COOKIE & TOKEN POLICY

Last Updated: July 2026

1. SaaS Architecture & Scope

This Cookie & Token Policy governs the local browser sessions, authentication tokens, and state persistence configurations used within the Jepely SaaS platform. We utilize secure HTTP cookies, server-side session identifiers, and API authorization tokens to maintain secure operator logins, validate Google Workspace integration handshakes, store temporary BI dataset states, and deliver interactive AI dashboard builders safely.

2. Technical Classifications of Cookies & Storage Tokens

To run our web dashboard and automated CRM processing securely, Jepely utilizes the following storage categories:

Essential Session Cookies

Mandatory for core application runtime (e.g., PHP native PHPSESSID). These cookies maintain your active account login, isolate multi-tenant user contexts via Auth::check(), protect against Cross-Site Request Forgery (CSRF), and prevent unauthorized access to administrative endpoints.

OAuth Access & Refresh Tokens

Used specifically when linking external Workspace and CRM services (such as Google Sheets, Google Drive, or Meta platforms). Instead of storing raw passwords, encrypted access and refresh tokens are stored to perform authorized background synchronization actions on your behalf.

Dataset State & Workspace Context

When utilizing the AI Business Intelligence engine or external dataset uploads, temporary session states preserve operational parameters (e.g., selected active sheets, source data context, and file upload identifiers) to prevent state loss during step-by-step dashboard generation.

Security & Anti-Abuse Tracking

Cookies and request header tokens help monitor session validity, track rapid request velocity, protect API dispatchers against brute-force attacks, and maintain isolated tenant environments.

3. OAuth Credentials & Third-Party Integration Management

When connecting your account via Google OAuth or Meta Authentication to manage Google Sheets, Drive files, or social messaging endpoints:

Google Workspace API: Access and refresh tokens are handled securely to read, modify, duplicate, or generate dashboard sheets within your Google Drive/Sheets scope.
Data Protection Guarantee: Authorization tokens are restricted strictly to functional operations executed by the operator and are never shared or sold to external third parties.

4. Integrated API Providers

Our SaaS application securely interacts with accredited third-party API infrastructures to power automation workflows:

Google Cloud & Google Drive APIs: For live spreadsheet matrix manipulation, structural sheet creation, and direct report exports (PDF/XLSX/CSV).
Meta Platforms, Inc.: For authenticating Meta assets and managing Webhook interactions.
AI Analytics Infrastructure: For parsing dataset metadata profiles and rendering structured standalone BI dashboards.

5. Token Lifespans & Storage Duration

Data structures maintained across the platform adhere to two main lifecycles:

Session Cookies & Temporary Storage: Expire immediately upon closing your browser session or logging out of the dashboard.
Persistent API Refresh Tokens: Encrypted tokens remain active until the user revokes the connection via the workspace settings or directly through their Google Account Permissions.

6. User Control & Session Management

You may clear or block cookies via your browser's security settings. However, disabling essential session cookies will prevent you from authenticating into the Jepely dashboard, as active cryptographic tokens are required to secure user sessions and prevent unauthorized access.

7. Policy Updates

Jepely may update this policy periodically to align with browser security updates, regulatory changes, or enhancements to our API capabilities.

8. Contact & Compliance Desk

For questions regarding our session security, cookie management, or OAuth data protection, contact our infrastructure team:

Jepely Support & Architecture Desk
Email: [email protected]
Web: https://jepely.com