Legal
Cookie Notice
How we use cookies
Cookies are small text files stored by your browser. We use essential cookies for security, fraud prevention, session continuity, and form processing. Optional functional, analytics, and marketing cookies stay off unless you choose them in Cookie Preferences.
Cookie inventory
This inventory was reviewed on August 28, 2026; the chat disclosure was updated on September 9, 2026. The current public custom domain is still served by the legacy Wix renderer, while the headless release uses the Wix Headless runtime below. Cookies marked as conditional are only written when the related sign-in, form, or security flow is used.
| Cookie | Provider | Purpose | Duration | Category | Party |
|---|---|---|---|---|---|
| _ga / _ga_* | Google Analytics | Distinguishes visits for site analytics after opt-in on the production domain. | Google-controlled | Analytics | First-party; third-party transfer |
| sec-fetch-unsupported | Wix | Helps the Wix runtime detect unsupported fetch behavior. | Session | Essential | First-party |
| ssr-caching | Wix | Routes a short-lived server-render cache response. | 20 seconds observed | Essential | First-party |
| bSession | Wix | Platform performance and system-effectiveness measurement. | Up to 30 minutes | Essential | First-party |
| hs | Wix | Platform security and fraud-prevention checks. | Session / platform-controlled | Essential | First-party |
| svSession | Wix | Visitor/session continuity and fraud prevention. | Up to 2 years | Essential | First-party |
| XSRF-TOKEN | Wix | Cross-site request forgery protection. | Session | Essential | First-party |
| wixSession | Wix Headless | Visitor or member authentication tokens where Wix authentication is used. | Browser session in production | Essential | First-party |
| oAuthState | Wix Headless | Temporary OAuth state validation during sign-in. | 30 minutes | Essential | First-party |
| mitsui_advisor_pending | Mitsui Ocean Cruises | Encrypted, HttpOnly temporary advisor-registration state. | 30 minutes | Essential | First-party |
| mitsui_advisor_processing | Mitsui Ocean Cruises | Encrypted, HttpOnly duplicate-submission guard for advisor registration. | 5 minutes | Essential | First-party |
| mitsui_advisor_receipt | Mitsui Ocean Cruises | Encrypted, HttpOnly confirmation state after advisor registration. | 24 hours | Essential | First-party |
| mitsui_guest_interest_rate | Mitsui Ocean Cruises | Encrypted, HttpOnly abuse/rate-limit state for the 2028 interest form. | 6 minutes | Essential | First-party |
| cf_clearance / __cf_bm | Cloudflare Turnstile | May be set when a security challenge or bot-management check is required. | Cloudflare-controlled | Essential | Third-party |
| Wix Site BI telemetry | Wix Hosting | Platform usage and performance telemetry; controlled through Wix Consent Policy Manager. | Platform-controlled | Analytics | Third-party transfer |
Optional cookies and third parties
This release includes Mitsui Concierge chat, powered by Chatwoot at chat.bootstacked.xyz. The chat widget loads when you visit the site. Opening chat can attach the public page address, your selected request type, and relevant public sailing information to the conversation; form values and URL query strings are excluded from that context. Messages you send are processed by the chat service. On the production domain, Google Analytics loads only after you allow analytics cookies. It uses the existing site measurement ID; staging visits do not load this application-owned integration. Query strings and fragments are excluded from the page address sent by this integration. Withdrawing analytics consent disables further Google Analytics measurement. No Meta Pixel script is included in the application source. Wix Hosting injects its own Consent Policy Manager and Site BI telemetry. The banner synchronizes with that manager, so Wix-managed analytics and third-party transfers are denied until consent. Google Fonts and Wix static-media requests are used for presentation and media delivery; this audit found no cookies from either. Cloudflare Turnstile is loaded only on protected public forms and is categorized as essential security.
If an optional source-owned script is added later, it must be declared with its consent category and is held as an inert placeholder until that category is allowed. Our consent record is stored only in this browser with the date, time, source, and chosen categories, alongside Wix's native consent-policy record. Server-side consent logging would require a dedicated, privacy-reviewed endpoint and retention policy.