Cookie Policy

1. About this Cookie Policy

This Cookie Policy explains how CraftIndex OÜ uses cookies and similar technologies in connection with the YachtCraft Index website and platform.

It explains:

• what cookies are;
• which categories of cookies we use;
• why we use them;
• which cookies require consent;
• how long cookies may remain on a device;
• how visitors can accept, reject or withdraw consent; and
• how to contact us about cookie use.

This Policy should be read together with the YachtCraft Index Privacy Policy.

2. Platform operator

YachtCraft Index is operated by:

CraftIndex OÜ
Registry code: 17498820
Legal form: Osaühing, OÜ
Registered address: Pärnu mnt 139b, Kesklinna linnaosa, Tallinn 11317, Harju maakond, Estonia
Email: office@yachtcraftindex.com

In this Policy, CraftIndex OÜ may be referred to as “CraftIndex,” “YachtCraft Index,” “we,” “us,” or “our.”

3. What cookies are

Cookies are small text files that a website stores on a visitor’s computer, telephone, tablet or other device.

Cookies may allow a website to:

• remember that a user is logged in;
• maintain a secure session;
• remember cookie choices;
• prevent fraud;
• protect forms and accounts;
• understand how the website is used; and
• provide other technical functions.

Some cookies remain only until the browser is closed. These are commonly called session cookies.

Other cookies remain for a defined period or until they are deleted. These are commonly called persistent cookies.

4. Similar technologies

This Policy also applies to similar technologies that may store information on, or access information from, a user’s device.

These may include:

• browser local storage;
• session storage;
• software development kits;
• tracking pixels;
• tags;
• scripts;
• device identifiers;
• authentication tokens; and
• similar technical tools.

The term “cookies” in this Policy includes these similar technologies where appropriate.

5. First-party and third-party cookies

A first-party cookie is set through the YachtCraft Index domain.

A third-party cookie or similar technology may be placed or operated by a service provider used by YachtCraft Index.

Our service providers may include:

• Google Analytics;
• Stripe;
• Supabase;
• Vercel;
• Cloudflare; and
• other technical providers required to operate or secure the platform.

A provider’s technology may operate as a first-party or third-party technology depending on its configuration.

6. Cookie categories used by YachtCraft Index

YachtCraft Index currently uses or plans to use two main categories:

1. Essential cookies
2. Analytics cookies

We do not currently plan to use advertising, behavioural-targeting or social-media advertising cookies.

If this changes, this Cookie Policy and the consent interface must be updated before those cookies are activated.

7. Essential cookies

Essential cookies are necessary for the website or platform to function securely and correctly.

They may be used to:

• maintain login sessions;
• authenticate users;
• secure accounts;
• remember cookie choices;
• process forms;
• prevent fraudulent or malicious activity;
• protect against cross-site request forgery;
• manage payment sessions;
• balance website traffic;
• protect the website from attacks;
• maintain technical platform functions; and
• provide services expressly requested by the user.

Essential cookies cannot be disabled through the YachtCraft Index cookie banner because the platform may not function properly without them.

Users may still block essential cookies through their browser settings, but doing so may prevent login, payment, account access or other core functions.

8. Legal basis for essential cookies

Essential cookies are used where they are necessary:

• to provide a service expressly requested by the user;
• to maintain account and platform security;
• to perform the membership or Builder User agreement;
• to process a requested payment;
• to remember a user’s privacy choices; or
• for another strictly necessary technical purpose.

We do not rely on optional cookie consent for strictly necessary cookies.

9. Examples of essential technologies

Depending on the final platform implementation, essential technologies may include:

9.1 Authentication cookies

These technologies may be used to:

• identify an authenticated user;
• keep the user signed in;
• verify account permissions;
• prevent unauthorised access; and
• terminate the session after logout or expiry.

These may be provided through YachtCraft Index or Supabase authentication functions.

9.2 Security cookies

These technologies may be used to:

• detect malicious requests;
• prevent automated abuse;
• manage traffic securely;
• protect forms;
• prevent fraud;
• apply rate limits; and
• protect the platform against attacks.

Cloudflare or other security providers may support these purposes.

9.3 Payment cookies

Stripe may use cookies or similar technologies during checkout to:

• process payments;
• authenticate payment methods;
• prevent fraud;
• maintain a secure checkout session; and
• remember relevant payment-session information.

9.4 Cookie-choice storage

A cookie or local-storage entry may record:

• whether the user accepted analytics cookies;
• whether the user rejected analytics cookies;
• the date of the choice;
• the consent-policy version; and
• when the user should be asked again.

This is necessary to respect and remember the user’s privacy choice.

9.5 Session and functional technologies

The platform may use session technologies to:

• maintain form progress;
• preserve technical account state;
• support navigation;
• prevent repeated authentication requests; and
• provide functions explicitly requested by the user.

10. Analytics cookies

With the user’s consent, YachtCraft Index uses Google Analytics to understand how visitors use the website.

Analytics may help us understand:

• how visitors reach the website;
• which pages are visited;
• how long visitors use the website;
• general user journeys;
• device and browser categories;
• approximate geographic regions;
• website errors or performance issues;
• whether content is useful; and
• aggregate website-use trends.

Analytics information is used to measure and improve the website and platform.

11. Google Analytics cookies

Google Analytics 4 may use the following first-party cookies:

_ga

Provider: Google Analytics
Purpose: Distinguishes users for analytics purposes.
Default duration: Up to two years.
Category: Analytics
Consent required: Yes

_ga_<container-id>

Provider: Google Analytics
Purpose: Maintains information about the user’s analytics session.
Default duration: Up to two years.
Category: Analytics
Consent required: Yes

The exact cookie suffix depends on the Google Analytics measurement or container identifier used by YachtCraft Index.

Browser restrictions or YachtCraft Index configuration may shorten the default duration.

12. Information processed through Google Analytics

Subject to the visitor’s consent and our configuration, Google Analytics may process information such as:

• pages viewed;
• events and interactions;
• session information;
• approximate location;
• browser information;
• device category;
• operating system;
• referral source;
• screen or display information;
• language;
• time and date of activity; and
• cookie or analytics identifiers.

We do not intend to send names, email addresses, telephone numbers, payment information or Company-profile content to Google Analytics as analytics event data.

13. Analytics consent

Analytics cookies are optional.

Where consent is required:

• analytics storage will be denied by default;
• Google Analytics cookies will not be placed before the user grants analytics consent;
• rejecting analytics will not prevent access to the public website;
• rejecting analytics will not prevent access to essential account functions; and
• the user may withdraw consent at any time.

Consent must be given through a clear affirmative choice.

Continuing to browse without making a choice does not itself constitute consent.

14. Google Consent Mode

YachtCraft Index may use Google Consent Mode to communicate a user’s consent choice to Google tags.

The initial setting for analytics storage should be denied unless and until analytics consent is granted.

When analytics consent is granted, the consent status may be updated to allow the approved analytics functions.

YachtCraft Index should not activate advertising storage, advertising personalisation or advertising user-data settings because advertising cookies are not currently used.

15. Advanced and basic Consent Mode

The technical implementation may use a consent configuration that prevents Google Analytics from loading before consent.

If a configuration allows limited cookieless signals before consent, it must be reviewed to ensure that:

• analytics cookies are not stored or accessed before consent;
• the implementation accurately reflects the information in this Policy;
• no advertising functions are enabled;
• unnecessary information is not transmitted; and
• the implementation complies with applicable law.

The simplest launch configuration is to block Google Analytics until the visitor accepts analytics cookies.

16. No advertising cookies

YachtCraft Index does not currently use cookies for:

• personalised advertising;
• remarketing;
• cross-site behavioural tracking;
• Meta advertising;
• LinkedIn advertising;
• Google Ads remarketing;
• advertising audiences; or
• sale of visitor profiles.

The Google Analytics account should not be linked to advertising functions that would contradict this statement unless this Policy and the consent interface are updated first.

17. Cookie schedule

The following schedule describes the expected cookie categories.

The exact cookie names used by authentication, security, payment and infrastructure providers must be confirmed through a production cookie scan before the website is launched.

Essential cookies

Cookie or technology: Cookie-consent preference
Provider: YachtCraft Index or selected consent-management provider
Purpose: Records whether analytics cookies were accepted or rejected.
Duration: Normally 6 to 12 months
Category: Essential

Cookie or technology: Authentication or session token
Provider: YachtCraft Index or Supabase
Purpose: Keeps an authorised user signed in and maintains account access.
Duration: Session-based or according to secure authentication settings
Category: Essential

Cookie or technology: Security and anti-abuse technology
Provider: YachtCraft Index, Cloudflare or another security provider
Purpose: Protects the website, forms and accounts against malicious traffic and abuse.
Duration: Session-based or according to the provider’s security settings
Category: Essential

Cookie or technology: Payment-session or fraud-prevention technology
Provider: Stripe
Purpose: Supports secure checkout, payment authentication and fraud prevention.
Duration: Session-based or according to Stripe’s payment and security settings
Category: Essential

Cookie or technology: Form or technical session state
Provider: YachtCraft Index
Purpose: Maintains requested form or platform functions during a session.
Duration: Normally until the session ends
Category: Essential

Analytics cookies

Cookie: _ga
Provider: Google Analytics
Purpose: Distinguishes users for analytics measurement.
Default duration: Up to two years
Category: Analytics

Cookie: _ga_<container-id>
Provider: Google Analytics
Purpose: Maintains analytics session information.
Default duration: Up to two years
Category: Analytics

18. Production cookie audit

Before public launch, CraftIndex OÜ should complete a cookie and storage audit on the live production website.

The audit should identify:

• the exact name of every cookie;
• the provider;
• whether it is first-party or third-party;
• its purpose;
• its category;
• its duration;
• when it is activated;
• whether it transfers data outside the European Economic Area; and
• whether it is blocked before consent where required.

The public cookie schedule should be updated with the exact production information.

The audit should be repeated after material changes to:

• authentication;
• payment;
• analytics;
• security;
• hosting;
• embedded content;
• consent-management tools; or
• third-party scripts.

19. Cookie banner

On a user’s first visit, the website should display a cookie banner before optional analytics cookies are activated.

The first layer should provide clear choices.

Recommended wording:

Cookie banner heading

Your Privacy Choices

Cookie banner text

We use essential cookies to operate and secure YachtCraft Index. With your permission, we also use Google Analytics to understand how the website is used and improve it. Analytics cookies are optional and are not activated unless you accept them.

Buttons

• Accept Analytics
• Reject Analytics
• Cookie Settings

The Accept and Reject options should be similarly visible and easy to select.

The banner must not use a pre-selected analytics checkbox.

20. Cookie settings panel

The settings panel should provide the following categories.

Essential cookies

Always active

These cookies are necessary for login, security, payment, session management and remembering your privacy choices. The platform may not function correctly without them.

Analytics cookies

Optional

Google Analytics helps us understand website use and improve the platform. Analytics cookies are activated only if you consent.

The panel should provide a clear save button, such as:

Save My Choices

21. Withdrawing or changing consent

Users must be able to change their cookie choice after the first visit.

A persistent link should be available in the website footer or privacy interface, labelled for example:

• Cookie Settings
• Manage Cookies
• Privacy Choices

When analytics consent is withdrawn:

• no new analytics cookies should be set;
• existing analytics cookies should be deleted where technically possible through the consent tool;
• analytics storage should be updated to denied;
• future analytics tracking should stop in the consent-requiring mode; and
• the new choice should be recorded.

Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

22. Duration of the consent choice

The website may remember a cookie choice for approximately 6 to 12 months.

The user may be asked again where:

• the stored choice expires;
• the user deletes browser data;
• the consent categories change;
• a new analytics or tracking provider is introduced;
• the legal basis changes;
• the Policy changes materially; or
• renewed consent is otherwise required.

23. Browser controls

Most browsers allow users to:

• view cookies;
• delete cookies;
• block all cookies;
• block third-party cookies;
• restrict cookies to specific websites;
• clear cookies when the browser closes; and
• receive warnings before cookies are stored.

Browser settings vary by provider and device.

Blocking all cookies may prevent:

• login;
• account access;
• profile editing;
• payment;
• form submission;
• security functions; and
• other essential platform functions.

24. Private or incognito browsing

Private or incognito browsing may limit how long cookies remain on a device.

It does not necessarily prevent every website or service provider from receiving technical information during the browsing session.

25. Do Not Track and browser privacy signals

Some browsers send “Do Not Track” or similar signals.

There is no single universally implemented standard governing every such signal.

YachtCraft Index will primarily rely on its cookie-consent interface and applicable browser controls to record and apply analytics choices.

Where a legally recognised browser privacy signal becomes applicable, we may update our systems to respond to it.

26. Third-party services

Third-party providers may process information under their own privacy and cookie terms.

Relevant providers may include:

• Google;
• Stripe;
• Supabase;
• Vercel;
• Cloudflare; and
• a future consent-management provider.

CraftIndex OÜ selects and configures providers for YachtCraft Index, but does not control every aspect of an independent provider’s technology or policy.

Users may consult the relevant provider’s privacy information for further details.

27. Embedded content

YachtCraft Index does not currently plan to use public embedded video, social-media or advertising content that places non-essential third-party cookies.

If embedded services such as YouTube, Vimeo, social-media feeds or maps are introduced:

• their cookie behaviour must be reviewed;
• they should be blocked before consent where required;
• the cookie banner and schedule must be updated; and
• an appropriate consent category must be provided.

28. Payment pages

Stripe may use strictly necessary cookies or similar technologies when a user begins or completes payment.

These technologies may be necessary for:

• secure checkout;
• fraud prevention;
• payment authentication;
• transaction processing; and
• compliance with payment requirements.

Disabling them may prevent payment from being completed.

Stripe’s own website or hosted checkout page may also provide separate privacy and cookie information.

29. Account and authentication technologies

Supabase or other authentication infrastructure may use browser storage or secure tokens to:

• identify the authenticated session;
• keep the user logged in;
• refresh authentication;
• apply access permissions;
• prevent unauthorised access; and
• log the user out securely.

These technologies are essential where the user requests account access.

30. Security technologies

Cloudflare or other infrastructure providers may use cookies or similar technologies to:

• distinguish legitimate users from automated traffic;
• manage security challenges;
• protect against distributed denial-of-service attacks;
• maintain secure traffic routing;
• apply rate limits; and
• protect the website and accounts.

These technologies may be treated as essential where they are strictly necessary for website and account security.

31. International data processing

Some cookie and analytics providers may process data outside Estonia or outside the European Economic Area.

Where personal data is transferred internationally, the safeguards described in the YachtCraft Index Privacy Policy apply.

These may include:

• an adequacy decision;
• Standard Contractual Clauses;
• supplementary contractual or technical measures; or
• another lawful transfer mechanism.

32. Personal data and cookies

Information linked to a cookie, account, IP address or device may constitute personal data where it identifies or can reasonably be linked to an individual.

The Privacy Policy explains:

• the data controller;
• processing purposes;
• legal bases;
• recipients;
• international transfers;
• retention;
• individual rights; and
• how to submit a privacy request.

33. Changes to cookie use

We may change the cookies and technologies used by YachtCraft Index where necessary to:

• introduce new platform functions;
• improve security;
• change service providers;
• improve authentication;
• change analytics;
• comply with legal obligations; or
• improve website performance.

Non-essential technologies will not be activated without the required consent.

34. Changes to this Cookie Policy

CraftIndex OÜ may update this Cookie Policy to reflect:

• changes in law;
• changes in cookie use;
• new providers;
• new website functions;
• changes to analytics;
• changes to consent management; or
• clarification of existing information.

The updated Policy will display a revised version number and effective date.

Where a change materially affects consent choices, users may be asked to make a new choice.

35. Supervisory authority

Privacy complaints may be submitted to the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon
Tatari 39
10134 Tallinn
Estonia
Email: info@aki.ee

A person may also have the right to contact the data-protection authority in the country where they live or work.

36. Contact

Questions about cookies or privacy choices may be sent to:

CraftIndex OÜ
Registry code: 17498820
Pärnu mnt 139b
Kesklinna linnaosa
Tallinn 11317
Harju maakond
Estonia

Email: office@yachtcraftindex.com