Aviral WhatsApp Platform cookie policy
Draft — pending counsel review. This page is not final yet and may change before it takes effect.
Effective date: 16 October 2026
This policy explains the cookies and similar browser storage that Aviral WhatsApp Platform uses. Aviral Techlab Private Limited ("Aviral Techlab", "we", "us") operates it. It is part of our Privacy policy.
The short version: we use only the cookies the product needs to work. We don't use advertising cookies, cross-site tracking or third-party analytics cookies.
1. What cookies and browser storage are
A cookie is a small text file a website asks your browser to keep. The browser sends it back on later requests, which is how a site remembers that you are signed in.
Local storage and session storage are similar browser features. They keep small pieces of data on your device. Local storage stays until you clear it. Session storage lasts until you close the tab. We treat them like cookies in this policy.
2. Cookies we set
These are all first-party cookies, set on our own domain. Each is needed to sign you in or to keep a connection flow secure, so they are "essential". We set them without asking for consent, as the law allows for strictly necessary cookies.
| Cookie | What it does | Lifetime | Details |
|---|---|---|---|
aw_rt | Keeps you signed in to your workspace. It holds the refresh token the app exchanges for a short-lived access token. | Up to 30 days, or until you sign out | HttpOnly, Secure, SameSite=Lax. Sent only to our sign-in endpoints. Page scripts can't read it. |
aw_prt | Keeps a partner administrator signed in to the partner console. | Up to 30 days, or until you sign out | HttpOnly, Secure, SameSite=Lax. Sent only to the partner sign-in endpoints. |
aw_oauth | Ties a connection you are making (for example to Shopify, Zoho, HubSpot or Google) to the browser that started it. This stops someone else from completing the connection in your name. | 10 minutes, and deleted when the connection finishes | HttpOnly, Secure, SameSite=Lax. Set only when you start a connection. |
The mobile app doesn't use cookies. It keeps its sign-in in the device's secure storage.
3. Browser storage we use
The product keeps the following in your browser. None of it is sent to advertisers, and none of it identifies you to anyone but us.
| Item | What it is for | Where |
|---|---|---|
aviral-wa.theme | Your choice of light, dark or system theme. | Local storage |
aviral-wa.session | A flag, not a secret, that says you probably have a signed-in session. A new tab uses it to restore your session instead of showing the sign-in page. | Local storage |
| Interface preferences | Settings that make the app feel the same each time: table columns, dashboard date ranges, collapsed sections, recently opened records, notification alert choices and the last numbers you used for test sends. | Local storage |
| Working data for a task | The step you are on in a multi-step form such as the campaign builder. | Session storage |
Your access token is held in the page's memory only. It is never written to browser storage, so it is gone when you close the tab.
4. What other companies may set
Some features load a script from another company, and only when you use that feature. That company may set its own cookies. We don't control them, and their policies apply.
- Meta (Facebook SDK). Loaded when you start WhatsApp Embedded Signup to connect a WhatsApp Business Account. See Meta's Cookies policy.
- Razorpay Checkout. Loaded when you pay for a subscription. See Razorpay's Privacy policy.
5. Our website chat widget on other sites
A business can add our click-to-chat widget to its own website. The widget runs on that business's site, and the business decides how it is used. The widget itself:
- sets no cookies;
- keeps two small items in session storage for the visit: the campaign tags (such as
utm_source) from the link the visitor arrived by, and whether they closed the greeting bubble; - sends a basic usage event (widget opened, chat clicked) to the business's workspace unless the visitor's browser sends a Do Not Track signal.
The business's own cookie and privacy notice applies to its website.
6. Analytics and monitoring
We don't use Google Analytics, Meta Pixel or any other third-party analytics or advertising tag in the product or on our website.
When error and performance monitoring is switched on, our monitoring tool receives technical reports: error messages, the page route and load timings. We remove e-mail addresses, phone numbers, tokens, cookies and message content before a report leaves your browser. It isn't used to track you across sites.
7. Your choices
- Browser settings. You can block or delete cookies and clear site data in your browser. If you block the essential cookies above, you won't be able to sign in or connect third-party apps.
- Browser storage. Clearing site data removes the preferences in section 3. The app then shows its defaults.
- Signing out. Signing out removes your sign-in cookie.
- Do Not Track. The chat widget honours it, as section 5 says.
8. Consent and changes
Because we set only essential cookies, we don't show a cookie banner. If we ever add non-essential cookies, we will ask for your consent first, in line with the Digital Personal Data Protection Act, 2023 and the IT Act, 2000, and update this page before we do.
We may update this policy. The date at the top shows the current version.
9. Contact
Questions about cookies or privacy: privacy@aviraltechlab.com.
Grievances: Grievance Officer, Aviral Techlab Private Limited, grievance@aviraltechlab.com.
Post: Aviral Techlab Private Limited, H-89, 2nd Floor, Ashok Vihar Phase-1, Delhi 110052, India.
This policy is governed by the laws of India. Courts at New Delhi have jurisdiction, subject to your rights under applicable data protection law.