Privacy and consent

You are the controller for your visitors; reactive.chat processes on your behalf. You will find the settings for this under /app/projects/{id} in the Privacy tab, section Data protection and consent.

This page describes what you can set. It is not legal advice.

Consent

• Consent – three levels:
• off (default) – no barrier.
• notice – one line with a link to your privacy policy above the input field. The chat runs right away.
• required – the input field stays locked until the visitor agrees. Only then does a conversation start. The consent is recorded with wording, time and language.
• Sentence the visitor agrees to – per language (German, English, Polish), 300 characters at most. Empty means: our translated sentence. The wording travels into the record.
• Your privacy notice – per language an address with https://, 255 characters at most. Empty means: no link.

With required, the following also applies: the widget only reads the text of your page after the visitor agrees, and before that no page or user details go to the server. The barrier also stands in front of the “Leave a message” form. The widget remembers the consent for a year.

If you require consent and have switched on the pre-chat form, consent comes first, then the form.

What visitors can do themselves

The widget has the “Your data” data card. Depending on your settings, it contains:

• Offer withdrawal in the widget – on by default. A button the visitor uses to withdraw their consent. Withdrawal closes their conversations, clears the session and leaves a record. The button only appears if consent has been given.
• Offer the delete button in the widget – on by default. The Delete everything button. Off only makes the button disappear: a visitor who asks for deletion in words in the chat still gets it (see below).

What deletion and withdrawal do

• hard (default) – the conversations disappear.
• anonymous – the wording goes, the row stays without personal reference for your reports.

The consent record is kept in both cases, without personal reference.

When the visitor types the deletion into the chat

If a visitor writes something like “Please delete my data”, the server detects this using fixed patterns, not the AI. The patterns are narrow: “forget what I said” triggers nothing.

• off – the sentence carries on like any other message.
• ask first (default) – a notice and one question. Deletion only follows the click.
• delete at once – notice and deletion, no question asked.

The notice always states that reactive.chat is a separate service and that data on your website has to be requested through your privacy policy.

Retention

• Your own retention period (days) – 0 to 3650. 0 (default) means: no period of your own, then the limit of your plan applies. Older conversations are handled daily in the way chosen (hard or anonymous).

Minimum requirements

reactive.chat can set minimum values for all projects, for example a minimum consent level, a delete button that cannot be switched off, or a maximum period. The affected fields are then locked, and your account tells you when you save.

Fixed answer to the storage question

If a visitor asks whether the chat is stored, reactive.chat answers with a fixed text. It contains the link to your privacy policy. If deletion via the chat is set to off, the note on how the visitor can have their data deleted is missing.

Storing in the browser and your cookie banner

Independently of consent to the chat, the widget asks whether it may store something permanently in the browser, for example to recognise a returning visitor. Without this permission it only stores for the lifetime of the tab.

With the default auto, the widget reads the permission itself:

1. from a cookie banner following the IAB TCF standard (version 2). What counts is purpose 1, “Store and/or access information on a device”. If the visitor changes their choice, the widget follows immediately.
2. otherwise from a consented.eu banner, if there is one.
3. otherwise: no permission.

If your banner uses none of these, you set the permission yourself on the snippet as soon as your banner has received consent:

<script src="https://cdn.reactive.chat/loader.js"
        data-rc-site-key="SITE_KEY"
        data-rc-consent="granted"
        async></script>

Values: auto (default), granted or denied. If your banner only loads the widget after consent, granted is the right value. There is no separate command for switching later at runtime; use ReactiveChat('boot', { consent: 'granted' }) at start-up for that. More on this in Technical integration.

Privacy text for your page

You can embed the section about reactive.chat in your privacy policy automatically. It follows exactly these settings and is up to date after ten minutes at most:

<div data-rc-privacy data-lang="de" data-heading="2"></div>

Everything about this is in Embed the privacy text automatically. A text block to copy is available in Text block for your privacy policy.

Further privacy points elsewhere

• Blocked areas and excluding areas of a page (data-rc-private): Knowledge and sources
• Personal data in messages is hidden when sending: Availability, forms and service
• Memory across conversations: AI assistant
• Agents in reports (with names, pseudonymised or not individually at all) and audit log retention: under /app/security, see Team, console and notifications