Cookie Policy

This policy was written from a direct technical review of what Vela's own code actually stores in your browser, rather than from a generic template. It reflects our production application as it exists at the time this policy was last updated, and distinguishes clearly between cookies, browser local storage, and browser session storage, since these behave differently even though they are often grouped together under "cookies" in everyday language.

"Cookies" are small pieces of data that a website asks your browser to store and send back on later requests to that same site. "Local storage" and "session storage" are similar browser storage mechanisms that a website's own code can read and write directly; unlike cookies, they are not automatically sent to a server with every request. Session storage is cleared when you close the browser tab; local storage persists until it is cleared.

We do not use advertising cookies, third party analytics trackers, or marketing pixels anywhere in the Service, including on our own website, in the dashboard, in the AI chat widget, or on websites built with the Service. We do not use Google Analytics, Meta Pixel, or any comparable advertising or cross site tracking technology. The storage we do use falls into three categories: an authentication cookie that keeps you signed in, a small number of local storage entries that remember your preferences and in-progress work, and, only when a Vela Customer chooses to connect WhatsApp as a Connected Channel from their dashboard, a script and cookie set by Meta Platforms, Inc. as part of that specific connection flow. Each is described in detail below.

The Service uses one strictly necessary cookie, set by our authentication provider, Supabase, to keep you signed in to your Vela Account across page loads and to identify which requests come from your authenticated session. Without this cookie, the dashboard and any feature that requires you to be logged in would not function, so it cannot be switched off while you use the Service. This cookie does not track you across other websites and is not used for advertising.

The dashboard and our public website use browser local storage, not cookies, to remember your interface preferences and certain in-progress work, so that the Service behaves the way you left it the next time you open it. None of these entries are sent to a server automatically; our own application code reads them only when needed to render the interface. The following is a complete list of the local storage keys our code sets, based on a direct review of the codebase:

We also use one browser session storage entry, cleared automatically when you close the tab, to avoid repeatedly re-triggering the same resume-session behavior within a single browser session.

If you build and publish a website using the Service, and it includes the embeddable AI chat widget, the widget stores a conversation identifier in the visiting End Customer's browser using local storage, keyed to the specific website and business, for example in the form vela_conv_[tenant]_[website]. This lets an End Customer's conversation with the AI Agent persist correctly if they close and reopen the chat widget or navigate between pages on that site, rather than starting a new conversation every time. This entry is not a cookie, is not sent automatically to any server, is not shared across different websites, and is not used to track a visitor across other, unrelated sites.

For websites built with the Service, we record aggregate visit statistics, such as visit counts, device type, approximate country, and referring page, so that our Customers can see traffic and engagement for their own site in their dashboard. This is implemented without a tracking cookie: a visitor is counted using a one way cryptographic hash generated from their IP address and browser type at the time of the visit, and that hash is used only to avoid double counting a visit, not to build an ongoing profile of that visitor or to track them elsewhere. No identifying value is placed in the visitor's browser for this purpose.

The Service does not load third party advertising, analytics, or tracking scripts on our own website, in the dashboard, in the AI chat widget, or on websites built with the Service. There is one specific, narrow exception, described below, which only ever occurs inside the authenticated dashboard and only for a Customer who takes a specific action.

Under GDPR, the ePrivacy Directive, and comparable laws, a cookie consent banner with granular accept and reject controls is required when a website uses non essential cookies, such as advertising or analytics cookies that are not necessary to provide the service the visitor asked for. Based on the direct technical review summarized in this policy, the Service does not use any non essential, non functional cookies: the only cookie we set is the strictly necessary authentication cookie described in Section 3, and the only third party cookie that can occur is the narrow, action triggered Meta SDK case described in Section 7.1, which is not something an ordinary visitor or End Customer ever encounters. Because none of our own storage is used for advertising, cross site tracking, or optional analytics, a consent banner is not currently required, and we have not added one, rather than adding one that would offer a choice that does not actually change what is collected.

Most browsers let you view, delete, and block cookies and site data through their settings, and let you clear local storage for a specific site. Because the authentication cookie described in Section 3 is required to remain signed in, blocking or deleting it will sign you out of your Vela Account. Clearing local storage for the Service will reset the interface preferences described in Section 4 to their defaults and, if done on a page where the chat widget described in Section 5 is embedded, may start a new conversation the next time an End Customer opens that widget.

Because we do not use advertising or cross site tracking cookies, there is no advertising opt out to configure for the Service itself; any browser level "do not track" or global privacy control setting you have enabled is respected in the sense that we have nothing additional to disable, since we do not track you across sites in the first place.

We may update this Cookie Policy as the Service changes, including if we add or remove a storage technology described here. We will update the "Last updated" date at the top of this policy when we do, and if a change means we begin using a non essential cookie for the first time, we will implement consent as described in Section 8 before that change takes effect, not after.

If you have questions about this Cookie Policy or about the storage technologies described in it, contact us at velaOsSupport@gmail.com.