Privacy integration: consent, storage and privacy text

This page describes the technology. Whether and for what you need consent is for you to assess; you will find wording in the Text block for your privacy policy. This text is not legal advice.

Where the widget gets the consent state from

At start-up, the loader checks – read-only, in this order:

1. data-rc-consent on the loader tag (or consent in ReactiveChatSettings/boot): granted or denied fix the state; the consent platform is then not asked.
2. IAB TCF v2 via window.__tcfapi('getTCData'): consent to purpose 1 (storing and accessing information on a device) counts as granted; so does a platform reporting gdprApplies: false.
3. consented.eu via window.Consented.getState().
4. Otherwise unknown – treated like denied.

After loading, the widget subscribes to the changes of your TCF platform (tcloaded, useractioncomplete) and reacts immediately, without a reload.

If you use a platform without TCF, you control the state through the attribute. Typically: insert the loader only after consent has been given.

// Example: load the loader after consent
function chatLaden(zugestimmt) {
  var s = document.createElement('script');
  s.src = 'https://cdn.reactive.chat/loader.js';
  s.async = true;
  s.setAttribute('data-rc-site-key', 'SITE_KEY');
  s.setAttribute('data-rc-consent', zugestimmt ? 'granted' : 'denied');
  document.head.appendChild(s);
}

There is no API command for setting consent; a withdrawal through your TCF platform takes effect immediately, otherwise from the next page view.

What happens with and without consent

Without consent (denied or unknown):

• The chat works; IDs are kept only in sessionStorage and disappear with the tab.
• No third-party IDs are read (such as those of a MousePlayer session).
• No page context (ctx), no page text, no navigation reports.
• If the project's chat asks for consent before the first message, it asks the visitor itself; their answer goes to the server as consent.

With consent (granted):

• Visitor and session ID as well as the offline buffer are kept in localStorage; the conversation is preserved across tabs and visits.
• Page context and – except on sensitive pages – page text go to the server (SPA).

If the state changes, the widget moves its entries (rc_*) between localStorage and sessionStorage and reports the change to the server. The widget sets no cookies.

The visitor's data in the widget

In the widget, the visitor can request the conversation by email, withdraw their consent and have their data deleted. How deletion requests and retention periods are set in your account is described in the Manual.

Excluding areas from the page text

The assistant reads the visible text of the current page in order to answer questions about it. Never read are form fields, invisible elements, the widget itself and pages with paths such as account, checkout, cart, orders or invoices. You exclude further areas like this:

<section data-rc-private>
  Customer number: 4711 · Contract details …
</section>

data-rc-ignore has the same effect. To switch it off completely: data-rc-dom-spiegel="false" on the loader tag (then there is no “Show me” either).

Inserting the privacy text automatically

An element in your privacy policy shows the section about reactive.chat – matching your project settings (consent before the first message, deletion periods, the AI assistant and its name, Smart Answer) and in the language of the page. Changes appear on your page after ten minutes at most. The short version is under Insert the privacy text automatically.

<div data-rc-privacy data-lang="en" data-heading="2" data-email="privacy@your-company.com">
  You will find information about the chat in section 7.
</div>

• data-rc-privacy (required) – marks the element.
• data-lang (optional) – de, en or pl; if not given, <html lang>, otherwise English.
• data-heading (optional) – heading level 2 to 6, default 3.
• data-email (optional) – contact address, linked in the matching sentences.
• data-rc-privacy-state (set by the widget) – loading, done or error.

Whatever is in the element stays there until the text has loaded – and if it cannot be loaded. The text is built only from text nodes (no colours or fonts of its own) and takes on the styling of your page.

Technology: the loader loads a small module for this, even without consent. It fetches the text via GET from the chat address – without cookies, without a referrer, without a visitor ID – and stores nothing in the browser. The text only appears on your project's domains. The module detects elements inserted later (SPA) by itself.

If your consent platform blocks the loader on the privacy page, embed the module directly:

<script src="https://cdn.reactive.chat/datenschutz.js" data-rc-site-key="SITE_KEY" async></script>

With your own domain, additionally data-rc-ws-url="wss://chat.your-company.com/rc_wss/" and src from your subdomain.

Next: Limits and quotas