Cookie Policy

Cookies are small text files a site stores in your browser to remember information between requests — like keeping you signed in, remembering a display preference, or recognizing repeat visits for analytics purposes. Some cookies are essential for a site to function; others are optional and only improve the experience or help us understand usage.

We group the cookies we use into three categories, detailed below:

• Strictly necessary — required for login and core functionality; cannot be disabled without breaking the product
• Functional — remember preferences; not required, but improve the experience
• Analytics — help us understand aggregate usage patterns; fully optional

• Access token cookie — a short-lived (15 minute) JWT that keeps you signed in to the dashboard or agent panel and authorizes API requests made on your behalf. Expires automatically after 15 minutes and is silently reissued using the refresh token below.
• Refresh token cookie — a longer-lived (30 day) token, stored hashed (not plaintext) in our database, used to reissue a fresh access token without asking you to log in again every 15 minutes. Cleared on logout or password change.
• CSRF/session-integrity cookie — where used, helps prevent cross-site request forgery against authenticated dashboard actions.

These cannot be disabled — blocking them means you cannot stay signed in.

• Theme preference — remembers light/dark dashboard display preference.
• Sidebar/layout state — remembers collapsed/expanded panel states in the dashboard and agent panel so they don’t reset on every page load.

These are not required for core functionality and default to a sensible state if disabled.

We use analytics cookies on the marketing site and dashboard to understand aggregate behavior — which pages are visited, general navigation patterns, and conversion from marketing pages to signup — so we can improve the product and content. These are not used to build individual visitor profiles for advertising, and JestBot does not run advertising of any kind on its own products.

The embeddable chat widget itself is designed to be lightweight on a third-party site and primarily relies on a session identifier (to keep the last messages of a conversation in context) rather than persistent tracking cookies. Widget session tracking used for analytics (hashed IP, domain, referrer, and country where available) is described in our Privacy Policy rather than duplicated here, since it’s implemented at the request/session level rather than as a traditional persistent cookie.

Google login (via Firebase Authentication) and Razorpay checkout may set their own cookies during sign-in or payment — for example, Google’s own session cookies during the OAuth flow, or Razorpay’s fraud-prevention cookies during checkout. These are governed by Google’s and Razorpay’s respective privacy and cookie policies, not this one, and we don’t control what those providers individually set or how long they persist.

Most browsers let you view, block, or delete cookies from Settings → Privacy (the exact path varies by browser). Blocking strictly necessary cookies will prevent you from staying signed in to the dashboard or agent panel entirely. Blocking functional or analytics cookies will not break core functionality but may reset preferences between visits.

If you’re visiting from the EU or UK, non-essential cookies (functional and analytics) are only set after you actively consent via the cookie banner shown on your first visit. You can change your choice at any time by reopening cookie preferences from the footer link. Strictly necessary cookies used for authentication are set regardless of consent choice, since the dashboard cannot function without them — consistent with ePrivacy/GDPR guidance treating strictly necessary cookies as exempt from consent requirements.

We may update this policy as we add or change features that rely on cookies. We’ll update the date at the top of this page when we do, and where a change is material, we’ll surface the updated cookie banner again for re-consent.