Consent and visitor rights

You can require visitors to agree to storage before the first conversation starts in the chat window. Separately, visitors find their rights over their own conversation under Your data in the chat window: a copy of their data and deleting the conversation, plus withdrawing consent when consent is switched on, with no account and no sign-in. This page covers the setting, the flow in the window, the checks on the service side and the matching endpoints.

Switching consent on

The setting belongs to the assistant. In the app, open Assistants at app.xicbot.de/assistenten, choose the assistant and go to the Chat window on your website section. Members with the Edit role or higher can change it; with the Read role the fields are locked. Save applies the values, after which the section shows Saved. Setting up an assistant is covered in Assistants, roles in Team and roles.

The language of the window is taken first from the data-sprache attribute in the embed code, as long as it starts with de or en. Otherwise the language of the published version applies, falling back to German. The service returns the default wording in that language. Your own wording appears exactly as you entered it, whatever the language. The attribute is described in Script attributes.

The gate in the embed code

With consent switched on, the embed code also carries data-einwilligung="erforderlich". After saving, the app reloads the embed code. The loader reads the gate from this attribute only, not from the setting. If you embedded the code earlier, copy it into your page again: without the attribute, the loader builds the chat window as soon as your page has loaded, and the window fetches its public configuration before your visitor has agreed in your banner. The consent screen in the window still appears in that case. How to embed the code is covered in Embed the widget.

<script src="https://cdn.xicbot.de/einbetten.js" data-xicbot="…" data-api="…" data-einwilligung="erforderlich" defer></script>

With the attribute, the loader only builds the chat window on its own once your page calls window.xicbot.einwilligen(). It keeps this agreement for 180 days in your page’s storage and during that time loads the window on its own on later page views as well. If the storage cannot be written, for instance because it is blocked or full, the agreement applies only to the current page view; on the next page the loader waits for the call again. It also loads it when the visitor, in the chat window on a previous page, confirmed a suggestion to fill in a form on this page; see Form prefill. If the visitor clicks the launcher before that, it loads anyway: a click is a request. Agreement in your banner does not replace consent in the chat window; one is the banner on your page, the other the screen before the first conversation. Connecting your banner is covered in JavaScript and storage.

The consent screen in the chat window

Whether the screen appears is decided by the service: the public configuration of the window contains consent and the wording in consent_text. A page therefore cannot skip the screen by leaving out a field. If consent is required and there is no conversation yet, the window shows the screen with your wording. The input field and the send button stay locked until the visitor agrees. This applies once the assistant has a published version; until then the window locks the input with This assistant is not ready yet.

1. 1

   Step 1

   Agree

   With I agree, start the chat the screen disappears, the input field is unlocked and the window creates the conversation with consent: true. For the consent it sends two further values: as consent_text the wording the screen showed, and as language the same language wish as when it fetched the settings, that is the value of data-sprache. Without the attribute the value stays empty, and, as when fetching the settings, the service uses the language of the published version, falling back to German. If the wording shown matches the current one, the language in which it was shown counts for the check value.

2. 2

   Step 2

   Check on creation

   The service checks this before it creates the conversation: if consent is not exactly true, it answers with 422 consent_missing and no conversation is created. If the wording sent differs from the current consent wording, it answers with 422 consent_changed and returns the current wording as consent_text; again no conversation is created. Differences in whitespace, such as a line break instead of a space, several spaces instead of one or a trailing space, do not count as a difference. The comparison covers the wording in both languages, so a change of the published version’s language between loading and agreeing does not count as changed wording.

3. 3

   Step 3

   Record the consent

   The service stores the time and the check value on the new conversation and returns the conversation ID to the window. All further visitor rights are tied to this ID.

Decline and close sits next to it with equal weight. The window then creates no conversation, locks the input with No conversation without consent. and asks your page to close the window.

Checks on the service side

The chat window checks consent, and the service checks it a second time. It refuses these actions:

Consent is attached to the conversation, not to a value in the browser. Such a value can disappear, and consent tied to it could then neither be shown nor withdrawn. Three fields are stored on the conversation:

Your data: the rights in the chat window

In the header of the chat window, next to the close button, there is a shield icon labelled Privacy. It expands the Your data panel and moves focus to the first button. With Consent before the first conversation switched on, the panel opens with this text:

With consent switched off, the middle sentence reads “You can request a copy or delete the conversation.” The Withdraw consent button is then not shown: without consent there is nothing to withdraw.

If there is no conversation yet, the three buttons report There is no conversation yet. The information names your account as the controller: the operator of the website is responsible, not XICBOT. If the name is missing, it reads “the website operator”.

Access, withdrawal and deletion remain open to a visitor you have blocked. The service checks the block when a conversation is created and when a message is sent, not for these three rights.

What withdrawing consent does

The service records the withdrawal on the conversation before it looks at whether an answer is running. An answer that is being written sees the withdrawal and stops.

• A second withdrawal changes nothing; the first timestamp stays.
• A running answer checks for a withdrawal at most once per second and one last time when it ends. Its text is not saved, and the partial piece disappears from the window. In Conversations, this message is marked consent withdrawn.
• The tokens used up to that point are still booked, because they were actually consumed. How usage is counted is covered in Plans and quotas.
• After that, the conversation accepts no further messages, ratings or attachments from the visitor. The window locks the input; after a stopped answer it reports Consent withdrawn. This conversation is closed.
• Your team can no longer take over a withdrawn conversation, and cannot write into it even after an earlier takeover. The app then reports The visitor has withdrawn consent. Nothing more can be written to this conversation.
• Withdrawal deletes nothing. The messages up to that point remain stored until the conversation is deleted.
• A conversation without recorded consent cannot be withdrawn. The service then answers with 422 without_consent, and the window reports The withdrawal did not go through.

What the information contains

The service returns the information as JSON. It comes from the conversation itself; there is no separate visitor table. The window shows it below the summary in an area that scrolls on its own: every message with sender (You, Assistant, Staff), time and text. The records follow below: enquiries, appointment requests, baskets with items and total, files with size, and the assistant’s steps with their status. Times use the date format of the window language. There is no file to download; the endpoint further down returns all fields.

The retention setting for conversations is covered in Retention and deletion.

Deleting a conversation

Delete conversation removes the conversation and its messages on the service. Deleting does not require a prior withdrawal. The history disappears from the window, and the loader removes the remembered conversation ID from your page’s storage.

• Staying with you: enquiries, appointment requests and baskets handed to you through the chat. They are your own records and only lose their link to the conversation.
• Audit log: before deleting, and within the same transaction, the service writes a Conversation deleted entry to your account’s Audit log, with channel widget, the number of messages and by: visitor. No member of your team is listed as the actor.
• No entry, no deletion: if the log entry cannot be written, the service deletes nothing and answers with 500 not_logged. The window then reports The conversation could not be deleted.

Other ways in which conversations are deleted are covered in Retention and deletion; finding conversations in your account is covered in Conversations.

Endpoints

The three rights live in the public branch of the widget API, which the chat window calls from other websites. There is no sign-in there: the visitor has no account. The rights are therefore tied to the conversation ID that the service returns to the window when the conversation is created. {key} is the widget key from data-xicbot, {conversation} the conversation ID. The other endpoints of this branch are covered in Widget endpoints, the limits in API limits.

Consents in the account export

Only the Owner role may fetch your account export; it is described in Privacy and legal. Its consents part lists every conversation with recorded consent, sorted by the time of agreement, with conversation_id, granted_at, revoked_at and content_hash. The conversations part also carries consent_at and consent_revoked_at on each conversation.

Frequent questions