Last updated: October 26, 2026
1. What are cookies?
Cookies and similar technologies (localStorage, sessionStorage, first-party HTTP cookies) are small pieces of data stored by your browser. NOVIXAGENT uses them to operate the NovixAgent AI widget, the customer dashboard and this marketing website, and, on the marketing site and only with your consent, for analytics and marketing.
2. We do not use advertising or cross-site tracking cookies
We do not use third-party advertising cookies, retargeting pixels, or cross-site behavioural tracking; the one third-party player on the site, YouTube, loads only when you press play (see Video). We do not sell browsing behaviour. Our marketing site uses Google Analytics 4 configured with Google Consent Mode v2: the Google Analytics script is not loaded at all until you accept Analytics cookies, so before that nothing is requested from Google and nothing is sent to it, and analytics cookies are set only after you opt in. IP addresses are anonymised and Google advertising / ad-personalisation signals are disabled, so it is not used for cross-site advertising.
3. Widget — strictly-necessary storage
The chat widget needs the following entries to function. They are placed without prior consent because they are strictly necessary under ePrivacy Directive Article 5(3).
3.1 Inside the chat window (our domain)
| Entry | Storage | Lifetime | Purpose |
|---|---|---|---|
ag_chat_state |
localStorage | Persists until you clear it | Preferred language, speech-to-text language, a flag recording that you closed the legal notice, welcome-screen view count. An earlier version of the widget also stored a browser id in this entry; the current widget stores none, never reads one, and never sends one — the identifier it uses is the session fingerprint fp-visitor-id below. A value that older build left behind stays in your own browser until you clear it, and we neither read it nor remove it. The flag records only that the notice was closed; it is not a record of consent |
fp-visitor-id |
sessionStorage | Browser session | Pseudonymous device fingerprint. Used for rate limiting and abuse prevention; additionally used to count distinct visitors for the site you are on, but only where that site has declared a basis for it. The counting identifier is derived separately per website, so it cannot link you across sites. Global Privacy Control refuses both uses, and a site owner may switch the signal off for their embed entirely; in either case no fingerprint is taken and this entry is not written. See section 2B of our Privacy Policy |
fp-token |
sessionStorage | Browser session | Server-signed fingerprint token for abuse prevention |
rate-limit-timestamps |
sessionStorage | Browser session | Timestamps of recent messages for client-side rate limiting |
novixagent_session_id:<websiteId> |
sessionStorage | Browser tab session | A random identifier for the current tab's chat session, so that several requests in one conversation are recognised as the same conversation. It is generated in your browser, holds no personal data, and a new tab starts a new one |
novixagent_unsent_messages:<websiteId> |
sessionStorage | Browser tab session | Messages you typed that could not be sent, held only long enough to send them when the connection returns — on a phone a dropped connection otherwise loses the message silently. They are your own words, kept on your own device and not sent to us until the message actually goes. At most ten are held, each stops being retried after five minutes, and closing the tab discards them |
Blocking this storage does not stop the widget, which keeps working for the page you are on, but chat-session continuity across a reload, rate-limit enforcement, and abuse prevention rely on it.
3.2 On the embedding website's own domain
The chat button is drawn on the page itself, outside the chat window, by a small launcher script. That script writes two entries, and only these two, into the storage of the website you are visiting. They exist purely as frequency limits on proactive invitations to chat: they enforce "at most one invitation per day in this browser" and "no invitation in a tab where you have already opened the chat", so they can only reduce what the widget shows you. That is why they fall under the same strictly-necessary basis as the entries above — without them the cap could not be honoured.
| Entry | Storage | Lifetime | Purpose |
|---|---|---|---|
novixagent:proactive:v1:<websiteId>:chat-opened |
sessionStorage | Browser tab session | True/false flag marking that the chat was already opened in this tab, so the widget doesn't invite you again during the same visit |
novixagent:proactive:v1:<websiteId>:last-fired-at |
localStorage | Persistent | Timestamp of the last proactive invitation, so at most one is shown per day in this browser |
They hold no personal data — one boolean and one timestamp. No message content, contact details, visitor or device identifier, page address, or pointer data is written to the embedding site's domain. <websiteId> identifies the website, not the visitor. If the browser blocks storage, both are skipped and the widget still works.
Website owners who prefer no storage on their own domain can switch proactive invitations off for their embed with the attribute data-proactive="false" (see the installation guide); the launcher then writes neither entry.
4. Marketing site — consent-gated storage
The marketing site at novixagent.ai shows a consent banner the first time you visit, where you can accept or decline each category individually.
Strictly necessary (placed without a consent choice)
| Entry | Storage | Purpose |
|---|---|---|
cookieConsent |
localStorage | Your consent choices, so we don't ask again |
theme |
localStorage | Your light / dark theme preference |
novix_exit_intent_v2 |
sessionStorage | Marks the exit-intent modal as already-shown in this browser tab so it doesn't re-fire on the same visit |
novix_exit_intent_cooldown_v2 |
localStorage | Suppresses the exit-intent modal for 7 days after you dismiss it, or 30 days if you opened the linked tool |
| Cloudflare Turnstile | Cloudflare's own frame (challenges.cloudflare.com) |
Bot check on the contact form, on the ROI calculator's request to email you a projection, and on the newsletter sign-up in the footer, where that sign-up is shown. Loaded without a consent choice wherever one of those forms is shown, because the form cannot be protected otherwise. It runs in a frame on Cloudflare's own domain, so anything it keeps there is kept by Cloudflare under its own policy, which describes the signals Turnstile collects as strictly necessary for detecting bots and lists them as the client IP address, TLS fingerprint, User-Agent header and site key with its origin; what you type into the form is not among them |
We run our own chat widget on this site, loaded without the attribute that switches proactive invitations off, so the two launcher entries described in section 3.2 — novixagent:proactive:v1:<websiteId>:chat-opened and …:last-fired-at — are written here too, on novixagent.ai's own domain, whenever that widget's settings invite you to chat. They are listed there rather than repeated here, and they hold what section 3.2 says they hold: one boolean and one timestamp, no personal data.
Analytics (placed only if you accept Analytics)
| Entry | Storage | Provider | Purpose |
|---|---|---|---|
_ga, _ga_* |
cookies | Google Analytics 4 | Aggregated traffic measurement (pageviews, sessions). Set only after you accept Analytics (see section 2). IP anonymised, ad-personalisation signals off. |
formbricks-js |
localStorage | Formbricks Cloud (app.formbricks.com) by default; a self-hosted origin can be substituted by configuration |
The survey tool's own state, holding the identifier it recognises this browser by, for survey deduplication and progress — used by the exit-intent survey and the in-product "Feedback" button. The survey tool sets no cookie. The Feedback button itself works even without analytics consent because clicking it is your explicit request to send feedback; the entry is written only after the click, and it is removed when you withdraw Analytics consent. |
novix_formbricks_cooldown_v1 |
localStorage | — (written by us, not by Formbricks) | Records that you closed a survey, so you are not shown another for 7 days. Written only when you close a survey that was shown after you accepted Analytics. |
Analytics — a note on the customer dashboard
The tables above cover the widget and this marketing site. The customer dashboard (where account holders log in to manage their sites) is a separate application with its own storage. It places no analytics storage on your device, so it asks for no analytics consent.
The record of which features an account holder uses is kept on our own servers. The dashboard builds each record in the browser and posts it to our own service, with no other company's code involved; from our servers the records are forwarded to our analysis tool. The dashboard sets no analytics cookie, writes no analytics storage and places no identifier for measurement on your device, so this page has no analytics entry for it and no consent to ask for. What the record is, our basis for it and how to object are in section 5.4 of our Privacy Policy.
The dashboard has no session replay and no click recording. An earlier version offered a browser recorder behind a consent question; the recorder and the analytics library that ran it have been removed, so the dashboard places neither the library nor its ph_*_posthog identifier. A browser that used that version may still hold what the recorder wrote, and the dashboard takes it back: the next time you open it, it deletes from your browser's storage the entries the recorder left — its identifier, its own opt-out flag, its per-window markers — together with the cookieConsent record of the answer given to the withdrawn question. That cookieConsent is the dashboard's own entry, on the dashboard's domain; the marketing site's cookieConsent, listed further up this page, is on a different origin and is not affected. The recorder also kept a copy of its identifier in a cookie on our domain. Our service removes that one: when the cookie arrives with a request from the dashboard, the response instructs your browser to delete it, so it goes the next time you open the dashboard. If you do not return, it expires by itself a year after it was written; clearing this site's cookies removes it at once.
What the dashboard does store is what it needs to work: the settings you made, and two markers the software writes for itself, one so that a reload onto a new version does not repeat and one so that an install offer you closed is not shown again.
| Entry | Storage | Provider | Purpose |
|---|---|---|---|
| Session and anti-forgery cookies | cookies | — | Keeping you signed in, and proving a request came from the dashboard rather than another site. |
| Cloudflare Turnstile | Cloudflare's own frame (challenges.cloudflare.com) |
Cloudflare | Bot check on the dashboard's email sign-up page only. It runs in a frame on Cloudflare's own domain, so what it keeps there is kept by Cloudflare under its own policy; the dashboard keeps no entry for it on your device. Not shown when you sign in or sign up with Google. |
novixagent-dashboard-theme |
localStorage | — | Your chosen light / dark appearance. |
novixagent-stated-locale |
localStorage | — | The language you picked in the dashboard's language switcher, so the next visit opens in it straight away. |
novixagent-stated-locale-unsynced |
sessionStorage | — | A language you picked in the dashboard's language switcher that your account has not been told about yet, for instance one picked on the sign-in screen, so that it can be saved to your account when you sign in. It holds the language code and the identifier of the account you were signed in to, which is empty before sign-in. It stays in this browser tab, it is removed as soon as your account has the language or when you sign out, and it is discarded when the tab closes. |
novixagent-dashboard-selected-website |
localStorage | — | Which of your own workspaces is open, so the dashboard reopens on it. |
novix.livechat.notif, novix.livechat.push, live-chat:sound-enabled |
localStorage | — | Whether you asked for notification of a new conversation, whether push is on, and whether the sound plays. Turning push on also registers a service worker and a browser push subscription; the subscription's delivery address is sent to our service so it can notify you, and turning push off deletes it. |
novixagent.tour.v1:* |
localStorage | — | That you have finished a guided tour, so it is not shown again. |
imp-banner-collapsed |
sessionStorage | — | Whether the banner announcing an audited support session is collapsed. Written only while one of our support staff is working in the account under that flow, on the device of whoever is looking at the banner, and discarded when the tab closes. |
novix.app.reload-attempt |
sessionStorage | — | The time this browser tab last reloaded itself onto a newly deployed version of the dashboard. It is not a setting you made: it is what stops the reload from repeating. It holds one timestamp, it is never sent anywhere, and it is discarded when the tab closes. |
novixagent.install.v1 |
localStorage | — | Whether this browser has already been shown the offer to install the dashboard as an app, and whether you turned it down. It holds one of two words, with no identifier, timestamp or account, it is never sent anywhere, and once you have closed the offer it keeps the offer from being shown again in this browser. |
novixagent.timeZone.keptOnDevice |
localStorage | — | The time zone this device reported when you chose to keep your profile's time zone instead of switching to the device's. It holds the name of one time zone and nothing else, it is never sent anywhere, and it is what keeps that question from being asked again until this device reports a different zone. |
novixagent.integrations.sheet.width.v1 |
localStorage | — | Whether you chose the wide or the compact layout for the integrations side panel, so the panel opens the way you left it. It holds one of two words, with no identifier, timestamp or account. |
None of these is an identifier for measurement, and none of them is placed in order to observe you. They divide in two. Three of them travel, because travelling is what they are for: the session cookie is sent to our own service with the dashboard's requests — that is what keeps you signed in — the anti-forgery cookie goes with it so the service can tell a request made by the dashboard from one made by another site, and the workspace you last had open is sent with the requests that ask our service for that workspace's data, because the screen has to name which one to load. They go to our own service and nowhere else. The rest stay where they are written, with the two exceptions named next: your appearance choice, the stored copy of your language choice, your notification and sound choices, the finished tour, the collapsed banner, the reload marker, the install offer's answer, the time zone you chose to keep and the width you chose for the integrations panel are read only by the dashboard running in your browser, and our service does not receive them. The first exception is the language pick your account has not been told about yet: it is held in this tab and sent to our service when you register or sign in, so that it is saved to your account. The second is push: turning on push notifications also sends the browser's push subscription to our service, as the table says. The language choice itself is also saved to your account on our own service when you make it. All of them are strictly necessary for the service you asked for under Article 5(3) of the ePrivacy Directive, which is why the dashboard shows no consent banner.
The chat widget on customer websites does not contact our analysis tool.
Marketing (placed only if you accept Marketing)
| Entry | Storage | Provider | Purpose |
|---|---|---|---|
_fprom* (the vendor's documentation names _fprom_ref, _fprom_tid, _fprom_track, _fprom_code and _fprom_signup) |
cookies | FirstPromoter | Partner attribution — remembers which partner's link brought you here, so that the partner can be credited if you subscribe |
fprom_* (the vendor's documentation names fprom_tid, fprom_ref and fprom_details) |
cookies | FirstPromoter | The same purpose, under the second spelling that the vendor's script documentation uses for the visitor identifier and the click details |
FirstPromoter's tracker script is requested from cdn.firstpromoter.com only after you accept Marketing. Before that, this site makes no request to FirstPromoter and places no tracker cookie. Once you have accepted, a visit through a partner's link is recorded by the script, which places the cookies.
If you later subscribe, the customer dashboard reads the visitor identifier from these cookies when you pay, if your browser holds them at that moment, and passes it with the payment to our payment processor, Stripe. FirstPromoter reads it there, through a connection to our Stripe account that is set up in FirstPromoter's own settings and not by our software, so that it can credit the partner who sent you. If you do not accept Marketing, the script is not loaded, no partner's link is recorded, and no partner is credited through a link. Withdrawing Marketing removes these cookies from this browser; a page that is already open keeps the script until you reload it.
FirstPromoter's documentation names cookies only, and the table lists what it names. The cookies are set by FirstPromoter's own script, so their expiry date is the one the script chooses. The window in which we credit a click is 90 days; it is a setting of our FirstPromoter campaign, not of our own software. A partner who invites a client by email from the partner programme is credited through that invitation, which uses no cookie.
Video (placed only if you press play)
The product tour on our home page is hosted on YouTube. The player is not loaded when the page opens — until you press play there is only a still image, and nothing is requested from YouTube or Google. Pressing play does two things: it loads the video itself from youtube-nocookie.com, YouTube's privacy-enhanced mode, which does not set advertising or profiling cookies for that view, and it fetches YouTube's player script from www.youtube.com, which is an ordinary Google domain rather than the privacy-enhanced one. Either may write storage that YouTube needs to play the video and count the view.
| Entry | Storage | Provider | Purpose |
|---|---|---|---|
| YouTube player storage | cookies / local storage on youtube-nocookie.com and on www.youtube.com |
YouTube (Google) | Playing the video and remembering player preferences, once you press play |
5. Managing cookies
You can control or delete cookies and browser storage:
- In the widget — clear your browser's storage for the site where the widget is embedded and for the widget's own domain (browsers that partition third-party storage clear the two together). The widget will start a fresh session next visit.
- On the marketing site — use the "Manage cookie preferences" button on our
/cookiespage (linked as "Cookies" in the footer) to re-open the consent banner and change your choices. Revoking a category clears the relevant cookies on the spot. - In the customer dashboard — the dashboard places no analytics storage, so there is no analytics consent to manage. If you used the version that offered the browser recorder, the recorder's cookie described in section 4 may still be on your device: our service deletes it the next time the dashboard contacts us, and clearing this site's cookies removes it at once. The one related control, Account → Product usage counting, is saved to your account rather than to your device: it is an objection rather than a consent, and it applies to your account on each device you sign in from.
- In your browser — browsers let you delete cookies and storage globally; the steps vary by vendor. Disabling strictly-necessary storage does not stop the widget, but a conversation then starts over when the page reloads.
6. Changes to this policy
If we add a new sub-processor or change a cookie's lifetime we revise the "Last updated" date at the top and publish the change on this page.
7. Contact
Questions about cookies and storage? Email support@novixagent.ai.