Cookie Policy

This Cookie Policy describes how Saaya uses cookies and similar storage technologies on the marketing site at saaya.ai, the dashboard at app.saaya.ai, and the admin console at admin.saaya.ai. It supplements the Privacy Policy and is governed by Indian law, the Digital Personal Data Protection Act, 2023 (DPDP Act), the IT Act, 2000, and the rules issued under them.

We try to be lean on cookies. The marketing site and the signed-in dashboard use a tag manager to load measurement tags (aggregate site analytics and, when enabled in the container, a session-replay tag), see section 2.3. Those tags do not load until you grant analytics in the cookie control. We do not run cross-site behavioural advertising trackers. The admin console does not load the tag manager today.

1. What are cookies?

Cookies are small text files placed on your device by a website. Similar technologies, localStorage, sessionStorage, browser cache, IndexedDB, pixel tags, let a website store or retrieve information on your device. We use the term "cookies" in this policy to cover all of these.

2. Categories we use

2.1 Strictly necessary

These keep the Service working. We do not ask for consent before setting them, because the Service cannot function without them.

| Name | Set by | Purpose | Lifetime | |---|---|---|---| | saaya_access | Dashboard / admin | HttpOnly session cookie that authenticates you. | Session | | saaya_refresh | Dashboard / admin | HttpOnly cookie that renews the access session without re-prompting you. | Up to 7 days | | saaya_csrf | Dashboard / admin | HttpOnly anti-forgery token for state-changing requests. | Session | | organization_id | Dashboard | localStorage key that remembers which workspace you are viewing. | Persistent | | saaya-consent-v2 | All three sites | localStorage record of your cookie categories, timestamp, and policy version. Strictly necessary to remember the choice. | Persistent | | saaya-theme / saaya-appearance-v2 | Dashboard / admin | Remembers light/dark preference. | Persistent | | Hosting routing cookies | Hosting CDN | Routes your request to the correct deployment. | Session |

2.2 Functional

These remember preferences that improve your experience. We treat them as strictly necessary in practice, but we list them separately so you can see exactly what we keep:

| Name | Purpose | Lifetime | |---|---|---| | saaya-cta-dismissed | Marketing-site preference: hides the floating sticky CTA after you dismiss it. | Session |

2.3 Analytics

We use a tag manager on saaya.ai and app.saaya.ai to load measurement tags. The tag manager itself does not set tracking cookies; it is the loader. The tags it deploys may set the cookies listed below. We present a cookie control (Accept all, Reject non-essential, or Manage categories) before those tags load. Public dashboard routes used as embeds or KYC (/embed, /w, /kyc) load neither the tag manager nor the banner.

| Name | Set by | Purpose | Lifetime | |---|---|---|---| | _ga | Analytics tag (loaded via the tag manager) | Distinguishes unique users for aggregate site analytics. | 2 years | | _ga_<container-id> | Analytics tag (loaded via the tag manager) | Persists session state for analytics. | 2 years | | _gid | Analytics tag (where enabled via the tag manager) | Distinguishes users for 24 hours. | 24 hours | | _gcl_au | Conversion linker (only if enabled via the tag manager) | Attributes conversions; never used for cross-site behavioural advertising. | 90 days | | MUID / CLID / related | Session-replay tag (Microsoft Clarity, if enabled in the container) | Distinguishes browsers for aggregate product analytics. | Up to 13 months |

We do not enrich analytics data with third-party identity graphs. We do not use cross-site advertising trackers. If we enable a new measurement tag through the tag manager that sets a cookie, we will list it here before activating it.

2.4 Advertising

We do not use advertising cookies on saaya.ai, app.saaya.ai, or admin.saaya.ai. The cookie control still shows an Advertising category, default off, so a future tag cannot silently expand consent. We do not sell or share personal information for cross-context behavioural advertising.

3. Third-party services

A small number of third-party services may set cookies when you interact with embedded content or when measurement tags load:

• Tag manager, loads on saaya.ai and the signed-in dashboard only after analytics consent. The container itself does not set tracking cookies; refer to the provider's own cookie policy. Cookies set by tags inside the container are listed in section 2.3.
• Analytics and conversion measurement, when these tags are enabled inside the tag manager, they set the cookies listed in section 2.3. Refer to the provider's own cookie policy.
• Embedded video player, when you press play on the home-page video showcase, a privacy-enhanced video player loads. It does not set ad-personalisation cookies; refer to the provider's own cookie policy.

If we add new third-party services that set cookies, we will update this list.

4. Managing cookies

You can:

• Cookie control, on saaya.ai, app.saaya.ai, and admin.saaya.ai: Accept all, Reject non-essential, or Manage (Strictly necessary locked on, Analytics optional, Advertising off by default). Re-open it any time via Cookie settings in the marketing footer, the dashboard Privacy page, or the admin profile menu. Your choice is stored in saaya-consent-v2 with a timestamp and this policy's version. Withdrawal does not affect the lawfulness of processing done before withdrawal.
• Browser controls, clear cookies and adjust per-site preferences in your browser. Refer to your browser's help for the exact path; doing so signs you out of the dashboard.
• Global Privacy Control (GPC), where the browser sends the GPC signal and you have not already stored a choice, we treat analytics as rejected.

5. Changes

We will update this page when our cookie usage changes. Material changes are announced through the Privacy Policy update mechanism.

6. Contact

Questions? Write to info@illusionart.ai with the subject "[Privacy request]".