Legal
Cookie Policy
Short version: we use strictly-necessary cookies — the ones needed to sign you in, secure the site, and continue your chat with Lilou — plus one optional functional entry the Lilou chat widget writes when you switch its language. No advertising. No tracking. No analytics cookies.
What are cookies / local storage?
Small files or browser-storage entries a site uses to make features work, keep you signed in, or measure usage. Under EU law, anything that is not strictly necessary requires your consent before it is set.
Categories we use
1. Strictly necessary (no consent required)
These are required for the site, the operator dashboard, and the chat to function.
| Name | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
ava_session | avadigital.ai | Authenticated session JWT after you sign in with Google | First-party · HttpOnly · Secure · SameSite=Lax · Path=/ | 30 days |
ava_oauth_state | avadigital.ai | Single-use CSRF token protecting the Google sign-in handshake | First-party · HttpOnly · Secure · SameSite=Lax · Path=/ | 10 minutes (cleared on sign-in completion) |
ava_cal_state | avadigital.ai | Single-use CSRF token protecting the Google Calendar connection handshake (operators only) | First-party · HttpOnly · Secure · SameSite=Lax · Path=/ | 10 minutes |
intake_widget_session | Lilou chat widget | Anonymous session identifier so your conversation continues across page reloads | First-party · SameSite=Lax · Path=/ | 30 days |
__cf_bm | Cloudflare (our CDN) | Bot detection / abuse protection — set automatically by Cloudflare's edge | Cloudflare · SameSite=None · Secure | ~30 minutes |
| (widget auth token) | Lilou chat widget | The per-session HMAC token the widget mints via the bootstrap endpoint; stored in browser memory / sessionStorage, not in a persistent cookie | sessionStorage | Conversation only (cleared when the tab closes) |
None of the above is used for tracking, profiling, or advertising.
2. Functional (consent required)
One entry today — the Lilou chat widget's language preference. Functional under ePrivacy Art. 5(3); only read and written after you opt in to the Functional category in the cookie banner.
| Name | Set by | Purpose | Type | Lifetime | Set when |
|---|---|---|---|---|---|
intk:ava:lang |
Lilou chat widget | Language preference for the Lilou chat widget — remembers whether you chose English or French in the in-widget language toggle, so Lilou keeps replying in the language you picked. | Functional · sessionStorage (not a persistent cookie) | Session (cleared when you close the tab) | You select a language in the widget |
If you don't opt in to Functional, the widget runs in English by default and your language choice is not persisted between page navigations within the session.
3. Analytics / performance (consent required)
None currently set. avadigital.ai uses no third-party web analytics — no Google Analytics, no Plausible, no PostHog, no Hotjar, nothing. If we add an analytics provider in the future, it will be listed here, disabled by default, gated behind your explicit consent via the cookie banner, and announced on the Privacy Policy page at least 30 days before deployment.
4. Advertising / third-party tracking
None. We use no advertising cookies, no cross-site tracking pixels, no remarketing tags, no social-media widgets that track you. Confirmed against the live deployment.
The chat widget specifically
The Lilou chat widget stores only what's needed to run the conversation (a session id and a short-lived authentication token bound to this site). It does not read your other browsing, contacts, or location. What you type is processed per the Privacy Policy.
Your choices
- Consent banner. Today the site sets only strictly-necessary cookies (see §1), for which the EU ePrivacy Directive does not require consent. We still surface a banner so you can review what's set, re-open this policy any time, and pre-record your choices in case we add functional / analytics cookies later — at which point the banner gates them with a genuine Reject option as prominent as Accept.
- Browser controls. You can block or delete cookies / local storage in your browser settings at any time. Note that blocking strictly-necessary items will break sign-in, calendar connection, or the chat conversation.
Third-party cookies
When you sign in with Google, Google may set its own cookies as part of its login process, governed by Google's privacy policy. We don't control those. We do not embed advertising or social-media tracking pixels on this site.
Changes
If we ever add a new category of cookie (for example, optional analytics), we will update this page and ask for your consent first where the law requires it.
Change log
- v0.3 · 27 May 2026 — F-03: corrected cookie disclosure to accurately reflect
intk:ava:langset by the Intake widget. BumpedCC_VERSIONto re-prompt consent. - v0.2 · 26 May 2026 — Filled real cookie inventory; added consent-banner commitment for any future functional / analytics entries.
Contact
For any question about cookies or to exercise your data-protection rights: [email protected]. See also our Privacy Policy.