# Privacy, cookies & compliance

> Everything you need to declare Bookbag as a third-party service in your cookie banner and privacy policy — the exact browser storage the widget uses (no cookies), paste-ready disclosure text, per-platform setup for Cookiebot, Usercentrics, Borlabs, OneTrust and Shopify, plus GDPR and CCPA/CPRA guidance.

If you run the Bookbag chat widget on your website, you almost certainly have to name Bookbag somewhere — in a cookie banner, a consent management platform (CMP), a privacy policy, or all three. This page gives you the facts to do that accurately, plus text you can copy straight into your own documents.

It is written for the person filling in the form: a shop owner in the EU adding a service to Borlabs or Usercentrics, or a US merchant adding a "third parties we share data with" row to their privacy policy.

> **NOT LEGAL ADVICE:** This page describes what the Bookbag widget technically does so you can describe it accurately. It is **not legal advice**, and it is not a substitute for your own assessment. Privacy law depends on your jurisdiction, your industry, and how you have configured your agent — consult your own counsel or data protection officer before you publish a privacy notice.

## The short version

- **Bookbag sets no cookies.** The widget never writes to `document.cookie`, and no widget response sets a cookie. Many consent managers assume "third-party script = cookie" — that assumption is wrong here, and it changes how you categorise us.
- **Bookbag does use browser storage.** It writes a small number of `localStorage` and `sessionStorage` entries. Under the EU ePrivacy rules, storing or reading information on a user's device is regulated whether or not it is technically a cookie, so these still belong in your disclosure.
- **The purpose is functional.** The entries cache the widget's appearance and keep a visitor's chat going across page loads. None of them are advertising or cross-site tracking identifiers, and Bookbag does not use them to build advertising profiles.
- **Bookbag is your processor for conversation data.** Your visitors talk to *your* agent; Bookbag processes those conversations on your behalf and under your instructions.
- **Service name:** Bookbag · **Provider:** Bookbag Inc. · **Privacy policy:** [https://bookbag.ai/legal/privacy](https://bookbag.ai/legal/privacy)

## What Bookbag stores in the browser

The widget has two parts, and they store data in two different places. Knowing which is which matters, because most CMPs ask you to declare storage per domain.

1. The **loader script** (`https://app.bookbag.ai/widget/embed`) runs on **your** page, so anything it stores is first-party storage on **your** domain.
2. The **chat panel** is an iframe served from `https://app.bookbag.ai/widget/frame`, so anything it stores is third-party (partitioned) storage on the **Bookbag** origin — or on your own domain if you use a [custom domain](/docs/deploy/custom-domain).

### Storage written on your domain (by the loader script)

| Key | Storage type | Purpose | Lifetime |
| --- | --- | --- | --- |
| `bb_cfg_<agentId>` | localStorage | Caches the widget's last-known visual configuration — colour, position, chat icon, screen offsets, launcher delay, auto-open delay and proactive popup messages — so the chat bubble can render immediately on a repeat visit instead of waiting for a network round trip. Contains configuration only; no visitor data. | Persistent. Overwritten each time the configuration is fetched; removed when the visitor clears site data for your domain. |
| `bb_widget_opened_<agentId>` | sessionStorage | Records that the visitor has already opened the chat panel in this browsing session, so an agent configured to auto-open does not pop up again on every page. | Session — cleared automatically when the browser tab is closed. |
| `bb_widget_opened_<agentId>_teaser` | sessionStorage | Records that the proactive teaser/popup message has already been shown in this browsing session, so the visitor is not shown it repeatedly. Not written when the agent is configured to show the popup on every page load. | Session — cleared automatically when the browser tab is closed. |

### Storage written on the Bookbag chat origin (inside the chat iframe)

| Key | Storage type | Purpose | Lifetime |
| --- | --- | --- | --- |
| `bb_chat_<agentId>` | localStorage | Chat continuity. Holds the conversation ID, the conversation token that authorises that visitor to continue it, the ID of the last message received from a human agent, and up to the last 60 messages of the transcript — so the conversation survives a page navigation or a reload instead of restarting. Only written when **persist chat** is enabled on the agent (the default). | Persistent. Deleted when the visitor starts a new chat or clears the conversation from the widget menu, and when they clear site data. |
| `bb_chat_<agentId>_nx` | sessionStorage | Records that the visitor dismissed the notice banner shown at the top of the chat panel, so it stays dismissed for the rest of the session. | Session — cleared automatically when the browser tab is closed. |

> **THE AGENT ID IS A PUBLIC KEY, NOT A VISITOR ID:** The `<agentId>` in each key is the same opaque public identifier you put in the embed snippet's `data-agent-id` attribute (for example `bk_…`). It identifies the agent, not the visitor. If you run more than one agent on a site, you will see one set of keys per agent.

> **NO COOKIES, AT ALL:** The Bookbag widget does not create cookies. If your consent manager only has fields for cookies, use its "local storage" / "other technology" option, or record the entries above with a note that they are `localStorage` and `sessionStorage` rather than cookies. Declaring them as cookies with a fabricated expiry is worse than declaring them accurately.

> **USING A CUSTOM DOMAIN?:** If you serve the widget from your own subdomain (e.g. `chat.yourbrand.com` — see [Custom domain](/docs/deploy/custom-domain)), every key above lives on **your** domain as first-party storage. Adjust the "domain" field in your CMP accordingly.

## When the storage is written

Consent managers usually want to know whether anything is stored **before** the visitor interacts. Precisely:

- **On page load, with the widget installed:** the loader reads `bb_cfg_<agentId>` to render the bubble instantly, fetches the agent's public configuration from Bookbag, and writes the refreshed configuration back to `bb_cfg_<agentId>`. This happens without any visitor interaction.
- **When the visitor opens the chat:** `bb_widget_opened_<agentId>` is set, and the chat iframe loads.
- **When a proactive popup is shown:** `bb_widget_opened_<agentId>_teaser` is set.
- **When the visitor sends a message:** `bb_chat_<agentId>` is created and updated as the conversation continues.
- **When the visitor dismisses the in-chat notice:** `bb_chat_<agentId>_nx` is set.

> **THIS MATTERS FOR PRIOR CONSENT:** Because `bb_cfg_<agentId>` is written on page load rather than on interaction, a strict prior-consent setup should **block the embed script until consent is given** rather than rely on the visitor not opening the chat. See [Blocking the widget until consent](#blocking-the-widget-until-consent) below.

## What data leaves the browser

Separately from browser storage, your privacy notice should describe what is transmitted. With the widget installed, the visitor's browser communicates with Bookbag as follows:

| Request | When | What it carries |
| --- | --- | --- |
| Agent configuration | On every page load | The public agent ID. No visitor content. |
| Chat message | When the visitor sends a message | The message text, the conversation ID and token, and — if you use [identity verification](/docs/developers/identity-verification) — the signed user ID and any user metadata you chose to pass. |
| Lead / form submission | When the visitor submits a lead form or an in-chat widget | The field values the visitor entered, plus the conversation ID. |
| Message rating | When the visitor rates a reply | The rating and the conversation token. |
| Live-agent polling | While a conversation has been taken over by a human | The conversation ID and token. |
| Voice session | Only when voice mode is enabled and the visitor starts a call | Audio from the visitor's microphone, and a transcript of the call logged back to Bookbag. |

> **VOICE MODE CONTACTS OPENAI DIRECTLY:** If you enable [voice](/docs/agents/voice), the browser opens a realtime connection **directly to OpenAI** (`api.openai.com`) using a short-lived session credential issued by Bookbag. If you run voice on your site, list OpenAI as a recipient in your privacy notice too. Text-only agents do not make this connection.

As with any HTTP request, the visitor's IP address and user-agent string are transmitted to the receiving server as a technical necessity.

## Paste-ready consent-manager disclosure

Most CMPs ask for the same handful of fields. Here they are, filled in:

| Field | Value |
| --- | --- |
| Service / vendor name | Bookbag |
| Provider | Bookbag Inc. |
| Category | Functional / Customer support (not Marketing, not Statistics) |
| Purpose | Provides the on-site chat assistant: renders the chat launcher, answers visitor questions, and keeps an ongoing conversation available across page loads. |
| Technology used | `localStorage` and `sessionStorage`. **No cookies.** |
| Storage keys | `bb_cfg_<agentId>`, `bb_widget_opened_<agentId>`, `bb_widget_opened_<agentId>_teaser`, `bb_chat_<agentId>`, `bb_chat_<agentId>_nx` |
| Domains | `app.bookbag.ai` (or your Bookbag custom domain), plus your own domain for the two keys written by the loader script |
| Data transferred | Chat messages, conversation identifiers, any details the visitor submits in a chat form, IP address and user-agent |
| Privacy policy | [https://bookbag.ai/legal/privacy](https://bookbag.ai/legal/privacy) |
| Data protection contact | [legal@bookbag.ai](mailto:legal@bookbag.ai) |
| Provider address | TODO: confirm Bookbag Inc.'s registered business address before publishing it in a consent notice. |

And the same thing as a block of text you can paste into a free-text service description:

```text
Bookbag

Provider: Bookbag Inc.
Category: Functional / Customer support

Purpose: We use Bookbag to provide the chat assistant on this website. It
answers visitor questions and, where offered, passes a request on to our
support team. Bookbag processes the messages you send in the chat on our
behalf.

Technologies used: local storage and session storage. Bookbag does not set
any cookies.

Stored entries:
  bb_cfg_<agentId>                    | localStorage    | widget appearance cache | persistent
  bb_widget_opened_<agentId>          | sessionStorage  | chat already opened this session | session
  bb_widget_opened_<agentId>_teaser   | sessionStorage  | popup already shown this session | session
  bb_chat_<agentId>                   | localStorage    | ongoing conversation and recent messages | persistent, until the chat is reset
  bb_chat_<agentId>_nx                | sessionStorage  | in-chat notice dismissed | session

Data processed: chat messages, conversation identifiers, any details you
enter into a chat form, IP address, browser user-agent.

Privacy policy: https://bookbag.ai/legal/privacy
```

> **TIP:** Replace `<agentId>` with your actual agent ID if your CMP requires literal key names. If you run several agents, list one set of keys per agent — or use a wildcard such as `bb_chat_*` where the tool supports it.

## Setting Bookbag up in your consent manager

The five tools below cover most merchant setups. In every case the pattern is the same: register Bookbag as a **functional** service, record the storage entries, and make sure the embed script does not run before consent if your policy requires prior consent.

### Cookiebot (Usercentrics Cookiebot CMP)

1. **Let the scanner run, then correct it** — Cookiebot's scanner reports local storage under "Unclassified" because it cannot infer a purpose. Open Cookie declaration → Unclassified and move each bb_ entry into Preferences (functional).
2. **Add the entries manually if the scanner missed them** — Under Manage cookies → Add cookie, add each key from the table above with type "HTML Local Storage" or "HTML Session Storage" and the matching domain.
3. **Block the script until consent** — Change the embed to data-cookieconsent="preferences" and type="text/plain" so Cookiebot activates it only after the Preferences category is accepted.

```html
<script
  src="https://app.bookbag.ai/widget/embed"
  data-agent-id="YOUR_AGENT_ID"
  data-cookieconsent="preferences"
  type="text/plain"
  defer
></script>
```

### Usercentrics (CMP v2 / Web CMP)

1. **Search the Data Processing Services catalogue** — Open Configuration → Services and search for "Bookbag". If there is no catalogue entry yet, create a Custom Data Processing Service.
2. **Fill in the service** — Name: Bookbag. Processing company: Bookbag Inc. Category: Functional. Data purposes: Provide the on-site chat assistant. Technologies used: Local storage, Session storage. Privacy policy URL: https://bookbag.ai/legal/privacy.
3. **List the storage entries** — Add each bb_ key from the table above with its type and duration. Usercentrics has explicit "Local Storage" and "Session Storage" options — use those rather than "Cookie".
4. **Wire up script blocking** — Give the embed script type="text/plain" and the data-usercentrics attribute set to the service name you created, so it only executes once that service is consented to.

```html
<script
  src="https://app.bookbag.ai/widget/embed"
  data-agent-id="YOUR_AGENT_ID"
  type="text/plain"
  data-usercentrics="Bookbag"
  defer
></script>
```

### Borlabs Cookie (WordPress / WooCommerce)

Borlabs is the most common CMP on German WordPress and WooCommerce shops. Bookbag has no prebuilt Borlabs template, so add it as a custom service.

1. **Create the service** — Go to Borlabs Cookie → Cookies (Services), pick the "Preferences" / "Funktionell" group, and click Add new. Choose the Custom / Benutzerdefiniert template.
2. **Fill in the details** — Name: Bookbag. Provider / Anbieter: Bookbag Inc. Purpose / Zweck: paste the German block above. Privacy policy URL: https://bookbag.ai/legal/privacy. Cookie name: leave the cookie fields empty and note in the description that Bookbag uses local and session storage rather than cookies — or list the bb_ keys there so they still appear in your declaration.
3. **Add the opt-in code** — Put the embed <script> tag in the service's "Opt-in code" box. Borlabs injects it only after the visitor accepts the Preferences group.
4. **Reference it in your shortcode** — If you place the widget through a page template, wrap it in the Borlabs content blocker shortcode for the service so it is not rendered before consent.

> **GERMAN SHOPS: NAME THE STORAGE, NOT "COOKIES":** German consent declarations conventionally list a name, a runtime (Laufzeit) and a provider for each entry. For Bookbag, use the key names from the table above and set the Laufzeit to **Sitzung** for the `sessionStorage` entries and **dauerhaft / bis zum Loeschen** for the two `localStorage` entries — do not invent a day count, because these are not cookies and have no expiry timestamp.

### OneTrust

1. **Add Bookbag to the cookie/tracker inventory** — In Cookie Compliance → Categorizations, add the bb_ entries with the tracker type "Local Storage" or "Session Storage" (OneTrust supports both alongside cookies) and assign them to your Functional category.
2. **Record the vendor** — Add Bookbag Inc. to Vendors with the privacy policy https://bookbag.ai/legal/privacy and the purpose "on-site chat assistant / customer support".
3. **Enable auto-blocking or manual blocking** — Either add app.bookbag.ai to the auto-blocking rules for the Functional category, or convert the embed to a class-based OneTrust script so it executes only after consent.

```html
<!-- class="optanon-category-C0003" = Functional, adjust to your category ID -->
<script
  src="https://app.bookbag.ai/widget/embed"
  data-agent-id="YOUR_AGENT_ID"
  type="text/plain"
  class="optanon-category-C0003"
  defer
></script>
```

### Shopify — the Customer Privacy API

Shopify stores that use the built-in cookie banner (or an app that integrates with it) can gate the widget with Shopify's **Customer Privacy API**. Bookbag falls under the `preferences` purpose. Add the snippet below to your theme instead of the plain embed tag: it loads the widget when the visitor has already consented, and listens for the consent event so the widget appears immediately if they accept afterwards.

```html
<script>
  (function () {
    var loaded = false;
    function loadBookbag() {
      if (loaded) return;
      loaded = true;
      var s = document.createElement('script');
      s.src = 'https://app.bookbag.ai/widget/embed';
      s.setAttribute('data-agent-id', 'YOUR_AGENT_ID');
      s.defer = true;
      document.body.appendChild(s);
    }
    function allowed() {
      var api = window.Shopify && window.Shopify.customerPrivacy;
      return !!(api && api.preferencesProcessingAllowed && api.preferencesProcessingAllowed());
    }
    if (allowed()) loadBookbag();
    document.addEventListener('visitorConsentCollected', function (e) {
      if ((e.detail && e.detail.preferencesAllowed) || allowed()) loadBookbag();
    });
  })();
</script>
```

> **TIP:** On Shopify markets where consent is not required, `preferencesProcessingAllowed()` returns true straight away, so the widget loads as normal. See also [Shopify integration](/docs/integrations/shopify) and [Website widget](/docs/deploy/web-widget).

## Blocking the widget until consent

If none of the above applies — or you use a CMP not listed here — the general rule is simple: **the widget does nothing until its script runs.** There is no pixel, no beacon, and no fallback request. So the only thing you have to control is whether the `<script>` tag executes.

- **Do not render the tag** server-side until consent is stored, or
- **Neutralise the tag** with `type="text/plain"` plus your CMP's activation attribute, or
- **Inject it from JavaScript** in your CMP's "on consent" callback, exactly as in the Shopify snippet above.

> **REMOVING THE WIDGET REMOVES THE STORAGE:** If a visitor withdraws consent, remove the script and clear the `bb_` keys for your domain. The two `sessionStorage` entries disappear on their own when the tab closes; a visitor can clear everything at any time via their browser's "clear site data" control, and clicking **New chat** in the widget menu deletes `bb_chat_<agentId>` immediately.

## GDPR (EU/EEA and UK)

### Who is controller and who is processor

For the conversations that happen on your website, **you are the controller** and **Bookbag is the processor**. Your visitors are talking to your agent, trained on your content, to get help with your products; Bookbag processes those messages on your instructions in order to provide the service.

- **You decide** which agent is deployed, what knowledge it has, whether it collects leads, whether voice is enabled, and whether identity verification passes customer data through.
- **Bookbag processes** the messages, conversation records, and any lead data your agent collects, in order to run the agent and show you the results.
- **Bookbag is a controller** only for its own relationship with you as a customer — your account, billing, and support correspondence. That is covered in [Bookbag's privacy policy](https://bookbag.ai/legal/privacy).

### Lawful basis and consent

Two separate questions come up, and it helps to keep them apart:

1. **Storing and reading data on the device (ePrivacy / Article 5(3) of the ePrivacy Directive, as implemented locally — e.g. § 25 TDDDG in Germany).** This is about the `localStorage` and `sessionStorage` entries listed above. Some supervisory authorities accept that storage which is strictly necessary to deliver a service the user explicitly requested is exempt from consent; others take a narrower view, and the widget writes `bb_cfg_<agentId>` on page load rather than on interaction. Many merchants therefore place Bookbag behind a **functional / preferences** consent category. That is a decision for you and your counsel.
2. **Processing the personal data in the conversation itself (GDPR Article 6).** Merchants commonly rely on **legitimate interests** (Art. 6(1)(f)) for providing customer support, or on **performance of a contract** (Art. 6(1)(b)) where the chat is part of fulfilling an order. If your agent collects leads for marketing purposes, you will usually need **consent** (Art. 6(1)(a)) for that marketing use.

> **TELL VISITORS NOT TO SEND SPECIAL-CATEGORY DATA:** A free-text chat box invites people to type whatever is on their mind, including health details and other Article 9 data. Use the widget's notice banner or your welcome message to tell visitors what the chat is for, and configure your agent's guardrails accordingly — see [AI trust & guardrails](/docs/agents/ai-trust).

### Data subject requests

Because you are the controller, requests from your visitors come to **you**. Bookbag gives you the tools to answer them:

- **Access / portability** — find the conversation in [Activity & chat logs](/docs/agents/activity) and export it; leads can be exported from the leads list.
- **Erasure** — delete the conversation and any associated lead record from the dashboard. A visitor can also delete their own local copy by clicking **New chat** in the widget menu, which removes `bb_chat_<agentId>` from their browser.
- **Rectification and objection** — handled by you in the dashboard, since you control the records.
- **Requests that need Bookbag's help** — write to [legal@bookbag.ai](mailto:legal@bookbag.ai).

### Data processing agreement (DPA)

Article 28 GDPR requires a written processor agreement between you and Bookbag. **TODO: confirm whether Bookbag publishes a standard DPA and, if so, link it here.** Until that is confirmed, contact [legal@bookbag.ai](mailto:legal@bookbag.ai) to put a data processing agreement in place — do not assume one is included by default.

- **TODO: sub-processors.** Article 28(2) requires you to be informed of sub-processors. Bookbag does not currently publish a sub-processor list; ask for the current list before you complete your own record of processing activities.
- **TODO: hosting location and international transfers.** Confirm where conversation data is stored and which transfer mechanism (e.g. Standard Contractual Clauses, EU-US Data Privacy Framework) applies before describing transfers in your privacy notice.
- **TODO: retention.** Confirm how long Bookbag retains conversation records by default. (Documented exception: on Enterprise workspaces with [HIPAA / Zero Data Retention](/docs/workspace/hipaa) enabled, conversations auto-end after 24 hours idle or 7 days of age and their content is irreversibly purged.)
- **TODO: EU representative.** If you need an Article 27 EU representative for Bookbag, request the details.

> **HANDLING HEALTH DATA?:** Bookbag offers Zero Data Retention on Enterprise, which redacts chat logs and lead data and purges conversation content automatically. See [HIPAA compliance (Zero Data Retention)](/docs/workspace/hipaa). Note that ZDR is a US HIPAA feature and is not itself a GDPR compliance measure, although the retention limits it enforces are useful under data minimisation.

## United States — CCPA/CPRA and the state privacy laws

US state privacy laws (California's CCPA as amended by the CPRA, plus Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the rest of the growing list) work differently from the GDPR, but the practical obligations for a merchant running a chat widget are similar: **say what you collect, say who you share it with, and honour opt-outs.**

### Bookbag is a service provider, not a third-party seller

Under the CCPA/CPRA, a vendor that processes personal information solely to perform services on your behalf — and is contractually restricted from using it for its own purposes — is a **service provider**, not a **third party**. Disclosing personal information to a service provider is not a "sale" or a "share" for cross-context behavioural advertising.

- Bookbag processes conversation data to run your agent and show you the results — a service-provider role.
- The Bookbag widget sets no advertising cookies and no cross-site advertising identifiers, so installing it does not by itself create a "share" for cross-context behavioural advertising.
- **Your contract has to say so.** The service-provider characterisation depends on the written terms between you and Bookbag. **TODO: confirm that Bookbag's standard terms include CCPA/CPRA service-provider language, or request an addendum from [legal@bookbag.ai](mailto:legal@bookbag.ai).**

### What to put in your privacy policy

1. **Categories collected.** Chat transcripts are "internet or other electronic network activity" and, where the visitor types their name or email or you pass it through identity verification, "identifiers" and "customer records".
2. **Purpose.** Providing customer service and responding to inquiries — an enumerated business purpose.
3. **Categories of recipients.** Name Bookbag (and OpenAI, if you have enabled voice) in your list of service providers.
4. **Sources.** Directly from the consumer, through the chat interface.
5. **Retention.** State how long you keep chat records. This is your decision as the business — see the retention TODO above for the platform default.
6. **Rights.** Your existing know / delete / correct / opt-out mechanisms cover chat data; make sure your deletion workflow includes deleting conversations from Bookbag.

### Do Not Sell or Share

If your site displays a "Do Not Sell or Share My Personal Information" link or honours **Global Privacy Control** signals, remember two things:

- Passing chat content to Bookbag as a service provider is not a sale or a share, so an opt-out does not require you to disable the widget.
- If you pipe chat or lead data onward into advertising tools — for example by syncing captured leads to an ad platform — **that** downstream step can be a sale or a share, and your opt-out must stop it.

> **CHAT RECORDING AND TWO-PARTY CONSENT:** Several US states have wiretapping statutes that plaintiffs have used against website chat and session-replay tools. If you record conversations, disclose it clearly at the start of the chat — the widget's notice banner and welcome message are the natural places — and take advice on whether your states require express consent.

## Copy-paste privacy-policy paragraph

Drop this into the "third parties" or "service providers" section of your own privacy policy and adjust the bracketed parts.

```text
AI chat assistant (Bookbag)

We use Bookbag, a service provided by Bookbag Inc., to operate the chat
assistant on this website. When you open the chat, Bookbag stores a small
amount of information in your browser using local storage and session
storage - not cookies - so that the chat window renders correctly and your
conversation is still there if you move to another page. When you send a
message, the content of that message, an identifier for the conversation,
any details you enter into a chat form, your IP address and your browser's
user-agent are transmitted to Bookbag so it can generate a reply and, where
necessary, pass your request to our support team.

Bookbag processes this information only on our behalf and under our
instructions, and is not permitted to use it for its own purposes. We do not
sell or share this information for cross-context behavioural advertising.

You can end and delete a conversation at any time by selecting "New chat" in
the chat menu, or by clearing site data in your browser.

Further information: Bookbag's privacy policy is available at
https://bookbag.ai/legal/privacy.
```

> **ADJUST IT IF YOU HAVE CHANGED THE DEFAULTS:** Add a sentence about **voice** if you have enabled it (audio is processed by OpenAI), about **identity verification** if you pass logged-in customer details into the chat, and about **lead capture** if your agent collects contact details for marketing rather than support.

## Common questions

**Does the Bookbag widget set any cookies?**

No. The widget never writes to `document.cookie`, and no widget response sets a cookie. It uses `localStorage` and `sessionStorage` only — the five keys listed above.

**Does Bookbag track visitors across other websites?**

No. The identifiers the widget stores are scoped to your agent and to the browser that created them. There is no cross-site advertising identifier and no advertising pixel.

**Which consent category should I put Bookbag in?**

Functional / Preferences — the same category most CMPs use for live chat and support tools. Not Statistics, and not Marketing.

**What expiry should I enter for the storage entries?**

`localStorage` has no expiry: it stays until it is overwritten, until the widget deletes it, or until the visitor clears site data. `sessionStorage` is cleared automatically when the browser tab closes. Enter "persistent" and "session" respectively rather than inventing a day count.

**Will blocking the script break anything?**

No. The widget is entirely inert until its script executes. If you block it, no bubble appears and nothing is stored or transmitted.

**A visitor asked me to delete their chat. What do I do?**

Delete the conversation from [Activity & chat logs](/docs/agents/activity), and delete any lead record it produced. The copy in their own browser is removed when they click "New chat" in the widget menu or clear site data.

**Is Bookbag "GDPR certified" or "CCPA certified"?**

No such certification exists, for Bookbag or anyone else. Compliance is a property of how *you* deploy and document the service, supported by the contractual terms between you and Bookbag. Treat any vendor claiming to be "GDPR certified" with suspicion.

## Questions this page does not answer

For anything about Bookbag's own contractual and organisational posture — a data processing agreement, the sub-processor list, hosting regions, transfer mechanisms, retention schedules, or security documentation — contact [legal@bookbag.ai](mailto:legal@bookbag.ai). We would rather send you the current answer than have this page state a stale one.

## What's next

- [Website widget](/docs/deploy/web-widget) — The embed snippet, install guidance, and widget settings.
- [HIPAA & Zero Data Retention](/docs/workspace/hipaa) — Redaction, automatic purge, and audited access on Enterprise.
- [AI trust & guardrails](/docs/agents/ai-trust) — Constrain what your agent will and will not discuss.
- [Identity verification](/docs/developers/identity-verification) — Pass a signed, verified user identity into the chat.