Cookie Policy.

1. Introduction

This Cookie Policy explains how Xevyo ("Xevyo," "we," "us," or "our") uses cookies and similar technologies (such as local storage, session storage, and pixels) when you visit or use xevyo.com, our chat platform, and our developer API (together, the "Services").

Xevyo is a self-hosted conversational AI platform. Unlike many AI products, our core inference stack runs on our own infrastructure using our own proprietary models — but our web application, account system, and billing still rely on cookies and comparable technologies to function, to remember your preferences, and to keep your account secure.

This policy should be read alongside our Privacy Policy, which explains in more detail how we collect, use, and protect personal data (including any health-related information you choose to share with the assistant).

2. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow a site to recognise your device, remember information about your visit, and enable features such as staying signed in. We also use similar technologies, including:

• Local storage / session storage — used by the browser to hold data such as draft messages, UI state, or short-lived session tokens without sending it back to the server on every request.
• Pixels / SDKs — small pieces of code embedded in emails or pages that confirm an email was opened or a page was loaded.
• Device and session identifiers — used by our authentication and API infrastructure (e.g. secure one-time session-launch tokens, developer API keys) to recognise a signed-in session.

For simplicity, this policy refers to all of these collectively as "cookies."

3. Why We Use Cookies

We use cookies for the following broad purposes:

• Authentication & security — to keep you signed in, protect against cross-site request forgery, and support Single Sign-On (Google / GitHub OAuth), LDAP, and SCIM-provisioned enterprise logins.
• Core functionality — to remember chat sessions, threads, folders, and in-progress uploads so the product works as expected across page reloads.
• Preferences & personalisation — to remember display, language, unit, and tone/response settings, custom instructions, and which optional tools (e.g. Google Calendar, Health Connect) you have enabled.
• Performance, feedback & analytics — to understand feature usage, aggregate thumbs-up/down feedback, and monitor product performance and reliability.
• Billing & subscriptions — to support secure checkout, plan entitlements, and fraud prevention through our payment processor, Stripe.
• Admin & enterprise administration — to support administrator sessions, audit logging, and role-based access for Admin / Reviewer / Trainer / Super-Admin roles.

4. Categories of Cookies We Use

4.1 Strictly Necessary Cookies

These cookies are essential for the Services to operate — for example, keeping you logged in, authenticating API and admin sessions, and protecting your account. They cannot be switched off without breaking core functionality, and under most privacy laws they do not require consent.

4.2 Functional & Preference Cookies

These cookies remember choices you make so the assistant behaves the way you expect — without them, features such as personalisation and memory would reset every visit.

4.3 Performance, Feedback & Analytics Cookies

These cookies help us understand how the Services are used in aggregate — for example, which features are used most, and how the assistant is rated — so we can improve reliability and quality.

4.4 Billing & Payment Cookies

Subscriptions and plan upgrades are processed by our payment provider, Stripe, which sets its own cookies during checkout for fraud prevention and to keep your payment session secure. Xevyo does not process or store your full card details.

4.5 Third-Party Integration Cookies

If you choose to connect optional integrations, the relevant third party may set its own cookies during the connection (OAuth) flow. These are governed by the third party's own cookie and privacy policies, not this one.

Xevyo's core chat, voice, retrieval, memory, and image-generation features run on our own self-hosted models and do not route conversational content through third-party AI APIs. The cookies above relate to web-application functionality (login, billing, optional integrations) — not to model inference.

5. We Do Not Use Advertising Cookies

Xevyo does not display third-party advertising and does not use cookies to build cross-site advertising profiles or sell personal information to ad networks. Any analytics we use are for the internal product-improvement purposes described above.

6. How Long Cookies Last

• Session cookies — deleted automatically when you close your browser or log out.
• Persistent cookies — remain on your device for a set period (noted in the tables above) or until you delete them, so we can remember your preferences on your next visit.

7. Managing Your Cookie Preferences

You can control cookies in several ways:

• Cookie banner — on your first visit, you can accept or reject non-essential cookie categories; you can change your choice at any time via the "Cookie Preferences" link in the site footer, or using the control below.
• In-product settings — personalisation, memory, and tool preferences described in Section 4.2 can be reviewed, edited, or deleted from your account settings and the Memory Manager, independent of your browser cookie settings.
• Browser controls — most browsers let you block or delete cookies via their settings menu. Blocking strictly necessary cookies (Section 4.1) will likely prevent you from logging in or using core features.
• Third-party opt-outs — for Stripe, Google, Microsoft, or GitHub cookies, refer to that provider's own cookie settings or opt-out tools.

Because Xevyo relies on session cookies for authentication, disabling cookies entirely will prevent the Services from functioning correctly.

8. Your Rights & Regional Disclosures

Depending on where you are located, you may have specific rights regarding cookies and the personal data associated with them:

• European Economic Area / UK — under the ePrivacy Directive and UK/EU GDPR, we ask for your consent to non-essential cookies before they are set, and you may withdraw consent at any time. You also have rights of access, correction, portability, and erasure over related personal data.
• India — under the Digital Personal Data Protection Act, 2023, we process personal data collected via cookies only as necessary and consistent with the notice provided at collection, and we provide region-appropriate consent and grievance-redressal mechanisms.
• Other jurisdictions — where applicable state or national privacy laws (e.g. relating to the "sale" or "sharing" of personal information) grant additional rights, we honour opt-out requests submitted through the mechanisms in Section 7 or via the contact details in Section 11.

Because Xevyo may process health-related information you share with the assistant, we apply additional safeguards described in our Privacy Policy, including redaction of protected health information from logs where applicable and honouring data export and erasure requests for stored memory.

9. Children's Privacy

The Services are not directed to children under the age required by applicable law to consent to data processing on their own behalf, and we do not knowingly set non-essential cookies for such users.