Widgo, Inc.

Effective date: 25 August 2026 · Last updated: 25 August 2026

This policy explains how Widgo, Inc. uses cookies and similar technologies such as local storage. It covers two separate places: our own website at widgo.ai and app.widgo.ai, and the Widgo widget when it runs on a customer's website.

1. On the Widgo widget, on our customer's website

When the widget loads on a company's website, it writes a small amount of data to the visitor's browser. This is done on that company's behalf. That company, not Widgo, is the controller and decides whether the widget runs and under what consent conditions.

• Widget visitor identifier. Type: Local storage Purpose: Recognises a returning visitor so a conversation continues where it left off, and so the same person is counted once against the site owner's monthly allowance rather than repeatedly Duration: 12 months

• Conversation state. Type: Local storage Purpose: Keeps the open conversation, its position and its unread state across page navigations Duration: Session, cleared when the conversation ends

• Human verification flag. Type: Local storage Purpose: Records that a visitor has already completed the one-time verification step, so they are not asked again. Free plan only Duration: 12 months

• Security and rate limiting. Type: Cloudflare cookies (__cf_bm, cf_clearance) Purpose: Distinguishes humans from bots, blocks abuse, and applies rate limits to protect the widget endpoints Duration: Up to 30 minutes for __cf_bm, up to 1 year for cf_clearance

The widget does not set advertising cookies, does not use third-party tracking pixels, and does not follow visitors across unrelated websites.

Company identification does not use cookies. It works by matching the visitor's IP address against licensed IP intelligence data at the moment of the request, at company level only. Blocking cookies does not disable it. A visitor who does not want their organisation identified should raise that with the website operator, who controls whether the feature is on.

For website operators

You decide how the widget interacts with your consent banner. Two positions are common:

• Load and answer, defer identification. Let the widget load so it can answer questions, and hold company identification until the visitor has consented to analytics. This keeps the assistant useful without processing identification data before consent.

• Block until consent. Do not load the script at all until the visitor accepts. Simplest to defend, at the cost of a chat widget that is missing on first visit.

Whichever you choose, the choice and its consequences are yours. Section 7 of the Terms of Service and section 5 of the DPA set out your responsibilities here.

2. On widgo.ai and app.widgo.ai

• Strictly necessary. What it does: Signs you in, keeps your session, remembers your workspace, protects against abuse Examples: Stack Auth session cookies, Cloudflare security cookies, CSRF tokens Can you turn it off: No. The product does not work without them

• Preferences. What it does: Remembers interface choices such as theme and dismissed banners Examples: Local storage keys set by the app Can you turn it off: Yes, by clearing site data

• Analytics. What it does: Tells us which features are used, where people get stuck, and what errors occur Examples: PostHog, Google Analytics via Google Tag Manager Can you turn it off: Yes, through the consent banner where shown, or through browser controls

• Performance and error monitoring. What it does: Records latency, failures and traces so we can fix problems Examples: Datadog Can you turn it off: Partly. Server-side monitoring continues, as it is necessary to operate the Service

We do not run advertising cookies and we do not sell or share data for cross-context behavioural advertising.

3. Managing cookies

Every major browser lets you block or delete cookies and clear local storage, usually under privacy or site settings. Blocking strictly necessary cookies will break sign-in.

Where a consent banner is shown to you, your choice is recorded and you can change it at any time from the link in the footer.

Global Privacy Control and similar browser signals are honoured as an opt out of sale or sharing where applicable law requires it. As noted above, we do not sell or share data in any case.

4. Changes

We update this policy when the technologies we use change. The effective date at the top always reflects the current version.

Questions: support@widgo.ai