Cookies are small files a site stores in your browser. 100mL uses them only where the marketplace cannot work without them. We run no advertising cookies, no cross-site trackers, and no third-party marketing pixels on our own pages.
Because every cookie we set is strictly necessary, we do not show a consent banner. There is nothing optional to consent to.
Cookies we set
This policy describes www.100mlhospitality.com. The table is generated from the same registry the code sets cookies from, so it cannot fall behind it.
| Cookie | What it does | How long it lasts | Deleted |
|---|---|---|---|
| better-auth.session_token (__Secure-better-auth.session_token over HTTPS) | Keeps you signed in after password, Google, SSO, or one-time-code authentication, and identifies your organization and role on every request. | 30 days from your last use. If you sign in with a password and leave “Remember me” unticked, it lasts only until you close your browser instead. | When you sign out or you end this session from your security settings |
| better-auth.dont_remember (__Secure-better-auth.dont_remember over HTTPS) | Records that you left “Remember me” unticked for the current sign-in, so the session cookie knows not to outlive your browser. | Until you close your browser | When you sign out or you end this session from your security settings |
| better-auth.state (__Secure-better-auth.state over HTTPS) | Protects a Google sign-in redirect against request forgery and callback mix-ups; consumed by the callback. | Five minutes | When the sign-in attempt completes |
| ml_login_email | Carries your email address, sealed so it cannot be read from the cookie, from the sign-in code request to its verification — so it never travels in a web address or in plain text. | Ten minutes | When the code is verified, you sign out or you end this session from your security settings |
| ml_admin_login_email | The same for the administrator sign-in screen, kept separate so opening one sign-in screen cannot change the address awaiting verification on the other. | Ten minutes | When the code is verified, a non-administrator code is refused, you sign out or you end this session from your security settings |
| ml_admin_otp_proof | Proves that this administrator session was completed with a one-time code, so an older sign-in cannot open the console. | As long as your session — it is renewed with the session and expires with it. | When you sign out, you end this session from your security settings or a non-administrator code is refused |
All of these are first-party, HTTP-only where the browser supports it, set with a same-site restriction, and tied to this site alone rather than shared with any other address. None is used for analytics or advertising.
- better-auth.relay_state — not currently set. Enterprise single sign-on is not offered until an identity provider is registered, so this cookie is never set today.
- better-auth.session_data — not currently set. The platform keeps that cache switched off so a revoked session stops working at once; the cookie is only ever cleared on sign-out, never set.
Third-party cookies
Our public forms — the newsletter sign-up on our homepage, the hotel application, the brand application, the support form and the sign-in screens, which open over the homepage — are protected by Cloudflare Turnstile, which filters automated submissions. Turnstile may set its own cookies or local storage on the Cloudflare challenge domain to remember that a browser has already passed a challenge. It is a privacy-preserving alternative to a CAPTCHA and is not used for advertising or cross-site profiling.
If you are signed in as a buyer and start setting up bank payment on your billing page, we load Stripe.js so your bank details reach Stripe directly and never pass through our servers. Stripe then sets its own cookies (__stripe_mid and __stripe_sid) to detect fraud on that payment setup. This happens only at that point, only for signed-in buyers, and never on our public pages — so no visitor to this site encounters them by browsing. Stripe is our payment processor and is listed as such in the privacy policy.
Analytics
We measure page traffic with Vercel Web Analytics, which is cookieless: it records aggregate page views and performance without storing an identifier in your browser or tracking you between sites.
What we deliberately do not do
- No advertising or retargeting cookies, and no ad-network pixels.
- No cross-site behavioral profiles, and no sale or sharing of personal information for advertising.
- No client-side marketing scripts — our email platform is called only from our servers, never from your browser.
- No session recording or heatmap tools.
- No sale or sharing of personal data of any kind — so there is no opt-out for a Global Privacy Control or Do Not Track browser signal to exercise, and we do not act on those signals. If that ever changes, this page will say so first.
Managing cookies
Every major browser lets you view, block, and delete cookies in its settings. Blocking our session cookie will stop you signing in — the marketplace cannot keep you authenticated without it. Public pages such as this one work fine with cookies blocked.
Changes and contact
If we introduce a cookie that is not strictly necessary, we will update this page and ask for your consent before setting it. Questions: privacy@100mlhospitality.com.
100mL Trade Inc. · 139 Budlong Street, Hillsdale, MI 49242 · Incorporated in Delaware, United States.