HTTP/2 200 content-type: text/html date: Sun, 28 Dec 2025 23:00:11 GMT last-modified: Mon, 22 Dec 2025 17:50:35 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: yKudjtcDqGfMthE55U_nBBoTtF4oyq6x server: AmazonS3 content-encoding: gzip etag: W/"c5445184d221b573acd127cd282cb486" vary: Accept-Encoding x-cache: Miss from cloudfront via: 1.1 2f83dfeb1a1636b50c323351c6fa829a.cloudfront.net (CloudFront) x-amz-cf-pop: BOM78-P8 x-amz-cf-id: ty70IEIkguYu15iCeL5ThNvhJxRPvrxQBJ79uP_j5dshvYE6pS9vnQ== x-xss-protection: 1; mode=block x-frame-options: DENY content-security-policy: default-src 'self' *.google.com google.com *.google.ca *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.gstatic.com *.recaptcha.net *.youtube.com *.facebook.com *.facebook.net *.hotjar.com *.hotjar.io wss://*.hotjar.com:* *.onetrust.io *.onetrust.com *.cookielaw.org *.doubleclick.net *.tiktok.com *.amazon-adsystem.com *.basis.net *.sitescout.com *.paa-reporting-advertising.amazon tracker.samplicio.us api.lever.co zoox.us18.list-manage.com *.amazonaws.com *.tiktokw.us *.spotify.com *.byspotify.com *.my.site.com *.my.salesforce-scrt.com; manifest-src 'self'; base-uri 'self'; form-action 'self'; font-src 'self' data: 'unsafe-inline'; frame-ancestors 'self'; object-src 'none'; media-src 'self' stream.mux.com *.datocms-assets.com; img-src 'self' blob: data: *.google.com *.googletagmanager.com google.com *.google-analytics.com *.datocms-assets.com cdn.cookielaw.org arttrk.com *.doubleclick.net *.facebook.net *.facebook.com *.sitescout.com *.google.ca; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google.com google.com *.google.ca *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.gstatic.com *.recaptcha.net *.youtube.com *.facebook.com *.facebook.net *.hotjar.com *.hotjar.io *.onetrust.io *.onetrust.com *.cookielaw.org *.doubleclick.net *.tiktok.com *.amazon-adsystem.com *.basis.net *.sitescout.com *.paa-reporting-advertising.amazon tracker.samplicio.us *.byspotify.com *.my.site.com *.my.salesforce-scrt.com; style-src 'self' blob: data: 'unsafe-inline' *.my.site.com *.my.salesforce-scrt.com; worker-src 'self' blob:; x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains; preload permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), fullscreen=(self), sync-xhr=(), midi=(), picture-in-picture=(), autoplay=(self), encrypted-media=()