Cookie Policy

A cookie is a small text file your browser stores on your device and sends back with every request to the site that set it. Sites use cookies to remember you from one page to the next: that you are signed in, which language you chose, which workspace you have open.

Local storage (localStorage) is different: it is a space in the browser that page code can read from and write to, but it is never sent automatically with requests. We use it in exactly one place — the chat widget on your storefront — and we explain why below.

First party versus third party: a first-party cookie is set by the site you are visiting. A third-party cookie is set by a different domain (an ad network, for example) so it can follow you across sites. Every cookie we set is first party, and we use no third-party cookies for cross-site tracking.

Capi Agent shows up in three different places, and each one has its own rules on this page:

1. The public marketing website (the pages you are reading now): one cookie for your language preference, plus optional analytics if they are enabled in the deployment.
2. The dashboard app (/dashboard): strictly necessary cookies only, for sign-in, security, your workspace, and your theme. There are never analytics or ads inside the dashboard.
3. The chat widget on your storefront: we set no cookies on your store's domain at all. We use local storage only so the conversation survives between pages.

The following sections cover each surface in detail. Cookies set by your store platform itself (Salla, Zid, Shopify, and the others) are not ours and are governed by their policies.

These are the cookies without which the service does not work. They need no consent because they carry out something you asked for yourself — signing in, picking a store, picking a language. None of them tracks you outside our site.

We do not state lifetimes in days for these cookies on this page because they follow the library's settings; the rule is: security cookies live for the session, preference cookies live until you change the preference or clear them.

On the public website (home, pricing, blog, these pages) we use Google Analytics 4, Google Tag Manager and Microsoft Clarity to understand which pages get read, where visitors come from, and which parts of the site confuse them. These tools collect pseudonymous usage data (a random identifier, pages viewed, traffic source, device and browser type, visit duration) — not your name or email, and Google Analytics 4 does not store IP addresses.

They load only after you accept. On your first visit a cookie banner appears; until you click "Accept" no analytics script is downloaded and none of their cookies is set. Your choice is stored in the cookie_consent cookie and you can change it at any time from the "Cookie settings" link at the bottom of every page.

They are never present inside the dashboard or inside the chat widget on your store. Your store data and your customers' conversations never pass through any external analytics tool.

How to opt out or withdraw your consent:

• Click "Cookie settings" at the bottom of any page and choose "Decline" — loading stops from your next visit.
• In your browser settings: block third-party cookies, or block cookies from the google-analytics.com and clarity.ms domains.
• Google's official analytics opt-out add-on: tools.google.com/dlpage/gaoptout.
• Opt out of Microsoft Clarity from their privacy page: clarity.microsoft.com/terms.

When you add widget.js to your store, the widget needs to remember the visitor from one page to the next so the conversation does not restart from scratch on every navigation. We do this with the browser's local storage, not with cookies:

• A random visitor id — links the same visitor's messages together on the same store. It contains no name, phone number, or email, and it is not used across other stores.
• An attribution reference — if the visitor arrived from a campaign link, we keep the reference so your dashboard can tell you which campaign this conversation or order came from.

Both are first party to your store's domain: they are stored under your domain name and never reach any other site. We set no cookies on your store's domain, and there is no third-party cookie from us. The widget configuration (colors, welcome message, the "AI assistant" notice) is fetched from our server and cached for 60 seconds — that cache lives on the server, not on the visitor's device.

Your obligation as a merchant: you are the controller of your store visitors' data, so your store's privacy or cookie notice should mention that the chat uses local storage for this purpose and name us as a processor. See the channel policies for details on each channel.

Links we compose in messages sent from the Platform (email, WhatsApp, chat) are written as /r/:token redirects. When a customer clicks, we record that the link was clicked and immediately forward them to the original destination. This is what lets a merchant see in the dashboard which campaign produced results. WhatsApp template buttons are exempt from this rewriting. Suspect clicks (bots, link previews) are labelled as suspect, not deleted.

Every marketing message contains an unsubscribe link with its own token; clicking it records the opt-out immediately and stops sending to that customer on that channel.

We use no third-party advertising pixels (Meta Pixel, Google Ads, and the like) in emails, in the widget, or in the dashboard. Attribution records are kept for 400 days to allow year-over-year comparison, then deleted.

• We set no advertising cookies and take part in no ad networks.
• We do not follow you or your customers across other sites, and we build no behavioral profiles.
• We do not sell data or use it to target ads — neither yours nor your customers'. The full picture is in the Privacy Policy.
• The only identifier we generate on your store (the widget visitor id) is random, specific to your store, and ties the visitor to nothing outside their conversation with you.

Every modern browser lets you view stored cookies, delete them, or stop a specific site from setting them. You will usually find these options under "Privacy and security" in the settings of Chrome, Safari, Firefox, or Edge. Local storage is cleared from the same place ("site data").

What happens if you block our cookies:

• Without the session cookie you cannot sign in to the dashboard — every request returns you to the sign-in page. That is not a bug; it is how sign-in works.
• Without the CSRF cookies, the sign-in form and Google sign-in fail.
• Without active_store_id, language, and theme, the dashboard and website still work but fall back to their defaults on every visit.
• Blocking analytics cookies affects nothing in the service.
• If a visitor to your store clears local storage, the widget starts a new conversation with a new id — the old conversations stay in your dashboard but are no longer linked to that visitor automatically.

Strictly necessary cookies (session, CSRF, workspace, language, theme) need no consent under the EU GDPR, the Turkish KVKK, or the Saudi PDPL, because they are required to deliver the service you asked for.

Analytics cookies on the marketing website run only where they are enabled in the deployment, and where the law requires prior consent (the EU and Turkey, for example) they run only after you choose to accept them. You can withdraw that consent at any time using the methods in the analytics section above.

The chat widget stores the visitor id to deliver the service the visitor asked for themselves (opening the conversation). If the law that applies to your store requires a notice or consent for this kind of storage, that is your obligation as controller — we provide the widget and the customizable notice, and you decide how to present it.

If we add a new cookie or a new analytics tool, or change how the widget works, we update this page and the "last updated" date at the top. We notify you of material changes (such as enabling a new analytics tool or any new storage on your store) by email to the account owner and by an in-dashboard notice before they take effect.

For any question about cookies or local storage: privacy@capiagent.com or via the contact page. We reply within 5 business days at most. For the full picture of the data we process, see the Privacy Policy and the list of subprocessors.