What the website chat sends and stores
For business owners who put the chat on their website and want to describe it in their privacy policy. Written in plain words; nothing is left out.
Before a visitor writes
- The page loads one small script. It sets no cookies and stores nothing in the browser.
- It makes one request for the chat's settings (colour, position, whether someone is available). That request carries only the website's chat key.
- No tracking, no fingerprinting, no third-party scripts, and no identity shared across websites.
- If the website asks for cookie consent first, the chat stays hidden until the site's consent banner allows functional cookies (it reads Cookiebot, OneTrust, CookieYes and Complianz by itself).
- If the website shows a greeting next to the chat button, the chat remembers for the day that it greeted, in the browser's storage (
csupport-greeted, the date only), and only once the visitor has agreed to cookies. Without that agreement it stores nothing and may greet again on the next page.
When a visitor writes
| Request | When | What it carries |
|---|---|---|
| GET /api/widget/config | Page load | The chat key |
| POST /api/widget/messages | Each message sent | The message, the page address and referring page, the browser's language, and the conversation's session token |
| GET /api/widget/messages | While the chat is open | The session token, to fetch replies |
| WebSocket /socket.io/ | While the chat is open, after the first message | The chat key and session token, to hear about replies at once. Sends only that the visitor is typing, never what they type |
| POST /api/widget/actions | When the visitor chooses an option | Their choice, and the email address or phone number if they give one for the reply |
What is stored
- In the visitor's browser: one random session token in local storage, written only after the first message, so the conversation is still there if they come back. Nothing else.
- On our servers: the conversation (messages, the page it started on, the referring page, the language), any name, email or phone number the visitor chose to give, and the first three parts of their IP address (for example 203.0.113.x), used only to stop spam and cleared after 7 days.
- How long: 90 days after the last message on the Free plan, or as long as the business chooses on a paid plan. The business can delete conversations or the whole account at any time.
Automated replies
When nobody on the team is free, an AI assistant may answer. It always says it is an AI. The conversation is sent to the AI provider only to write that reply, with retention and training switched off.
Email replies
If a visitor asks for the reply by email, the business's replies are emailed to them, and their email answers are added to the same conversation.
Text replies
If a visitor asks for the reply by text (US and Canadian mobile numbers), they get one text confirming it, with how to opt out, and then the business's replies. Their texts back are added to the same conversation. Texting STOP ends all texts from that number at once. No texts go out between 9 pm and 8 am in the visitor's time zone unless they have just written. The texts go through our carrier, Telnyx, only to be delivered.
Services that handle the data for us
Each one only for the job named here.
| Service | What for |
|---|---|
| Our servers, at our hosting provider | Running the chat and storing conversations. |
| Clerk | Signing in the business's team (never visitors). |
| OpenRouter, with the model providers it routes to | The AI assistant's answers, when the business uses it. Sent with zero retention required: not stored, not used for training. |
| Our email provider (MXroute) | Sending emails to visitors who asked for the reply by email, and receiving their answers. |
| Apple (APNs) and Google (Firebase Cloud Messaging) | Ringing the team's phones. Only a short notification: the business name and the first words of a message. |
| Telnyx | Text messages, for visitors who asked for the reply by text, and text alerts to the business. |
| Stripe | The business's own payments for its plan (never visitors). |