2. What we store, and why
| Key | Type | Purpose | Lifetime |
|---|---|---|---|
| verdant-access-token | Local storage — strictly necessary | Keeps you signed in and authorises API requests. Without it you would have to sign in on every page load. | Until you sign out, the token expires, or you clear site data |
| verdant-active-org | Local storage — strictly necessary | Remembers which organisation you are working in, so the console shows the right data. | Until you sign out or switch organisation |
| activeWabaId | Local storage — functional | Remembers the WhatsApp Business Account you last selected, so pages open on the right account. | Until you change it or clear site data |
| verdant-theme | Local storage — functional | Stores your light or dark appearance preference and applies it before the page renders, avoiding a flash. | Until you change it or clear site data |
| pkce_verifier | Session storage — strictly necessary | A one-time secret that proves the sign-in request came from this browser (OAuth 2.0 PKCE). | Deleted the moment sign-in completes; cleared when the tab closes |
| pkce_state | Session storage — strictly necessary | A one-time random value that protects the sign-in exchange against cross-site request forgery. | Deleted the moment sign-in completes; cleared when the tab closes |
| verdant-cookie-consent | Local storage — strictly necessary | Remembers whether you accepted or rejected analytics cookies, so we do not ask again on every visit. Storing your answer is itself necessary to honour it. | Until you clear site data, or the policy changes materially and we ask again |
Strictly necessary storage cannot be switched off, because the console cannot authenticate you or keep you signed in without it. Functional storage only records a preference; clearing it simply resets that preference to the default.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
| _ga | Google Analytics 4 | Distinguishes one browser from another so repeat visits are not counted as new people. It holds a randomly generated identifier, not your name, email or phone number. | 2 years, or until you withdraw consent or clear site data |
| _ga_<measurement id> | Google Analytics 4 | Keeps the state of the current analytics session — when it started and whether it is still going. | 2 years, or until you withdraw consent or clear site data |
Analytics is off until you say otherwise
No analytics cookie is written, and no Google script is loaded at all, until you accept on the banner. Reject it, or simply ignore it, and nothing is measured. Withdraw consent later under Settings → Analytics and we stop collecting and delete the cookies above from this browser.
3. Third-party technologies
| Provider | When it loads | What it does |
|---|---|---|
| Meta — Facebook JavaScript SDK (connect.facebook.net) | Only on the Connect page, and only when you start WhatsApp Embedded Signup | Renders Meta's own signup window so you can authenticate with Meta and select the WhatsApp Business Account to connect. Meta may set its own cookies during this flow, under Meta's cookie policy. |
| DraskenLabs single sign-on | When you sign in or out | Authenticates you and issues the session token. Sign-in happens on the SSO domain — we never see your password. |
| Google Analytics 4 (googletagmanager.com) | Only after you accept analytics cookies — never before | Measures which parts of the console are used and where they fail, so we know what to fix. It records screens visited, actions taken and errors returned. It never receives message content, recipient phone numbers, contact details, template copy, API keys or access tokens. |
| Firebase Cloud Messaging (Google) | Only if you switch on browser notifications | Delivers push notifications to this browser. It registers a device token with Google; it sets no cookie and is independent of analytics. |
Meta's use of cookies during Embedded Signup is governed by Meta's cookie policy (https://www.facebook.com/policies/cookies) and privacy policy (https://www.facebook.com/privacy/policy). If you never open the Connect page, the Meta SDK is never loaded.
No advertising, no session replay
We embed no advertising networks, no session-replay recorders and no heat-mapping tools. Google Analytics runs in consent mode with advertising signals switched off permanently, so it is not used to build an advertising profile of you, and IP addresses are anonymised.
Google's handling of the data it receives is governed by its own terms and privacy policy. Analytics is the only third-party technology on this page that is optional, and the only one that waits for your consent — the Meta SDK loads only if you start Embedded Signup, and sign-on is required to use the console at all.
4. Managing and clearing storage
- Analytics can be turned on or off at any time under Settings → Analytics. Turning it off stops collection immediately and deletes the analytics cookies from this browser.
- Signing out clears the session token, the active organisation and the sign-in values from your browser.
- Every major browser lets you clear site data or block storage for a site — usually under Settings → Privacy → Cookies and site data.
- Using private or incognito mode discards everything when you close the window.
- Blocking storage for this site will prevent you from signing in: the console has no way to remember an authenticated session without it.
- Clearing storage does not delete anything held on our servers. To delete server-side data, follow the data deletion instructions.
5. Do Not Track and Global Privacy Control
We do not track you across sites, build advertising profiles or sell personal information, so there is no cross-site tracking for a Do Not Track or Global Privacy Control signal to switch off. The one measurement we do carry out — analytics within this console — is off unless you have asked for it, which is the outcome those signals exist to produce.
6. Changes and contact
If we add a new storage key or a new third-party technology, we will update the tables above and the effective date at the top of this page before the change ships.