URL, query string, referrer, click ID, form content or scorecard answer.	Only after analytics permission and a complete valid campaign touch containing utm_source. Kept: Each touch expires 30 days after capture. Visits do not extend it, and the record is removed sooner on rejection, withdrawal or invalid consent. Removed: When the stored schema is malformed, both touches have expired, consent is invalid, immediately on withdrawal or rejection, or when a material policy change requires a new choice.
`_ga` cookie	Google Analytics 4 uses this to recognise a returning browser so repeat visits are not counted as new people. A pseudonymous client identifier generated in the browser. It contains no name, email address, telephone number, form answer, appointment detail or advertising identifier, and it is not shared with any advertising destination.	Only after the current consent policy records an analytics grant and the Google Analytics tag loads. Kept: 420 days from the first visit. Return visits do not extend it, because the tag is configured with cookie_update disabled. Removed: Immediately on rejection or withdrawal, when the consent record is malformed, expired or on a legacy policy version, or when a material policy change requires a new choice.
`_ga_*` cookie	Google Analytics 4 uses this to keep one visit together as a session. Session count and session state for this stream only. It contains no name, email address, telephone number, form answer, appointment detail or advertising identifier.	Only after the current consent policy records an analytics grant and the Google Analytics tag loads. Kept: 420 days from the first visit, on the same non-extending basis as _ga. Removed: On the same conditions as _ga: rejection, withdrawal, an invalid or legacy consent record, or a material policy change.

Advertising

Source-disabled in this release. The allowlist documents only the bounded revocation registry and transient cross-tab withdrawal signal that a separately reviewed activation could create after affirmative advertising consent; neither contains a click ID.

Advertising browser-storage records
Key and mechanism	Purpose and contents	Creation and retention
`ml_google_ads_revocation_registry_v1` localStorage	Keep a bounded revocation path available across a Cal visit for an explicitly consented Google Ads click correlation. One device-local opaque subject key and up to 8 compact slots containing only a slot number, bounded issue/expiry times and a revocation-only capability. Pending times are replaced with the exact server-receipt times after receipt recovery. The complete record is at most 1024 bytes and contains no click ID, UTM value, URL, booking, event, contact value or correlation token. The capability can only withdraw; it grants no promotion or read authority.	Only after an explicit affirmative advertising choice, immediately before the same-origin consent-receipt request, so a lost response remains withdrawable; the source-disabled release cannot create it. Kept: Until the exact consent-receipt expiry, capped at 180 days. Visits do not extend it. Removed: After confirmed or already-completed server withdrawal, when its receipt expires, when invalid, or through the ML-020 advertising withdrawal controller. Generic analytics cleanup does not erase this revocation path before server withdrawal.
`ml_google_ads_withdrawal_signal_v1` localStorage	Notify another open tab to clear an advertising handoff and begin the same withdrawal. A fixed value of 1 only. It contains no click, capability, identity, URL, booking, event or contact value.	Only during an explicit advertising withdrawal when BroadcastChannel needs a storage-event fallback; the source-disabled release cannot create it. Kept: Transient for one synchronous storage-event signal and removed immediately by the same operation. Removed: Immediately after publication, and defensively during optional-state cleanup.

Configuration-verified browser policy · analytics active on consent

Optional attribution and Google Analytics browser measurement start only after acceptance. These are the configured lifetimes for this release's own consent, attribution and analytics cookies; they do not state how long every Google aggregate or backup persists. Advertising providers remain off, and any further material provider change requires a new policy version, fresh choice and separate review.

The consent preference record

The first-party ml-consent-v7 local-storage record has schema version 1. It contains only the schema and policy versions, analytics state, fixed denied advertising state, UTC decision time and UTC expiry time. It contains no identifier, campaign attribution, URL or server receipt.

An acceptance or rejection follows the fixed lifetime in the inventory above and is not extended by return visits. A malformed, legacy, expired or differently versioned record is discarded and the site asks again. A material change to a provider, purpose, category, data field, retention period or cross-site processing also requires a new policy version and a fresh choice; an ordinary copy correction does not.

Activating Google Analytics is a material provider change, so this release uses the new ml-consent-v7 policy and asks every visitor again. An older choice cannot authorise Google Analytics. The closed Authority-article interaction labels remain limited to the reviewed types and contain no free text.

Withdrawal and provider limits

Withdrawing optional processing saves the denied choice, sends the loaded Google tag an immediate denied consent update, clears the consent-bound first/last attribution record, retired source keys and registered optional first-party identifier cookies, then reloads the same query-free page. The denied replacement does not load the tag, and no analytics event is sent about the withdrawal.

The cookie cleanup allowlist is exact names _ga, _gid, _gat, _fbp, _fbc and prefixes _ga_*, _gat_*, _gac_*, _gcl_*. Of these, only _ga and the stream-specific _ga_* cookie can be created by this release, and only after acceptance; the rest remain removal-only.

Google Analytics 4 is active only after acceptance and is the only remote measurement provider this release activates. Google Ads and Meta remain source-disabled: there is no advertising tag, transport or Content Security Policy origin for either. Activating an advertising provider would require a separate purpose, disclosure, material consent-policy version and fresh choice.

For personal-information processing outside browser storage, including Formspree enquiries and host logs, read the website privacy notice.

Every browser record, in one place.