Privacy, cookies & compliance

If you run the Bookbag chat widget on your website, you almost certainly have to name Bookbag somewhere — in a cookie banner, a consent management platform (CMP), a privacy policy, or all three. This page gives you the facts to do that accurately, plus text you can copy straight into your own documents.

It is written for the person filling in the form: a shop owner in the EU adding a service to Borlabs or Usercentrics, or a US merchant adding a "third parties we share data with" row to their privacy policy.

The short version

• Bookbag sets no cookies. The widget never writes to document.cookie, and no widget response sets a cookie. Many consent managers assume "third-party script = cookie" — that assumption is wrong here, and it changes how you categorise us.
• Bookbag does use browser storage. It writes a small number of localStorage and sessionStorage entries. Under the EU ePrivacy rules, storing or reading information on a user's device is regulated whether or not it is technically a cookie, so these still belong in your disclosure.
• The purpose is functional. The entries cache the widget's appearance and keep a visitor's chat going across page loads. None of them are advertising or cross-site tracking identifiers, and Bookbag does not use them to build advertising profiles.
• Bookbag is your processor for conversation data. Your visitors talk to your agent; Bookbag processes those conversations on your behalf and under your instructions.
• Service name: Bookbag · Provider: Bookbag Inc. · Privacy policy: https://bookbag.ai/legal/privacy

What Bookbag stores in the browser

The widget has two parts, and they store data in two different places. Knowing which is which matters, because most CMPs ask you to declare storage per domain.

1. 1The loader script (https://app.bookbag.ai/widget/embed) runs on your page, so anything it stores is first-party storage on your domain.
2. 2The chat panel is an iframe served from https://app.bookbag.ai/widget/frame, so anything it stores is third-party (partitioned) storage on the Bookbag origin — or on your own domain if you use a custom domain.

Storage written on your domain (by the loader script)

Storage written on the Bookbag chat origin (inside the chat iframe)

When the storage is written

Consent managers usually want to know whether anything is stored before the visitor interacts. Precisely:

• On page load, with the widget installed: the loader reads bb_cfg_<agentId> to render the bubble instantly, fetches the agent's public configuration from Bookbag, and writes the refreshed configuration back to bb_cfg_<agentId>. This happens without any visitor interaction.
• When the visitor opens the chat: bb_widget_opened_<agentId> is set, and the chat iframe loads.
• When a proactive popup is shown: bb_widget_opened_<agentId>_teaser is set.
• When the visitor sends a message: bb_chat_<agentId> is created and updated as the conversation continues.
• When the visitor dismisses the in-chat notice: bb_chat_<agentId>_nx is set.

What data leaves the browser

Separately from browser storage, your privacy notice should describe what is transmitted. With the widget installed, the visitor's browser communicates with Bookbag as follows:

As with any HTTP request, the visitor's IP address and user-agent string are transmitted to the receiving server as a technical necessity.

Paste-ready consent-manager disclosure

Most CMPs ask for the same handful of fields. Here they are, filled in:

And the same thing as a block of text you can paste into a free-text service description:

Bookbag

Provider: Bookbag Inc.
Category: Functional / Customer support

Purpose: We use Bookbag to provide the chat assistant on this website. It
answers visitor questions and, where offered, passes a request on to our
support team. Bookbag processes the messages you send in the chat on our
behalf.

Technologies used: local storage and session storage. Bookbag does not set
any cookies.

Stored entries:
  bb_cfg_<agentId>                    | localStorage    | widget appearance cache | persistent
  bb_widget_opened_<agentId>          | sessionStorage  | chat already opened this session | session
  bb_widget_opened_<agentId>_teaser   | sessionStorage  | popup already shown this session | session
  bb_chat_<agentId>                   | localStorage    | ongoing conversation and recent messages | persistent, until the chat is reset
  bb_chat_<agentId>_nx                | sessionStorage  | in-chat notice dismissed | session

Data processed: chat messages, conversation identifiers, any details you
enter into a chat form, IP address, browser user-agent.

Privacy policy: https://bookbag.ai/legal/privacy

Setting Bookbag up in your consent manager

The five tools below cover most merchant setups. In every case the pattern is the same: register Bookbag as a functional service, record the storage entries, and make sure the embed script does not run before consent if your policy requires prior consent.

Cookiebot (Usercentrics Cookiebot CMP)

1. 1
   Let the scanner run, then correct it

   Cookiebot's scanner reports local storage under "Unclassified" because it cannot infer a purpose. Open Cookie declaration → Unclassified and move each bb_ entry into Preferences (functional).
2. 2
   Add the entries manually if the scanner missed them

   Under Manage cookies → Add cookie, add each key from the table above with type "HTML Local Storage" or "HTML Session Storage" and the matching domain.
3. 3
   Block the script until consent

   Change the embed to data-cookieconsent="preferences" and type="text/plain" so Cookiebot activates it only after the Preferences category is accepted.

<script
  src="https://app.bookbag.ai/widget/embed"
  data-agent-id="YOUR_AGENT_ID"
  data-cookieconsent="preferences"
  type="text/plain"
  defer
></script>

Usercentrics (CMP v2 / Web CMP)

1. 1
   Search the Data Processing Services catalogue

   Open Configuration → Services and search for "Bookbag". If there is no catalogue entry yet, create a Custom Data Processing Service.
2. 2
   Fill in the service

   Name: Bookbag. Processing company: Bookbag Inc. Category: Functional. Data purposes: Provide the on-site chat assistant. Technologies used: Local storage, Session storage. Privacy policy URL: https://bookbag.ai/legal/privacy.
3. 3
   List the storage entries

   Add each bb_ key from the table above with its type and duration. Usercentrics has explicit "Local Storage" and "Session Storage" options — use those rather than "Cookie".
4. 4
   Wire up script blocking

   Give the embed script type="text/plain" and the data-usercentrics attribute set to the service name you created, so it only executes once that service is consented to.

<script
  src="https://app.bookbag.ai/widget/embed"
  data-agent-id="YOUR_AGENT_ID"
  type="text/plain"
  data-usercentrics="Bookbag"
  defer
></script>

Borlabs Cookie (WordPress / WooCommerce)

Borlabs is the most common CMP on German WordPress and WooCommerce shops. Bookbag has no prebuilt Borlabs template, so add it as a custom service.

1. 1
   Create the service

   Go to Borlabs Cookie → Cookies (Services), pick the "Preferences" / "Funktionell" group, and click Add new. Choose the Custom / Benutzerdefiniert template.
2. 2
   Fill in the details

   Name: Bookbag. Provider / Anbieter: Bookbag Inc. Purpose / Zweck: paste the German block above. Privacy policy URL: https://bookbag.ai/legal/privacy. Cookie name: leave the cookie fields empty and note in the description that Bookbag uses local and session storage rather than cookies — or list the bb_ keys there so they still appear in your declaration.
3. 3
   Add the opt-in code

   Put the embed <script> tag in the service's "Opt-in code" box. Borlabs injects it only after the visitor accepts the Preferences group.
4. 4
   Reference it in your shortcode

   If you place the widget through a page template, wrap it in the Borlabs content blocker shortcode for the service so it is not rendered before consent.

OneTrust

1. 1
   Add Bookbag to the cookie/tracker inventory

   In Cookie Compliance → Categorizations, add the bb_ entries with the tracker type "Local Storage" or "Session Storage" (OneTrust supports both alongside cookies) and assign them to your Functional category.
2. 2
   Record the vendor

   Add Bookbag Inc. to Vendors with the privacy policy https://bookbag.ai/legal/privacy and the purpose "on-site chat assistant / customer support".
3. 3
   Enable auto-blocking or manual blocking

   Either add app.bookbag.ai to the auto-blocking rules for the Functional category, or convert the embed to a class-based OneTrust script so it executes only after consent.

<!-- class="optanon-category-C0003" = Functional, adjust to your category ID -->
<script
  src="https://app.bookbag.ai/widget/embed"
  data-agent-id="YOUR_AGENT_ID"
  type="text/plain"
  class="optanon-category-C0003"
  defer
></script>

Shopify — the Customer Privacy API

Shopify stores that use the built-in cookie banner (or an app that integrates with it) can gate the widget with Shopify's Customer Privacy API. Bookbag falls under the preferences purpose. Add the snippet below to your theme instead of the plain embed tag: it loads the widget when the visitor has already consented, and listens for the consent event so the widget appears immediately if they accept afterwards.

<script>
  (function () {
    var loaded = false;
    function loadBookbag() {
      if (loaded) return;
      loaded = true;
      var s = document.createElement('script');
      s.src = 'https://app.bookbag.ai/widget/embed';
      s.setAttribute('data-agent-id', 'YOUR_AGENT_ID');
      s.defer = true;
      document.body.appendChild(s);
    }
    function allowed() {
      var api = window.Shopify && window.Shopify.customerPrivacy;
      return !!(api && api.preferencesProcessingAllowed && api.preferencesProcessingAllowed());
    }
    if (allowed()) loadBookbag();
    document.addEventListener('visitorConsentCollected', function (e) {
      if ((e.detail && e.detail.preferencesAllowed) || allowed()) loadBookbag();
    });
  })();
</script>

Blocking the widget until consent

If none of the above applies — or you use a CMP not listed here — the general rule is simple: the widget does nothing until its script runs. There is no pixel, no beacon, and no fallback request. So the only thing you have to control is whether the <script> tag executes.

• Do not render the tag server-side until consent is stored, or
• Neutralise the tag with type="text/plain" plus your CMP's activation attribute, or
• Inject it from JavaScript in your CMP's "on consent" callback, exactly as in the Shopify snippet above.

GDPR (EU/EEA and UK)

Who is controller and who is processor

For the conversations that happen on your website, you are the controller and Bookbag is the processor. Your visitors are talking to your agent, trained on your content, to get help with your products; Bookbag processes those messages on your instructions in order to provide the service.

• You decide which agent is deployed, what knowledge it has, whether it collects leads, whether voice is enabled, and whether identity verification passes customer data through.
• Bookbag processes the messages, conversation records, and any lead data your agent collects, in order to run the agent and show you the results.
• Bookbag is a controller only for its own relationship with you as a customer — your account, billing, and support correspondence. That is covered in Bookbag's privacy policy.

Lawful basis and consent

Two separate questions come up, and it helps to keep them apart:

1. 1Storing and reading data on the device (ePrivacy / Article 5(3) of the ePrivacy Directive, as implemented locally — e.g. § 25 TDDDG in Germany). This is about the localStorage and sessionStorage entries listed above. Some supervisory authorities accept that storage which is strictly necessary to deliver a service the user explicitly requested is exempt from consent; others take a narrower view, and the widget writes bb_cfg_<agentId> on page load rather than on interaction. Many merchants therefore place Bookbag behind a functional / preferences consent category. That is a decision for you and your counsel.
2. 2Processing the personal data in the conversation itself (GDPR Article 6). Merchants commonly rely on legitimate interests (Art. 6(1)(f)) for providing customer support, or on performance of a contract (Art. 6(1)(b)) where the chat is part of fulfilling an order. If your agent collects leads for marketing purposes, you will usually need consent (Art. 6(1)(a)) for that marketing use.

Data subject requests

Because you are the controller, requests from your visitors come to you. Bookbag gives you the tools to answer them:

• Access / portability — find the conversation in Activity & chat logs and export it; leads can be exported from the leads list.
• Erasure — delete the conversation and any associated lead record from the dashboard. A visitor can also delete their own local copy by clicking New chat in the widget menu, which removes bb_chat_<agentId> from their browser.
• Rectification and objection — handled by you in the dashboard, since you control the records.
• Requests that need Bookbag's help — write to legal@bookbag.ai.

Data processing agreement (DPA)

Article 28 GDPR requires a written processor agreement between you and Bookbag. TODO: confirm whether Bookbag publishes a standard DPA and, if so, link it here. Until that is confirmed, contact legal@bookbag.ai to put a data processing agreement in place — do not assume one is included by default.

• TODO: sub-processors. Article 28(2) requires you to be informed of sub-processors. Bookbag does not currently publish a sub-processor list; ask for the current list before you complete your own record of processing activities.
• TODO: hosting location and international transfers. Confirm where conversation data is stored and which transfer mechanism (e.g. Standard Contractual Clauses, EU-US Data Privacy Framework) applies before describing transfers in your privacy notice.
• TODO: retention. Confirm how long Bookbag retains conversation records by default. (Documented exception: on Enterprise workspaces with HIPAA / Zero Data Retention enabled, conversations auto-end after 24 hours idle or 7 days of age and their content is irreversibly purged.)
• TODO: EU representative. If you need an Article 27 EU representative for Bookbag, request the details.

United States — CCPA/CPRA and the state privacy laws

US state privacy laws (California's CCPA as amended by the CPRA, plus Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the rest of the growing list) work differently from the GDPR, but the practical obligations for a merchant running a chat widget are similar: say what you collect, say who you share it with, and honour opt-outs.

Bookbag is a service provider, not a third-party seller

Under the CCPA/CPRA, a vendor that processes personal information solely to perform services on your behalf — and is contractually restricted from using it for its own purposes — is a service provider, not a third party. Disclosing personal information to a service provider is not a "sale" or a "share" for cross-context behavioural advertising.

• Bookbag processes conversation data to run your agent and show you the results — a service-provider role.
• The Bookbag widget sets no advertising cookies and no cross-site advertising identifiers, so installing it does not by itself create a "share" for cross-context behavioural advertising.
• Your contract has to say so. The service-provider characterisation depends on the written terms between you and Bookbag. TODO: confirm that Bookbag's standard terms include CCPA/CPRA service-provider language, or request an addendum from [legal@bookbag.ai](mailto:legal@bookbag.ai).

What to put in your privacy policy

1. 1Categories collected. Chat transcripts are "internet or other electronic network activity" and, where the visitor types their name or email or you pass it through identity verification, "identifiers" and "customer records".
2. 2Purpose. Providing customer service and responding to inquiries — an enumerated business purpose.
3. 3Categories of recipients. Name Bookbag (and OpenAI, if you have enabled voice) in your list of service providers.
4. 4Sources. Directly from the consumer, through the chat interface.
5. 5Retention. State how long you keep chat records. This is your decision as the business — see the retention TODO above for the platform default.
6. 6Rights. Your existing know / delete / correct / opt-out mechanisms cover chat data; make sure your deletion workflow includes deleting conversations from Bookbag.

Do Not Sell or Share

If your site displays a "Do Not Sell or Share My Personal Information" link or honours Global Privacy Control signals, remember two things:

• Passing chat content to Bookbag as a service provider is not a sale or a share, so an opt-out does not require you to disable the widget.
• If you pipe chat or lead data onward into advertising tools — for example by syncing captured leads to an ad platform — that downstream step can be a sale or a share, and your opt-out must stop it.

Copy-paste privacy-policy paragraph

Drop this into the "third parties" or "service providers" section of your own privacy policy and adjust the bracketed parts.

AI chat assistant (Bookbag)

We use Bookbag, a service provided by Bookbag Inc., to operate the chat
assistant on this website. When you open the chat, Bookbag stores a small
amount of information in your browser using local storage and session
storage - not cookies - so that the chat window renders correctly and your
conversation is still there if you move to another page. When you send a
message, the content of that message, an identifier for the conversation,
any details you enter into a chat form, your IP address and your browser's
user-agent are transmitted to Bookbag so it can generate a reply and, where
necessary, pass your request to our support team.

Bookbag processes this information only on our behalf and under our
instructions, and is not permitted to use it for its own purposes. We do not
sell or share this information for cross-context behavioural advertising.

You can end and delete a conversation at any time by selecting "New chat" in
the chat menu, or by clearing site data in your browser.

Further information: Bookbag's privacy policy is available at
https://bookbag.ai/legal/privacy.

Common questions

Questions this page does not answer

For anything about Bookbag's own contractual and organisational posture — a data processing agreement, the sub-processor list, hosting regions, transfer mechanisms, retention schedules, or security documentation — contact legal@bookbag.ai. We would rather send you the current answer than have this page state a stale one.

What's next