Velqia
Cookies and scripts
Version: 31 October 2026
This page lists the cookies, local storage and third-party scripts used by the Velqia website, based on the current code.
§ 25 of the German TDDDG requires your consent to store information on your device or access it, unless this is strictly necessary for a service you requested (§ 25(2) no. 2). Afterwards, data processing is governed by the GDPR (Art. 6(1)(a) for consent-based processing).
Cookies and local storage
| Name | Type | Purpose | Duration | Consent required? |
|---|---|---|---|---|
| velqia_lang | First-party cookie | Remembers the chosen language. | 1 year | No: strictly necessary (§ 25(2) TDDDG) |
| sb-…-auth-token | First-party cookie | Keeps you signed in to the dashboard. Only set if you sign in. | The name includes the Supabase project reference (sb-<reference>-auth-token, sometimes split into .0, .1…). Duration: 400 days, the default of the Supabase library Velqia uses | No: strictly necessary (§ 25(2) TDDDG) |
| velqia_analytics_consent | Local storage | Stores your decision on analytics, performance and errors. | Until you delete it or click “Cookie settings” | No: strictly necessary (§ 25(2) TDDDG) |
| velqia_marketing_consent | Local storage | Stores your decision on advertising (Meta Pixel). | Until you delete it or click “Cookie settings” | No: strictly necessary (§ 25(2) TDDDG) |
| velqia_meta_sdk_consent | Local storage | Stores that you accepted loading the Meta script in the dashboard to connect WhatsApp. Only when signed in. | Until you delete it or click “Cookie settings” | No: strictly necessary (§ 25(2) TDDDG) |
| vq_visitor_id, vq_msgs, velqia_widget_session_id | Session storage | Anonymous visit identifier and messages, to keep the conversation with the Velqia assistant while the tab is open. | Until the tab is closed | No: strictly necessary (§ 25(2) TDDDG) |
| vlq-dashboard-theme, vlq-recent-emojis, velqia_pwa_banner_dismissed, … | Local storage | Remember settings you choose in the dashboard (theme, recent emojis, dismissed install notice, page size of a list). Only when signed in. | Until deleted manually | No: strictly necessary (§ 25(2) TDDDG) |
| velqia_social_nonce, velqia_social_pending | First-party cookie | Protect the connection of the Facebook or Instagram account when connecting social networks in the dashboard (httpOnly cookies, only when signed in). | 15 minutes | No: strictly necessary (§ 25(2) TDDDG) |
| Service worker (PWA) | Browser cache | Stores website files (images, styles, scripts, fonts) so the site loads faster and can be installed as an app. It does not store personal data. | Between 1 day and 1 year depending on the file type | No: strictly necessary (§ 25(2) TDDDG) |
Third-party scripts and measurements
| Name | Type | Purpose | Duration | Consent required? |
|---|---|---|---|---|
| Google Analytics 4 (googletagmanager.com) — _ga, _ga_<ID> | Third-party script and cookies | Measure the use of the Velqia website and improve the service. | Two years by default according to Google’s documentation (_ga distinguishes users; _ga_<ID> persists session state) | Yes. Only loaded if you click “Accept analytics” (Art. 6(1)(a) GDPR and § 25(1) TDDDG) |
| Vercel Speed Insights | Hosting provider script | Measure website performance (load times). | Vercel states the data is anonymous and does not allow a user to be identified or a session reconstructed; it does not state whether it sets cookies. In a check with an automated browser (25 October 2026), after accepting the banner no Vercel cookie or storage appeared. | Yes. Only loaded if you click “Accept” in the banner (Art. 6(1)(a) GDPR and § 25(1) TDDDG) |
| Sentry (/monitoring) | Error service, through our own domain | Detect and diagnose application errors. | Sets no cookies in our configuration. In a check with an automated browser (25 October 2026), after accepting the banner only requests to /monitoring were observed and no Sentry cookie | Browser: yes, only loaded if you click “Accept” in the banner (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Server: does not access your device and always logs errors (Art. 6(1)(f) GDPR) |
| Meta Pixel (connect.facebook.net) — _fbp, _fbc | Third-party script and cookies | Measure whether our Facebook and Instagram ads work (visits, contacts, sign-ups and trial starts). Meta receives your IP address, browser data, the page visited and those actions. Loaded only on public pages and only when enabled in our configuration. | Cookies _fbp and _fbc: up to 90 days according to Meta’s documentation. When you withdraw consent we delete them from our domain | Yes. Only loaded if you accept the “Advertising” purpose in the banner (Art. 6(1)(a) GDPR and § 25(1) TDDDG) |
| Meta / Facebook JavaScript SDK (connect.facebook.net) | Third-party script | Connect the customer’s WhatsApp Business (embedded signup). Loaded only in the dashboard of signed-in customers who can connect WhatsApp, and only after you accept it; not loaded on public pages. | Meta may set its own cookies or storage when the script loads; these are governed by Meta’s cookie policy. It is only loaded after you consent. | Yes. Only loaded if you click “Load Meta script” before connecting WhatsApp (Art. 6(1)(a) GDPR and § 25(1) TDDDG) |
Notes
- Advertising (the Meta Pixel) only loads if you accept it in the banner. If you do not, there are no advertising pixels or marketing cookies.
- Payments are completed on Stripe’s page (checkout.stripe.com), which sets its own cookies on its domain; they are not Velqia cookies.
- Assistant installed on a customer’s website: the assistant only uses browser session storage (vq_visitor_id, vq_msgs, velqia_widget_session_id), which is deleted when the tab is closed, and does not set cookies. It is necessary to keep the conversation going (§ 25(2) no. 2 TDDDG). The other cookies and scripts on that website are managed by its owner, who is responsible for informing about them.
You can change your decision on analytics, performance and errors (and on the Meta script in the dashboard) at any time with the “Cookie settings” button in the footer.