Security and privacy

Cookie consentCopy Anchor Link

By default the widget appears as soon as its display rule allows. If your site uses a cookie banner and you want the widget to wait for consent, open the conversational form, go to the Display tab, Trigger, and turn on Wait for cookie consent.

With this option on, until consent is given the widget:

• does not open,
• does not set its visitor identifier,
• does not record page visits.

Your consent banner tells the widget what the visitor chose by calling the Nudge JavaScript API:

// After the visitor accepts
window.Nudge.setConsent(true)

// If the visitor refuses or withdraws consent
window.Nudge.setConsent(false)

What the widget stores in the browserCopy Anchor Link

Page visits record, for each page, its path and the time: no IP address and no page title. They are erased after 90 days. The Outreach Agent uses them to spot visitors who come back without writing.

Conversation memoryCopy Anchor Link

Choose whether a visitor who reloads the page picks the conversation back up, per form, in Settings › Forms, section AI, Remember the conversation:

• Nothing is stored: reloading starts a new conversation. No resume identifier is stored on the device. Messages sent are still saved on the server.
• Until the tab closes: survives a reload and a navigation in the same tab, and is gone when the tab closes. Never readable by another site or a later visit.
• Across visits, with consent: survives between visits, but only once your cookie banner says yes. Without that signal it behaves like the first option.

The resume identifier expires after 30 days without a new message. It gives access to the conversation, so it is treated as pseudonymous personal data.

How visitor data is handledCopy Anchor Link

• Messages are saved as they are sent, so your team gets the conversation even when the visitor leaves before the end.
• Contact details are masked from the AI. Email addresses and phone numbers typed by the visitor are detected and replaced before Nudge's AI reads the conversation; once the name, email and phone are known, they are replaced wherever they appear. The AI knows that an email was given, not which one. Your team sees the real values in Nudge.
• Page content stays on the page. To pick questions for the section being read, the widget sends only the section heading, never the text displayed, which could hold a signed-in visitor's data.
• Documents: when you upload a file to the knowledge base, only its extracted text is used; the file itself is never sent to the AI.
• Disclosure: the widget footer reads AI-generated answers, so visitors know they are talking to an assistant.
• Booking consent: before a meeting is confirmed, the visitor accepts your terms when your forms require consent. The consent text and the link to your privacy policy are set in Settings › Forms, section Appearance.

For data subject requests (access, export, erasure), retention settings and your data processing terms, see Account.

Protection against abuseCopy Anchor Link

Nudge protects your widget and your conversation allowance without anything to configure:

• Bot check: an invisible check confirms that a real browser opens each conversation. Scripts that try to open conversations directly are refused.
• Site check: Nudge compares the site a conversation comes from with the website address of the knowledge base the form reads (with or without www). Your widget copied onto another website cannot hold conversations at your expense.
• Hijacking guard: every visitor message is checked before the agent acts on it. A message trying to change the agent's role, extract its instructions or make it misbehave gets a polite refusal, and the agent cannot record anything or open the calendar on that turn. Repeated attempts end the conversation. These events appear as Flags in the conversation (see Conversations).
• Limits: each conversation has a maximum number of visitor messages. Past it, the visitor can still leave their details or book, but the agent stops writing free answers. When your workspace reaches its monthly conversation allowance, the widget is hidden until the next month; your team is notified by email as the allowance nears its end.

Blocking visitorsCopy Anchor Link

To refuse specific visitors in every form, the widget's conversational forms and the booking form included, use Settings › Forms, section Blocking: blocked IP addresses, emails, countries and dialling codes. See Forms and scheduling.

What the agent will never doCopy Anchor Link

Whatever the instructions, tone or content of your knowledge base, the Website Agent:

• never invents a time slot: the calendar shows your closers' real availability;
• never confirms a meeting on its own: only the visitor's click on Confirm the meeting books it;
• never states a fact that is not in your knowledge base: it says it does not know instead;
• never follows instructions hidden in a web page it read: pages are material to check, and the ingestion check sets aside pages that contain hidden instructions (badge hidden instruction in Sources).

Content Security PolicyCopy Anchor Link

If your site sends a Content Security Policy, it must allow Nudge or the widget will not load. The Website Agent page shows Blocked by CSP and lists what to add. See Content Security Policy.