Cookie Policy

A cookie is a small text file your browser stores on your device and sends back with every request to the site that set it. Sites use cookies to remember you from one page to the next: that you are signed in, which language you chose, which workspace you have open.

Local storage (localStorage) is different: it is a space in the browser that page code can read from and write to, but it is never sent automatically with requests. We use it in exactly one place — the chat widget on your storefront — and we explain why below.

First party versus third party: a first-party cookie is set by the site you are visiting. A third-party cookie is set by a different domain (an ad network, for example) so it can follow you across sites. Every cookie we set ourselves is first party. The only third-party cookies are sc_at, set by Snap on snapchat.com, the cookies TikTok may use on its own domain tiktok.com, and fr, set by Meta on facebook.com, and only on the public marketing website after you turn on "Advertising cookies" — see the advertising section below.

Capi Agent shows up in three different places, and each one has its own rules on this page:

1. The public marketing website (the pages you are reading now): one cookie for your language preference, plus optional analytics if they are enabled in the deployment, and the Snap Pixel, TikTok Pixel and Meta Pixel only if you turn on "Advertising cookies".
2. The dashboard app (/dashboard): strictly necessary cookies only, for sign-in, security, your workspace, and your theme. There are never analytics or ads inside the dashboard.
3. The chat widget on your storefront: we set no cookies on your store's domain at all. We use local storage only so the conversation survives between pages.

The following sections cover each surface in detail. Cookies set by your store platform itself (Salla, Zid, Shopify, and the others) are not ours and are governed by their policies.

These are the cookies without which the service does not work. They need no consent because they carry out something you asked for yourself — signing in, picking a store, picking a language. None of them tracks you outside our site.

We do not state lifetimes in days for these cookies on this page because they follow the library's settings; the rule is: security cookies live for the session, preference cookies live until you change the preference or clear them.

On the public website (home, pricing, blog, these pages) we use Google Analytics 4, Google Tag Manager and Microsoft Clarity to understand which pages get read, where visitors come from, and which parts of the site confuse them. These tools collect pseudonymous usage data (a random identifier, pages viewed, traffic source, device and browser type, visit duration) — not your name or email, and Google Analytics 4 does not store IP addresses.

No analytics cookie is set until you accept. On your first visit a cookie banner appears; until you click "Accept" the Tag Manager and Clarity scripts are not downloaded at all, and Google Analytics runs in its no-consent mode (Consent Mode): it sets and reads no cookie, gives you no identifier, and sends only anonymous signals so we can count visits in aggregate. Your choice is stored in the cookie_consent cookie and you can change it at any time from the "Cookie settings" link at the bottom of every page.

They are never present inside the dashboard or inside the chat widget on your store. Your store data and your customers' conversations never pass through any external analytics tool.

How to opt out or withdraw your consent:

• Click "Cookie settings" at the bottom of any page and choose "Decline" — Google Analytics goes back to cookieless mode at once, and the other tools stop from your next visit.
• In your browser settings: block third-party cookies, or block cookies from the google-analytics.com and clarity.ms domains.
• Google's official analytics opt-out add-on: tools.google.com/dlpage/gaoptout.
• Opt out of Microsoft Clarity from their privacy page: clarity.microsoft.com/terms.

On the public website only (home, pricing, blog, these pages) we use the Snap Pixel from Snap Inc. (USA) to measure Capi Agent's own ads on Snapchat, and to build audiences of website visitors so we can show them Capi Agent's own ads on Snapchat (retargeting).

We also use the TikTok Pixel from TikTok (TikTok Pte. Ltd., Singapore, and its group companies) to measure Capi Agent's own ads on TikTok, and to show Capi Agent's own ads on TikTok to visitors of the website (retargeting).

We also use the Meta Pixel from Meta (Meta Platforms Ireland Limited for visitors in the EU/EEA, and Meta Platforms, Inc., USA, elsewhere) to measure Capi Agent's own ads on Facebook and Instagram, and to show Capi Agent's own ads on Facebook and Instagram to visitors of the website (retargeting).

All three load only after you turn on "Advertising cookies". This is a separate, third category in the cookie banner and in the preferences popup, next to "Strictly necessary" and "Performance & analytics". Until you turn it on, none of the Snap, TikTok or Meta scripts is even downloaded. Your choice is stored in the cookie_consent_ads cookie.

What Snap receives: the page address (URL) and the referring page, your IP address, browser and device information (user agent), and the pixel's cookie identifier. The only event we send today is a page view. No name, email, or phone number is sent.

What TikTok receives: the page address (URL) and the referring page, your IP address, browser and device information, the pixel's cookie identifier, page views, and clicks on buttons on the page. No name, email, or phone number is sent (automatic advanced matching is off).

What Meta receives: the page address (URL) and the referring page, your IP address, browser and device information, the pixel's cookie identifier, and page views. Automatic button-click events and reading of page content are switched off. No name, email, or phone number is sent.

TikTok may also use its own cookies on tiktok.com.

None of the three pixels is ever present inside the dashboard, on the sign-in or sign-up pages, inside the chat widget on your store, or in our emails. Your store data and your customers' conversations never go to them. Snap may also process this data under its own privacy policy: values.snap.com/privacy/privacy-policy, and TikTok under its own: tiktok.com/legal/page/global/privacy-policy/en, and Meta under its own: facebook.com/privacy/policy. Data sent to TikTok may be transferred outside your country, including to Singapore and the United States, and data sent to Meta may be transferred to the United States.

How to withdraw your consent:

• Click "Cookie settings" at the bottom of any page and turn "Advertising" off — all three pixels stop from the next page load.
• In the Snapchat app: Settings → Privacy Controls → Ad preferences, or from Snap's page: values.snap.com/privacy/your-information.
• In the TikTok app: Settings and privacy → Ads, to turn off personalised ads.
• In Facebook or Instagram: Accounts Center → Ad preferences.

When you add widget.js to your store, the widget needs to remember the visitor from one page to the next so the conversation does not restart from scratch on every navigation. We do this with the browser's local storage, not with cookies:

• A random visitor id — links the same visitor's messages together on the same store. It contains no name, phone number, or email, and it is not used across other stores.
• An attribution reference — if the visitor arrived from a campaign link, we keep the reference so your dashboard can tell you which campaign this conversation or order came from. Since 26.09.2026 the same goes for the ad click ids an ad platform puts on the URL (fbclid, ScCid, ttclid, gclid / wbraid / gbraid): kept in local storage for 28 days and sent with the visitor's messages, so the ads dashboard can attribute the conversation and the order.

Both are first party to your store's domain: they are stored under your domain name and never reach any other site. We set no cookies on your store's domain, and there is no third-party cookie from us. The widget configuration (colors, welcome message, the "AI assistant" notice) is fetched from our server and cached for 60 seconds — that cache lives on the server, not on the visitor's device.

Your obligation as a merchant: you are the controller of your store visitors' data, so your store's privacy or cookie notice should mention that the chat uses local storage for this purpose and name us as a processor. See the channel policies for details on each channel.

Links we compose in messages sent from the Platform (email, WhatsApp, chat) are written as /r/:token redirects. When a customer clicks, we record that the link was clicked and immediately forward them to the original destination. This is what lets a merchant see in the dashboard which campaign produced results. WhatsApp template buttons are exempt from this rewriting. Suspect clicks (bots, link previews) are labelled as suspect, not deleted.

Every marketing message contains an unsubscribe link with its own token; clicking it records the opt-out immediately and stops sending to that customer on that channel.

We use no third-party advertising pixels (Meta Pixel, Google Ads, and the like) in emails, in the widget, or in the dashboard. Attribution records are kept for 400 days to allow year-over-year comparison, then deleted.

• There are no advertising cookies anywhere in Capi Agent except the Snap Pixel, the TikTok Pixel and the Meta Pixel on the public marketing website, and only after you turn on "Advertising cookies" (see the section above). None in the dashboard, the sign-in pages, the chat widget, or our emails.
• We do not follow your customers across other sites, and we build no profiles of your customers.
• We never sell data, and we never use your store data or your customers' data for advertising. The full picture is in the Privacy Policy.
• The only identifier we generate on your store (the widget visitor id) is random, specific to your store, and ties the visitor to nothing outside their conversation with you.

Every modern browser lets you view stored cookies, delete them, or stop a specific site from setting them. You will usually find these options under "Privacy and security" in the settings of Chrome, Safari, Firefox, or Edge. Local storage is cleared from the same place ("site data").

What happens if you block our cookies:

• Without the session cookie you cannot sign in to the dashboard — every request returns you to the sign-in page. That is not a bug; it is how sign-in works.
• Without the CSRF cookies, the sign-in form and Google sign-in fail.
• Without active_store_id, language, and theme, the dashboard and website still work but fall back to their defaults on every visit.
• Blocking analytics or advertising cookies (or declining them in "Cookie settings") affects nothing in the service.
• If a visitor to your store clears local storage, the widget starts a new conversation with a new id — the old conversations stay in your dashboard but are no longer linked to that visitor automatically.

Strictly necessary cookies (session, CSRF, workspace, language, theme) need no consent under the EU GDPR, the Turkish KVKK, or the Saudi PDPL, because they are required to deliver the service you asked for.

Analytics cookies on the marketing website run only where they are enabled in the deployment, and where the law requires prior consent (the EU and Turkey, for example) they are set only after you choose to accept them. You can withdraw that consent at any time using the methods in the analytics section above.

Advertising cookies (the Snap Pixel, the TikTok Pixel and the Meta Pixel on the marketing website) always need your prior consent: they are set only after you turn on "Advertising cookies", separately from analytics. Our legal basis is that consent, and you can withdraw it at any time from "Cookie settings", as described in the advertising section above.

The chat widget stores the visitor id to deliver the service the visitor asked for themselves (opening the conversation). If the law that applies to your store requires a notice or consent for this kind of storage, that is your obligation as controller — we provide the widget and the customizable notice, and you decide how to present it.

If we add a new cookie or a new analytics tool, or change how the widget works, we update this page and the "last updated" date at the top. We notify you of material changes (such as enabling a new analytics tool or any new storage on your store) by email to the account owner and by an in-dashboard notice before they take effect.

For any question about cookies or local storage: privacy@capiagent.com or via the contact page. We reply within 5 business days at most. For the full picture of the data we process, see the Privacy Policy and the list of subprocessors.