Why our chat widget starts without a banner
The legal basis, the technical implementation and where responsibility sits for a chat widget that writes nothing to the browser until the visitor starts a conversation. An honest account of what we do and do not do.
Last updated Effective
1. The short version
Three facts carry the whole argument. First, before a visitor opens the chat, the widget reads and writes nothing on the device. Second, when the visitor sends a message, one opaque session token is written so the conversation survives a page refresh — the minimum storage for the service they explicitly asked for. Third, the conversation itself is personal data, and the obligations around it are shared between you and us in a defined way.
| Moment | Storage written | Personal data processed | Who is responsible |
|---|---|---|---|
| Page load, bubble visible | None | Presence only: URL, referrer, language (no identifier stored) | TapCub as processor |
| Visitor opens window | None | Same as above | TapCub as processor |
| Visitor sends first message | One session token (sessionStorage) | Message text, consent record, visit context | You as controller, TapCub as processor |
| Visitor opts in to "remember" | Token moves to localStorage, 30 days | Same as above | Visitor consent, logged |
2. ePrivacy Article 5(3) and national storage rules
In the EU and the UK, prior consent is required for storing information on, or gaining access to information already stored in, a user's device. The rule is about terminal storage, not the word "cookie": localStorage, sessionStorage and IndexedDB are treated the same way. "We do not use cookies" is therefore not, by itself, a reason to skip a banner.
The same provision exempts access that is strictly necessary to provide an information-society service explicitly requested by the user. Our implementation sits inside that exemption:
- Page load and bubble: no storage is written or read.
- Visitor opens the window and sends a message: one opaque token is written to sessionStorage so the conversation survives a refresh — the smallest storage that lets the requested service continue.
- The token expires when the tab closes. The optional "remember this conversation for 30 days" is off by default, and turning it on is an explicit act by the visitor that we log.
Germany's TTDSG §25, France's CNIL guidance and the UK PECR follow the same structure. A site that runs only TapCub analytics and chat therefore has no storage that requires a banner. Whether other things on your site need one is a separate question.
3. GDPR and PIPL: conversations are personal data, and we are the processor
No cookies does not mean no personal data. Everything a visitor types is personal data under the GDPR, and personal information under China's Personal Information Protection Law, regardless of how it was transported. The lawful basis for processing it and the duty to inform visitors sit with you, the site operator — the controller under the GDPR, the handler under PIPL. Our duties as processor, or entrusted party, are to process only on your instructions, to limit retention, to provide deletion and export, to keep an audit trail, and to make a data processing agreement and a sub-processor list available.
What we built to support that:
- a notice before the first message that names you and links to your privacy policy, with a versioned consent record stored on the conversation;
- retention per site, with automatic deletion when it expires, and one-click deletion of any conversation;
- export of a visitor's conversations as JSON for data-subject requests;
- a full audit log of agent and administrator actions;
- no raw IP addresses at rest — only coarse country or region, which you can switch off;
- AI processing that sends the current question and matched knowledge-base snippets to the model provider, never the full history and never for training.
4. CIPA and ECPA: a chat tool as an extension of your business
Wiretap claims in the United States, particularly under California's CIPA, target third parties that intercept communications without the user's knowledge and use them for their own purposes. Courts have held that a support tool acting as an extension of the website operator falls under the party exception when it does not use the content for itself.
Our commitments and implementation line up with that reasoning: we never train models on conversation content, never use it for advertising, never link visitors across sites and never resell it. The chat window always shows that the conversation is recorded, with a link to your privacy policy, and the first message writes a consent record you can export as evidence.
5. EU AI Act Article 50: AI must disclose itself
From 2 August 2026, AI systems that interact with people must tell them at first contact that they are interacting with AI. Our AI assistant inserts a system notice before its first reply that cannot be dismissed, every AI message carries a visible "AI" label, and the visitor can ask for a human at any time. Site owners cannot hide these markers. If you write your own automatic replies, keep the disclosure in place.
6. What the visitor sees
Before typing, a visitor sees a short notice: who runs the site, that the conversation is recorded and a link to your privacy policy. While chatting, they see which messages came from a human agent and which from AI, and a button to request a human. If translation is on, they see replies in their own language with a small "translated" marker. Afterwards, they can rate the conversation, leave an email for a follow-up, and — if you enable it — choose to remember the conversation on this device for 30 days.
Visitors never see other visitors, never see your analytics, and never see the context card your agents use. On the hosted chat page at app.tapcub.com/c/{siteKey}, exactly the same rules apply.
7. What your agents see
Agents see the conversation, the visitor's coarse location and device type, the current page, the referrer and the pages viewed during this visit, the detected language, and any email the visitor left. They see a daily visitor hash, not an IP address, and they cannot link a visitor across days unless your site uses identify. Card-number-like patterns are masked in the inbox by default. Agents in the agent-only role see the inbox and nothing else in the console.
8. Retention and deletion
Conversations are kept for the retention period of your chat plan — 30 days on Free, 90 days on Pro, 180 days on VIP 1 and 12 months on VIP 2 — or shorter if you set it per site. When the period ends, messages, attachments, translations, AI drafts and consent records are deleted together. Any agent with the right permission can delete a conversation immediately, and a visitor's request to be forgotten can be fulfilled by deleting their conversations and exporting the rest as JSON. The server-side mapping between session token, daily visitor hash and conversation expires after 24 hours.
9. Translation and AI: what leaves our systems
When two-way translation is on, the text of each message that needs translating is sent to the model provider and the translation comes back; the original and the translation are stored together on the conversation. When AI replies are on, the current question and the knowledge-base snippets that matched it are sent; the provider returns a draft, which is labelled as AI if shown to the visitor or shown to an agent as a suggestion. The full conversation history, the visitor's context and your analytics are not sent. Model providers are contractually prohibited from training on this data, and you can turn either feature off per site at any time.
10. How it works, concretely
Everything here can be verified in the browser's developer tools.
- The presence connection carries no identifier. The launcher opens a WebSocket that reports only the current URL, referrer and language; no cookies, no storage. Identity is a server-side hash of a daily-rotating salt, the site key, the IP address and the user agent — it never exists in the browser.
- Same identity model as analytics. Chat uses the same visitor hash and salt as analytics, so "the same visitor" only holds within a day. We label that honestly instead of working around it.
- The token is opaque. It is server-generated randomness encoding nothing about the visitor.
- No IP at rest. IPs are used in memory for rate limiting and ban keys; the database stores only coarse region.
- The window is an iframe. Host-page scripts cannot read the conversation; the widget cannot read the host page. They exchange open, close and unread-count messages only.
- Delete means delete. Expiry or manual deletion removes messages, attachments and consent records together.
11. Your responsibilities as site operator
- Mention live chat in your privacy policy: what is collected, why, how long it is kept, and that TapCub and an AI model provider act as processors.
- Enter your privacy-policy URL in the widget settings so it appears in the chat window.
- Set a retention period that fits your purpose, and turn geography off if you do not need it.
- Train your agents not to ask for data you do not need, and keep the AI disclosure in place.
- Assess whether your jurisdiction or industry requires additional notices or consent — for example for minors or for health-related sites.
12. What we commit to
- Process conversation data only on your instructions.
- Provide retention controls, deletion, export and an audit log.
- Never train models on conversations, never identify visitors across sites, never sell or share conversation data.
- Notify you before adding a sub-processor and within 72 hours of becoming aware of a breach affecting your data.
- Provide a data processing agreement on request.
13. What to say — and what not to say
Getting a compliance claim wrong is itself a problem. The same wording rules apply when you describe this chat on your own site.
| Safe to say | Do not say |
|---|---|
| No tracking, no profiling, no cross-site identification | "We process no personal data" — conversation content is personal data |
| The widget writes no cookie and shows no banner before a chat starts | "Fully anonymous" — a visitor is linkable within a day |
| No IP addresses stored in clear | "Not subject to GDPR" or "not subject to PIPL" |
| Conversations are never used for training and never resold | "Immune to CIPA lawsuits" |
| Delete anytime in one click; export available | "Zero data retention" — conversations are kept for the retention period |
14. Contact
Questions about this document go to [email protected] or through the contact page. Product behaviour is described on the live chat page; the platform-wide privacy policy applies alongside this page.
Also read