Cookie Policy

What cookies and browser storage we use

• hd_session — strictly necessary. httpOnly session cookie (30 days, SameSite). Authenticates you on the platform after login; cannot be read by JavaScript.
• hd_org / hd_ws — strictly necessary. Remembers which organization and workspace you have active when you work across multiple tenants. No personal data beyond your internal IDs and the choice you made.
• 2FA flow cookies — strictly necessary, short-lived (about 2 minutes). Carry a random, signed intermediate step while you complete a two-factor login.
• Visitor widget storage ('hd_wid' / 'wid') — functional. A random token in the visitor's browser local storage on a customer's site, used only so a returning visitor continues their existing conversation. Not a tracking cookie; contains no personal data (the server stores only an SHA-256 hash of it), and can be cleared from the browser without losing account data.
• Analytics cookies — privacy-preserving statistics from Cloudflare Insights (no cross-site tracking, no advertising identifiers).

What we do NOT use

• No third-party advertising or retargeting cookies.
• No cross-site profiling of visitors.
• No cookie-based consent walls: because we only use strictly necessary and privacy-preserving analytics cookies, no consent banner is required under most ePrivacy implementations. If operators add advertising cookies in the future, a consent manager will ship with it.

Third-party cookies inside the app

When you use integrated features, you may additionally receive cookies set by those providers: Cashfree sets cookies/tags during payment checkout for fraud prevention and payment-session security; Meta, Twilio, and inbox provider infrastructure use functional cookies/tags needed to route messages. These are governed by the respective providers' policies, not ours.

How long each cookie lasts

• hd_session — up to 30 days from your last activity, or until you log out (it is revoked server-side either way).
• hd_org / hd_ws — until removed; transient UI state only.
• 2FA intermediate cookies — expire immediately after login completes.
• Cloudflare Insights — up to 30 days from the visitor's last visit, as described in Cloudflare's policy.
• Widget local storage token — persists in the visitor's browser until cleared, so a returning visitor continues their conversation; deleting site data (or the customer deleting the conversation on our side and re-issuing a new one) resets it.

Managing cookies

You can clear or block cookies in your browser at any time. Code that depends on them (for instance, staying logged in) will stop working while blocked. The one-click unsubscribe links in campaign emails work without cookies.

Questions

Reach out through the details on our Contact page if you have a question about any cookie listed here.