Cross Water Production uses cookies to operate cross-water.com and, with your consent, to understand how the site is used. You can change your choices any time from the footer's Cookie settings link.
Required for the site to work. Your cookie choices (xw_cookie_consent) are kept in your browser's localStorage for 180 days. If you start building a boat in the configurator, that build (xw-build-v1:…) is kept in localStorage for 30 days so you can pick it up where you left off, and when you open the quote page from the configurator a picture of it (xw-quote-hero) is put in sessionStorage, which your browser clears when you close the tab. None of them contain an identifier. Opening the quote page carries the build in the page address, so it reaches our servers at that moment; we store it only if you send the quote request. On a personal offer page (proposals.cross-water.com) one cookie (xw_offer) keeps you on that one offer for up to 30 days, or until the offer expires if that is sooner; it carries the offer's own identifier and nothing else.
Third-party analytics with IP anonymization, active only after you accept analytics. Helps us see which pages and platforms get attention. The same category covers a product-analytics service (PostHog, EU data centre) that records how a page is used — which elements are clicked and which steps of a form are reached — and that can replay a recording of your visit to the page. Everything you type into a form is masked out of that recording. On a personal offer page this runs only if you allow analytics on that page itself; see “Personal offer pages” below.
Cookies and pixels from advertising partners, active only if you accept marketing. Used to measure our advertising and reach relevant audiences. If you submit a form, the details you enter may also be shared with these partners as a one-way code — never in readable form — so your visit can be matched to your account with them. Global Privacy Control keeps these off regardless of any earlier choice.
Independently of cookies, we count visits with a first-party, cookie-free method: nothing is stored on your device, and your IP address is never stored. Instead, a daily-rotating secret value is combined with technical connection data into a one-way code that lets us count same-day visits; the secret is deleted every 24 hours, after which these counts are permanently anonymous and cannot be linked to anyone. Country comes from network-level location, not a stored address. We do this under legitimate interest to know how many people visit at all — consented analytics only ever sees a fraction.
The same anonymous method also counts which stage of our enquiry forms is reached — started, sent, blocked by a technical error, or left without sending. We record which field was last touched and how many were completed, never what was typed into them, and time on the form only as a coarse range.
We honor the Global Privacy Control signal as an opt-out: with GPC enabled your visit is not counted at all. You can also object to this measurement any time via the contact address below.
Information you send through the contact, quote, or newsletter forms is delivered to our sales inbox via Resend and used only to respond to your inquiry. Newsletter signups go through a double-opt-in confirmation email; unsubscribe at any time. The IP address attached to a submission is kept for about a week at most (spam protection), then automatically removed.
If your enquiry came from the configurator, our sales team may prepare a personal offer page for you on proposals.cross-water.com. The link is sent to you by a person, never automatically. The page shows your first name, your build and its prices, and anyone with the link sees the same page.
Always recorded, to answer your enquiry. One strictly necessary cookie (xw_offer) keeps you on the offer for up to 30 days. We record that the link was opened, with the time and which version of the offer it showed, and keep any build you save. This does not depend on cookie consent or Global Privacy Control.
Only if you allow analytics on the offer page. We also record which parts of the page you viewed, how long it was open, your device type (phone, tablet or computer) and actions such as opening the 3D view, changing the build, pressing a contact button or printing. PostHog (EU data centre) records how the page is used and a replay of your visit, with anything you type masked out; replays are deleted after 30 days. PostHog keeps its data for the offer page in your browser's local storage, not in a cookie. If you decline, do not answer, or your browser sends Global Privacy Control, none of this happens. Your choice is remembered, and you can change it on the offer page.
Our sales team sees this to follow up on your offer. These records are kept with your enquiry and deleted together with it; what PostHog holds is kept for PostHog's retention period. If you ask us to erase your data, we also delete the replays and ask PostHog to delete the usage events.
On every page, including offer pages, we use Sentry (EU data centre) to be told when something breaks. An error report says what failed, your browser and device type, and the page; on an offer page the private link is removed from it and the report is marked with the offer it came from. Sentry also times a small sample of requests to the main site, and Vercel Speed Insights measures how fast the main site's pages load, without cookies. To stop abuse, opening an offer link briefly uses your IP address to limit repeated attempts; it is kept for about a minute. All of this is used only to find and fix faults, and runs without cookie consent, under our legitimate interest in keeping the site working and secure.
Forms are protected by Cloudflare Turnstile, which may set short-lived challenge tokens to verify you're not a bot. These do not track you across sites.
For questions about how your data is handled, or to ask for a copy of your data, have it corrected or deleted, object to its use, withdraw a consent, or have an offer link withdrawn, contact info@xwproduction.com. You can also complain to your local data protection authority.