TRANSPARENCY & TRACKING DISCLOSURE · AUTOBIZ COOKIE POLICY

Cookie Policy & Data Storage Transparency.

Clear, comprehensive disclosure of the essential authentication cookies, preference settings, and privacy-preserving analytics technologies AutoBiz uses to provide secure, resilient business automation across Sri Lanka and worldwide.

Last Updated & Effective Date: September 2026 · Colombo, Sri Lanka

Zero Ad Tracking

We never deploy third-party advertising tracking cookies, retargeting pixels, or broker marketing profiles.

HTTP-Only Auth

Session tokens are strictly secured with HTTP-Only, Secure, and SameSite=Lax flags against XSS vectors.

Granular Consent

Optional analytics and functional telemetry cookies can be toggled on or off at any moment in one click.

Cloudflare Edge Shield

Security clearance tokens strictly manage DDoS mitigation and bot challenge verification state.

CLAUSE 1.0

What Are Cookies & Local Technologies

Cookies are small text files placed on your computer, smartphone, or tablet when you visit websites and web applications. They are widely utilized by web platforms to ensure cryptographic security, maintain authenticated login sessions, remember user interface settings, and understand aggregated platform usage patterns.

In addition to traditional HTTP cookies, AutoBiz utilizes standard browser-native storage technologies such as localStorage and sessionStorage for transient user interface states (such as active navigation filters, theme states, and cookie consent choices).

This Cookie Policy comprehensively explains all tracking and storage technologies utilized across the AutoBiz web platform located at autobiz.lk and its associated subdomains.

CLAUSE 2.0

Strictly Essential Cookies (Auth & Security)

Strictly Essential Cookies are foundational to the operation of the AutoBiz merchant dashboard and web application. These cookies are automatically deployed upon page load or user sign-in. You cannot opt out of essential cookies, as disabling them renders authentication, account isolation, and platform operations technically impossible.

Cookie NameType & SecurityDurationSpecific Purpose
auth-tokenHttpOnly, Secure, SameSite=LaxSession / 7 DaysStores encrypted JSON Web Token (JWT) verifying merchant credentials and tenant authorization. Protected from JavaScript access.
csrf-tokenHttpOnly, Secure, SameSite=StrictSessionCryptographic anti-forgery token preventing Cross-Site Request Forgery (CSRF) attacks during state-changing dashboard requests.
session-idSecure, SameSite=LaxActive SessionMaintains authenticated browser state and multi-tenant routing continuity across dashboard page navigations.
Notice on Browser Blocking: If you configure your browser to block all cookies indiscriminately, you will be unable to log in to the AutoBiz portal, configure AI assistants, or access merchant order workflows.
CLAUSE 3.0

Preference & Customization Cookies

Preference cookies and local storage tokens remember your personalized dashboard settings and UI configurations. While they are not strictly required for core database security, disabling them means your aesthetic choices will reset on every page refresh.

Key / CookieStorage ModeDurationPurpose
theme-preferenceCookie / localStorage1 YearSaves your visual theme selection (Emerald Dark Mode vs. Crisp Light Mode) to prevent page flashing during SSR hydration.
ui-statelocalStoragePersistentRemembers sidebar expansion states, table column visibility, date-range picker defaults, and storefront management filters.
autobiz_cookie_consentlocalStorage1 YearStores your granular opt-in/opt-out cookie choices so the consent banner does not re-prompt you on every visit.
CLAUSE 4.0

Analytics & Search Tools (Zero PII Guarantee)

AutoBiz utilizes diagnostic analytics and search indexing tools to understand public website traffic patterns, detect broken links, evaluate latency, and improve platform performance. We enforce a strict Zero Personally Identifiable Information (PII) policy across all analytics integrations.

Google Analytics 4 (GA4)

Used exclusively on public marketing pages to count visitor aggregates, popular feature tutorials, and page rendering performance. We configure GA4 with strict IP anonymization. GA4 cookies (e.g. _ga, _ga_*) store pseudonymized random client IDs. No names, phone numbers, email addresses, order amounts, or WhatsApp conversation logs are ever transmitted to or stored in Google Analytics cookies.

Google Search Console

Google Search Console operates server-to-server and via search engine crawler bot indexing. It does not place client-side cookies on your device and does not monitor private merchant accounts or customer messages.

Microsoft Bing Webmaster Tools

Used strictly to verify search crawl indexing health, sitemap XML availability, and public metadata compliance. Operates without placing intrusive third-party retargeting cookies on end-user devices.

Opt-Out Availability: You can enable or disable Google Analytics tracking cookies at any time via our Cookie Consent Banner without affecting your ability to use AutoBiz.
CLAUSE 5.0

Meta Cloud APIs & Server-to-Server Data

AutoBiz integrates directly with Meta Platforms, Inc. (WhatsApp Cloud API, Messenger Platform, and Instagram Graph API). It is critical to understand the architectural boundary between our web platform and Meta:

  • Zero Meta Tracking Pixels on autobiz.lk: AutoBiz does not embed Meta advertising tracking pixels or retargeting cookies on our marketing website or dashboard.
  • OAuth Tokens Stored Server-Side: When a merchant connects their WhatsApp Business Account or Instagram handle via Meta Embedded Signup, the resulting OAuth access tokens are transmitted directly over TLS 1.3 to our backend and stored in our encrypted AWS database with AES-256-GCM encryption. Tokens are never written to browser cookies.
  • Server-to-Server Webhook Routing: End-customer WhatsApp, Messenger, and Instagram messages are transmitted via secure HTTPS webhooks directly to our cloud infrastructure. Conversations are never routed through or stored in your browser cookies.
CLAUSE 6.0

Server-Side AI & Redis Cache Isolation

All conversational artificial intelligence processing occurs exclusively on hardened backend microservices and secure enterprise LLM infrastructure. Browser cookies are never used for AI inference or conversational state storage. Specifically:

Zero Cookie Prompts

Customer messages, AI prompt embeddings, and catalog knowledge bases reside in encrypted databases, never client cookies.

Redis Deduplication

WhatsApp message IDs are deduplicated in an in-memory Redis cluster with a 5-minute TTL to prevent duplicate AI replies.

Opt-Out Flags

Customer STOP / human takeover flags are maintained in Redis and PostgreSQL tables, completely independent of browser cookies.

CLAUSE 8.0

How to Manage Cookies in Your Browser

Every modern web browser gives you complete control over whether cookies can be stored, inspected, or deleted. You can clear existing cookies or block third-party trackers directly within your browser settings:

Google Chrome

Settings → Privacy & Security → Third-party cookies → See all site data and permissions.

Mozilla Firefox

Settings → Privacy & Security → Enhanced Tracking Protection / Cookies and Site Data.

Apple Safari (macOS & iOS)

Preferences / Settings → Privacy → Manage Website Data → Prevent cross-site tracking.

Microsoft Edge

Settings → Cookies and site permissions → Manage and delete cookies and site data.

Note: If you clear your browser cookies, your stored theme preferences and cookie consent choice will be reset, requiring re-selection on your next visit.

CLAUSE 9.0

Separate Customer Messaging Opt-Out (STOP)

If you are an end-consumer communicating with a business via WhatsApp, Instagram, or Facebook Messenger powered by AutoBiz, your messaging privacy rights are entirely distinct from website browser cookies.

Customer chat data is transmitted through Meta Cloud APIs and processed server-side. To revoke consent and permanently stop receiving automated promotional messages from any business using AutoBiz:

Instant Automated Opt-Out Methods:

  • Reply STOP, UNSUBSCRIBE, or NAVATHTHANNA directly inside the WhatsApp or Messenger conversation.
  • The AutoBiz conversation engine immediately registers an immutable opt-out flag in Redis and PostgreSQL, halting further marketing broadcasts.
  • Email support@autobiz.lk with the subject "Opt-Out Request" quoting your phone number.

For exhaustive details on personal data deletion, refer to our Privacy Policy (Section 8).

CLAUSE 10.0

Updates, Data Protection & Legal Contact

AutoBiz reserves the right to revise this Cookie Policy periodically to reflect technological updates, changes in statutory privacy legislation (such as Sri Lanka PDPA or European GDPR regulations), or the release of new platform features. Material modifications will be posted with an updated "Last Updated" timestamp at the top of this document.

Data Protection Officer & Compliance Inquiries

AutoBiz Platform

Online Compliance Desk

100% Digital Cloud SaaS

Sri Lanka (GMT+5:30)

Privacy Desk: privacy@autobiz.lk

Support Helpdesk: support@autobiz.lk

WhatsApp Desk: +94 72 999 5959