Essential cookie
The website server sets a short-lived, HTTP-only xytra_csrf cookie when a visitor starts a protected form. It is used only to prevent cross-site request forgery and expires after one hour.
Analytics
The built-in analytics adapter records named conversion events and limited plan properties. It does not intentionally collect passwords, payment details, names, email addresses or message content. If third-party analytics or advertising tools are enabled later, this notice and any consent controls must be updated before deployment.
Payment provider
The configured hosted checkout provider may set its own essential cookies after you choose to continue to payment. Review that provider’s policy at checkout.