DocsTeam and settings
Privacy and your visitors' data
Aura records what helps you answer visitors and understand your site, and no more. Here's what it keeps, for how long, and what you need to tell your visitors.
You decide what Aura is used for on your site; OneInfer processes the data on your behalf.
What Aura keeps, and for how long
| What | Kept for |
|---|---|
| Visits: pages seen, clicks, time and scrolling, page speed, and the details your site passed | 30 days |
| Chats and their messages, notes, ratings, contact names and emails, and summaries | 12 months after the last message |
| People: the record that joins someone's chats | 12 months after their last chat |
| Clicks per page element (for heatmaps) and browser errors, with nothing that identifies anyone | 90 days |
| Daily totals for Insights, with no visitor ids | Kept |
What Aura never stores
- IP addresses. A visitor's rough location is worked out from it, then the address is dropped. Blocks use a one-way code instead.
- Anything visitors type into your site's own forms, and the values of any fields.
- Recordings of voice or calls. What's said shows in the chat as text.
- Full addresses: query strings are dropped (only campaign tags are kept), and a referrer is kept as its site only.
Clicks are recorded by the element and the text on it. Emails and long numbers are blanked out of that text.
What's stored in the visitor's browser
Nothing, and no cookies, until a visitor sends their first chat message. Then the chat keeps a token in the browser's local storage, so their later chats join up.
With Recognise returning visitors on (off by default), the chat also keeps a random id in the browser for 30 days, so a visitor's visits join up even if they never chat. In the EU and UK this usually needs the visitor's consent: turn it on only if your cookie banner covers analytics.
What visitors see
The chat always shows a recording notice at the top. By default: "Chats are recorded so our team can help you." You can reword it, but not remove it, because in some places recording a chat without saying so is against the law. Link your privacy policy from it in Look, under Chat.
Your privacy policy
Each bot's Go live step has a Privacy checklist. It writes the section to add to your privacy policy, filled in for that bot's settings: answering in the visitor's language, reading how chats went, voice, measuring pages, goals, returning visitors, Slack and Teams, and signed-in details. Copy or Download it.
The public privacy guide has the same steps. It's a starting point, not legal advice.
Delete someone's data
When someone asks you to delete their data:
- Find them on Live, using a visit of theirs.
- In their panel, choose Delete this visitor's data and confirm.
Their visits (every visit of their journey), page views and clicks, chats and messages, and their visitor record are removed for good. The token in their browser stops working. Integrations that take the "Someone's data is deleted" event are told, so your help desk can delete its copy. Only owners and admins can delete data.