Cookie Policy

NebulaHex Pvt Ltd (“NebulaHex,” “we,” or “us”) uses a deliberately minimal set of cookies and browser storage mechanisms to operate the Service. This Cookie Policy explains what we use, why we use it, and what we do not use.

This Policy supplements our Privacy Policy, which describes how we handle personal data more broadly. Defined terms not specified here have the meanings given in the Privacy Policy.

For the purposes of this Policy, “cookies” refers to small text files placed on your device by a website. “Browser storage” refers to related technologies including localStorage, sessionStorage, and IndexedDB. We use the terms collectively unless a distinction matters.

We use cookies and browser storage in two strictly-necessary categories required to deliver the Service, plus one optional analytics category that loads only if you consent. The strictly-necessary categories are:

• Authentication: session cookies set by our authentication provider so you stay signed in to the dashboard.
• Widget continuity: browser local storage and session storage used by the embeddable chat widget, mainly to keep a conversation going from one page and one visit to the next. Section 04 lists each item and how long it stays.

Both categories are essential to operating the Service. Disabling them will prevent the affected functionality from working — you will not be able to sign in, and chat widgets embedded on customer sites will start a new conversation on every page load.

In addition, with your consent we use Google Analytics 4 to understand how visitors use our marketing site. These analytics cookies (named _ga and _ga_*) are optional, are set only after you accept analytics in our cookie banner, and can be withdrawn at any time. They are not set if you decline or if your browser sends a Global Privacy Control signal.

Strictly necessary cookies are exempt from prior-consent requirements under the EU ePrivacy Directive and equivalent regulations in other jurisdictions. Our optional analytics cookies are not exempt and are therefore loaded only after you grant consent.

We use Clerk as our authentication and session-management provider. Clerk sets a small number of first-party cookies on the clerk.nebulahex.com subdomain to manage your authenticated session.

These cookies allow us to:

• Recognize you as a signed-in user across requests, so you do not have to re-authenticate on every page load.
• Maintain session integrity and detect anomalous behavior consistent with session hijacking.
• Enforce sign-out across all open tabs when you sign out from any one of them.

The specific cookie names are managed by Clerk and may change as Clerk updates its SDK; we do not document individual cookie names because they are implementation details we do not control. For details, see Clerk’s own documentation.

Authentication cookies are set only when you sign in. They are scoped to clerk.nebulahex.com and are not shared with other domains. They are cleared automatically when you sign out, and they expire on their own when their lifetime ends.

The NebulaHex chat widget is the chat window our customers add to their own websites. It sets no cookies and does not use IndexedDB. It keeps the items below in your browser’s storage, most of them in local storage, so that a conversation can carry on from one page to the next and from one visit to the next. Each name ends with the ID of the AI agent the widget belongs to, so every agent on a site keeps its own.

• Session key: nhx_skey_<agent ID>, in local storage. A random key that ties your messages to one conversation. The widget sends it with each message, and NebulaHex works out the conversation from it, so the conversation can be reached only from a browser that holds the key. It has no expiry date: it stays until you use “Clear chat” or “Not you,” which replace it with a new one, or until you clear your browser’s site data.
• Session ID: nhx_sid_<agent ID>, in local storage, only if a conversation was started with an earlier version of the widget. A random ID that version used in place of the key. The widget keeps using it for that conversation, and deletes it, keeping a session key instead, the first time it runs after thirty days without a new message in that conversation, or when you use “Clear chat” or “Not you.”
• Conversation history: nhx_msgs_<agent ID> and nhx_msgs_ts_<agent ID>, in local storage. Up to the last 100 messages of your conversation, and the time they were last saved. They stay for up to thirty days after the last message in your conversation. On your first visit after that, the widget deletes them.
• Verified email: nhx_cred_<agent ID> and nhx_cred_addr_<agent ID>, in local storage, only after you verify your email address in the widget. A verification token that shows NebulaHex you verified the address, and the address itself, so the widget can show which address is verified. The token works for up to sixty days from the verification, and using it does not extend that. The next time the widget finds that the token has stopped working, it deletes the token and the address.
• Theme: nhx_theme_<agent ID>, in local storage, only if you switch the widget between light and dark. It remembers your choice until you clear your browser’s site data; “Clear chat” and “Not you” keep it.
• Dismissed message: nhx_preview_dismissed_<agent ID>, in session storage, only if you close the short message shown beside the chat button. It stops that message from showing again in the same tab, and your browser deletes it when you close the tab.

The widget writes the session key as soon as a page with the widget loads, before you open the chat, and the conversation too when the agent has a welcome message. It can delete an item only while it is running, so an item past the times above stays in your browser until your next visit to a page with the widget.

By default the widget runs inside its own frame, a small window served by NebulaHex inside the website’s page. The items in local storage then belong to that frame, and the website cannot read them. The dismissed message is the exception: the chat button and the message beside it sit on the website’s own page, so that item is in the website’s session storage.

A website can turn the frame off. The widget then runs in the website’s own page and keeps its items in the website’s own storage, where the website’s scripts can read them. Without the frame the widget does not offer email verification, so it keeps no verification token or email address there.

You can remove these items yourself. “Clear chat,” in the widget’s menu, deletes the conversation and its session key or session ID and starts a new conversation with a new session key; it keeps the verification token and the email address. “Not you,” shown beside a verified email address, deletes the verification token, the email address, the conversation and its session key or session ID, and starts a new conversation with a new session key. Clearing your browser’s cookies and site data removes all of them.

When an agent is tried out in NebulaHex’s own preview, the widget keeps the session key, any session ID and the conversation under separate names, with preview_ added before the agent ID, so a preview never mixes with a real conversation on the same device.

The chat widget is served from NebulaHex’s own servers, and so is everything it needs to run: its code, including the Markdown renderer and the HTML sanitizer it uses to display replies safely, and its fonts. It loads nothing from a public CDN.

A business can choose one of six fonts for its widget: Inter, Roboto, Open Sans, Lato, Montserrat or Poppins. Each is served from NebulaHex’s own servers, beside the widget. The widget makes no request to Google Fonts or to any other font service, so loading a page with the widget does not send your IP address to one.

What the widget does load from elsewhere is an image the business adds: the agent’s avatar and the business’s logo. Your browser loads each one from wherever it is kept, as soon as a page with the widget loads and before you open the chat. An image the business uploads is kept by Supabase, our storage provider, and loaded from Supabase’s servers; an image the business adds by its web address is loaded from that address, which can be any website. The site an image comes from, and any network between you and it, can see that the request was made, including your IP address and your browser’s user agent.

The NebulaHex dashboard, and the pages that go with it for invitations, billing confirmation and agent previews, load the Material Symbols icon font from Google Fonts ( fonts.googleapis.com and fonts.gstatic.com). This transfers your IP address to Google solely to deliver the font files; no cookies are set and no analytics are collected through these font requests. The marketing site and the chat widget do not load it.

We have made deliberate choices about what we do not put on your device. As of the date of this Policy, the NebulaHex marketing site, dashboard, and chat widgets do not use any of the following without your explicit consent:

• Advertising or retargeting cookies (no Meta Pixel, no Google Ads remarketing tag, no LinkedIn Insight Tag, no TikTok Pixel, no equivalent).
• Analytics cookies that load without your consent (our Google Analytics 4 is optional and loads only after you accept; we use no Mixpanel, Amplitude, Hotjar, or Segment-mediated equivalents).
• Cross-site tracking cookies of any kind.
• Browser fingerprinting techniques used to identify visitors across sites.
• Social-network share-button cookies that pre-load tracking before you click a share button.
• Session-replay or behavior-recording tools.

We do not sell or share personal information collected through cookies or browser storage with third parties for their own marketing or advertising purposes.

We use a cookie consent banner so you can grant or refuse optional analytics cookies. Strictly-necessary cookies are always active because the Service cannot function without them; analytics cookies load only after you accept.

• Our Cookie Policy and Privacy Policy describe every category we use, including the optional analytics category.
• A consent banner lets visitors grant or refuse non-essential cookies. Analytics cookies are not set before consent in the European Economic Area, the United Kingdom, and other jurisdictions that require prior consent.
• You can revisit and change your consent preferences at any time through the banner.
• We honor Global Privacy Control and "Do Not Sell or Share My Personal Information" signals where applicable under California and other state privacy laws — when detected, optional cookies default to off.

Sections 02 through 05 describe every cookie and browser-storage item NebulaHex uses, including the optional analytics cookies set only with your consent.

Most modern browsers allow you to view, manage, and delete cookies through their preferences or settings interface. You can also configure your browser to block cookies from specific sites or to clear all cookies when the browser closes.

The strictly-necessary cookies and storage described in this Policy are required to operate the Service, so blocking or deleting them will affect functionality. Optional analytics cookies can be refused at any time through our consent banner without affecting how the Service works. In particular:

• Blocking authentication cookies will prevent you from signing in to the NebulaHex dashboard.
• Blocking local storage will make the chat widget start a new conversation every time a page with the widget loads.

For general guidance on managing cookies across browsers, independent resources such as allaboutcookies.org publish current per-browser instructions.

We may update this Cookie Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice through the dashboard or by email.

We encourage you to review this Policy periodically to stay informed about how we use cookies and browser storage.

If you have any questions about this Cookie Policy or our use of cookies and browser storage, please contact us at:

support@nebulahex.com