1. Two different website contexts
This policy is provided by Mahdi Group Ltd. It distinguishes our own account website from installations on a customer's domain. The customer's privacy/cookie notice and enabled installation determine the processing on that domain; this page is not a substitute for its disclosures.
Cookies and local/session storage can remember sign-in, privacy choices, chat state and random visit continuity. Some essential functions operate at the user's request. Optional purposes require the applicable permission; owner activation alone is not visitor consent. This policy does not install a banner or change an existing website's choices.
2. Account website storage
Other enabled services may add their own cookies. An inventory must identify what is actually deployed; an OAuth reporting connection does not itself install Google Analytics or advertising tags on a website.
| Name / technology | Purpose | Lifetime / removal |
|---|---|---|
| convertai-auth-token (cookie) | Lets route protection recognise an account session. It contains authentication material; do not share it. | Session cookie, cleared on logout. The associated token also has its own expiry. |
| convertai-auth (local storage) | Persists account sign-in and workspace state for the requested account service. | Browser storage persists until logout, application changes or browser clearing; the token's own expiry still applies. |
3. Customer installation technologies
These are product technologies, not a declaration that every listed item is present on every page or is automatically exempt from consent. Consent receipts are server records, not cookies; their default retention is 365 days and is separately configurable.
| Name / technology | Purpose | Scope and duration |
|---|---|---|
| convertai_consent:<website> (local storage) and convertai_cc_ui (cookie) | Native consent policy revision and preferences. Receipt references are random, not a lead identity. | A remembered choice defaults to 180 days, subject to the configured policy and a material-purpose change. |
| convertai_recording_visit:<website>:<visit> (local storage) | Random website-visit continuity and activity timestamps for multi-page recordings and participating features. | Website and origin scoped. Visit continuity expires after 30 minutes of inactivity; stale storage is removed on later runtime access, not necessarily at the exact expiry while the browser is closed. |
| convertai_recording_tab (session storage) | Distinguishes tab tracks within recorded visits without combining bot answers. | Tab session, subject to browser session restoration behaviour. |
| Other bot state and coordination storage | Independent conversation state, duplicate-capture coordination and approved-prompt suppression where applicable. | Depends on the installed feature and version; customer audits must report the actual names and lifetime. |
4. Optional purposes and Google tags
- Google analytics, session recordings, browsing-journey insights, helpful suggestions, advertising measurement and advertising personalisation are separate purposes when configured.
- Helpful suggestions need journey permission and separate personalisation permission, plus an approved prompt policy. Refusing optional purposes does not automatically prevent manually requested chat or ordinary enquiry submission.
- In native managed mode, Google Consent Mode v2 uses analytics_storage, ad_storage, ad_user_data and ad_personalization. Basic mode is the default; consent defaults must run before the relevant managed tags.
- Existing-banner adapters require explicit mapping and disclosure. A generic analytics or advertising choice must not silently grant recordings, profiling or suggestions. An unsupported or disabled banner cannot be treated as acceptance.
- Independently executed scripts, CMS plugins and GTM tags are not reliably blocked by a late snippet. Their ordering and consent triggers must be configured and checked separately. A successful audit is not a legal-compliance certificate.
5. Making and withdrawing choices
Use the site's actual Cookie settings or Privacy choices control where a banner is installed. Optional choices should be off until selected; closing or ignoring a banner is not acceptance. Refusing one purpose should not silently grant another. You can also clear or block storage through your browser, which can sign you out or reset requested functionality.
Withdrawing permission stops the affected new managed processing and applies the relevant identifier/evidence removal. It is not a promise that every independently executed vendor tag, submitted enquiry, legal record or backup is immediately erased. Existing customer installations must be checked rather than assumed to be consent-managed.
For our own site's privacy questions, contact hello@convertai.one. For another business's website, use its privacy contact. Its cookie inventory and actual controls depend on what that business installs and enables.