What the ZappBot code keeps in a browser, taken from the code today. The code sets one cookie of its own, the affiliate cookie described below, and only when a visitor arrives by an affiliate link. Apart from that it uses the browser's local storage (kept until cleared) and session storage (this tab only, gone when the tab closes). ZappBot's own code sets no analytics and no advertising cookies.
Strictly necessary storage (the chat session, your language, sign-in on the dashboard) is used without asking, because the page or chat cannot work without it. The affiliate cookie is not necessary for the service, so it is treated as optional: it is set only when a link carries a referral code, it holds no name or contact, and blocking it never stops anyone from using or signing up for ZappBot.
Session storage: a random chat id, the position in the conversation and the last lines, so the chat survives a page change in the same tab. Also the language the visitor picked, whether a page-asked bubble was closed, whether a proactive bubble was shown, and the larger-text and high-contrast switches.
Local storage: the time of the last visit, only when the business turns on the welcome-back message. It is used to tell whether the visitor is returning after 30 minutes.
The business that runs the chat decides to put the widget on its site. That business is responsible for its own cookie and privacy notice to its visitors; this page describes what the widget code itself stores.
Local storage: the chosen language. The public pages are always light, so a stored light or dark choice is ignored on them (an older choice may still sit in your browser and does nothing). The demo page also keeps the chosen example business and language. Blocking this storage only means the page opens in English.
When a page is opened with ?ref=CODE in the address, the browser keeps the cookie lp_ref (the code, 30 days, last link wins, same site only). It is read once, when that person signs up for a trial, so the sign-up can be credited to the person who shared the link. It holds no name or contact. If you do not want it, block cookies for this site or delete lp_ref; nothing else changes.
The sign-in link carries a token in the address. Local storage: the staff member's display name, the sound on or off choice and the dashboard's own light or dark theme. If a person turns on notifications, the browser also keeps a push subscription for the dashboard (a service worker); it can be turned off on the same page.
Local storage: an encrypted operator vault used only by the operator.
Cloudflare Turnstile runs on the sign-up and sign-in pages when the operator turns it on, and VietQR loads a QR image for payments. These services are run by other companies and can set their own cookies or storage under their own policies. The outside-services list is on the data-location page and the sub-processors page.
You can clear or block cookies and site storage in your browser settings at any time. The chat, the pages and the dashboard keep working with storage blocked, with the defaults (English, light, a new chat on each visit). If this list changes, this page changes with it. Questions: use the contact link at the top of this page.