Cookie Policy

1. Scope

This Cookie Policy explains how IMFA Labs LLC, the company that operates IMFA Agents ("IMFA," "we," "us," or "our"), uses cookies and similar browser storage on the IMFA Agents website, dashboard, and hosted chat widgets. It works together with our Privacy Policy, which explains how we handle the personal data these technologies may hold.

2. What cookies and browser storage are

A cookie is a small text file that a website asks your browser to keep and send back on later requests. Local storage and session storage are similar browser features: local storage keeps data until it is cleared, and session storage keeps it only until you close the tab.

We use these technologies for two purposes: to make the service work, and, only with your consent, to measure how the website is used.

3. Strictly necessary cookies

These cookies keep you signed in and protect your account. The service cannot work without them, so they do not require consent. They are first-party cookies, set by IMFA Agents itself, and are never used for advertising.

On secure connections, each name starts with __Host-, which limits the cookie to this exact website. All three cookies are only sent on requests from this website and when you follow a link to it, never on requests that other websites make in the background (SameSite=Lax), and are deleted when you sign out.

IMFA does not host the service on its own servers. The website runs on managed hosting (Vercel), and our backend runs on Convex, which is SOC 2 Type 2 compliant, HIPAA compliant, and GDPR verified. These providers handle the requests your browser sends, but the cookies listed above belong to IMFA Agents and are not used by those providers for their own purposes.

When you connect WhatsApp, Instagram, or Facebook, the connection goes through Zernio, an official Meta Business Partner that is SOC 2 Type 2 and GDPR compliant (Zernio Trust Center). The pages Zernio and Meta show during that step may set their own cookies under their own policies.

4. Preferences stored in your browser

We keep some choices in your browser's local storage so the interface stays the way you left it. This data stays on your device and is not used to track you.

• Theme: light, dark, or system appearance.
• Language: the language you chose for the dashboard.
• Interface layout: whether the sidebar is collapsed, which list it shows, the AI model you picked in the composer, the code example tab you last opened, workflow positions in the agent builder, and whether you finished a product tour.
• Privacy choices: your consent decision, so we can respect it before you sign in and transfer it to your account afterwards.
• Sign-up destination: the page you were trying to open when you created an account, kept only until you confirm your email and then removed.

Some information lives only in session storage and is cleared when you close the tab. Examples include the conversation you are having with a chat widget and an agent description you typed before signing in.

5. Analytics cookies (only with your consent)

If you allow analytics, we load Google Analytics through Google Tag Manager to understand which pages are visited and how the website is used. Google Analytics then sets its own cookies, typically named _ga and _ga_<ID>, which can last up to 2 years.

Until you choose, analytics stays off and no analytics cookies are set. If you decline, it stays off. We use Google's consent mode and always deny advertising storage, ad personalization, and ad user data, so these cookies are not used for advertising.

6. Chat widgets on other websites

When a business adds an IMFA chat widget to its own website, the widget keeps a pointer to your conversation in session storage for that tab (imfa:threads), so you can continue it while you browse. Before a message is sent, a bot-protection check runs in your browser to block automated abuse. The business that runs the website is responsible for its own cookie notice and for any cookies it sets itself.

The widget also keeps a random identifier in its local storage (imfa:visitor-id). It is not linked to your name or contact details, and it is not used for advertising or to follow you across websites; your browser keeps it separately for each website the widget is on. We use it to group your conversations with that business's agent and to protect the agent from abuse: if you spam an agent, try to change its instructions, insult or threaten it, or keep asking for content that is not allowed, the agent warns you once, and after a second warning within 24 hours it stops answering this identifier for 7 days. In that case only, we also keep a one-way hash of your IP address for 24 hours, so a new conversation from the same address is not answered either. This storage is needed to keep the chat working and safe, so it does not require consent. Clearing your browser's site data removes the identifier. See our Privacy Policy and Acceptable Use Policy.

If the business turned on voice calls in its widget, the widget also sets a cookie named imfa_calls_<agent>. It counts the calls started from your browser so that, after 3 calls in 30 minutes, calls to that agent pause for 30 minutes. It holds only the start times of those calls, is partitioned so it stays tied to the website you are on, and expires after at most 1 hour. It is needed to protect the service and is not used to track you.

7. Managing your choices

• Change your analytics choice at any time from Settings > General > Consent manager. Withdrawing consent stops analytics from then on.
• Delete or block cookies in your browser settings. If you block strictly necessary cookies, you will not be able to sign in.
• Clear stored preferences by clearing your browser's site data for IMFA Agents. Your interface preferences return to their defaults.

8. Changes to this policy

We may update this policy when we add, remove, or change cookies or similar technologies. We will post the revised policy with a new effective date and give additional notice when required.

9. Contact

To ask a question about cookies, email privacy@imfa.io.