Cookies Policy
Last updated: 13 September 2026
This Cookies Policy explains how Sant Limited ("Sant", "we", "us", or "our") uses cookies and similar technologies on the sant.chat website and through the Sant Chat AI WordPress plugin (collectively, the "Service").
1. What Are Cookies?
Cookies are small text files placed on your device by a website or application. They are widely used to make websites work efficiently, provide information to site owners, and improve the user experience. Cookies can be "session" cookies (deleted when you close your browser) or "persistent" cookies (remain on your device for a set period or until you delete them).
2. Cookies We Use on sant.chat
We categorise cookies into three groups: Essential (always active), Analytics (which includes session recording), and Marketing. Whether we ask you before loading the analytics group depends on where you are — see Section 5.
2.1 Essential Cookies (Always Active)
These cookies are required for the website to function. They cannot be disabled.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
sb-*-auth-token | Supabase | Authentication — maintains your login session. Contains an encrypted JWT token that identifies your account. | Session / until logout |
sant_cookie_consent | Sant Chat AI | Consent — stores your cookie preferences (essential, analytics, marketing) so we respect your choices on future visits. | Persistent (localStorage) |
2.2 Analytics Cookies
These cookies help us understand how visitors use our website so we can improve it. In the EEA, the UK and Switzerland they are loaded only after you give consent; elsewhere they load without a banner and you can still decline (see Section 5).
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics | Distinguishes unique visitors. Used to calculate visitor, session, and campaign data for site analytics reports. | 2 years |
_ga_* | Google Analytics | Maintains session state for Google Analytics 4. | 2 years |
_clck | Microsoft Clarity | Links a visit to a Clarity user ID so repeat visits from the same browser are recognised. | 1 year |
_clsk | Microsoft Clarity | Joins the page views of a single visit into one session recording. | 1 day |
We configure Google Analytics with anonymize_ip: true to mask the last octet of your IP address before it is stored, reducing the identifiability of individual visitors.
2.2a Session Recording and Heatmaps (Microsoft Clarity)
Microsoft Clarity does more than count visits: it records your session and lets us replay it. It captures the pages you view, every click and tap, how far you scroll, how your mouse moves across the page, and your screen size, browser and approximate location derived from your IP address. Those sessions are also combined into heatmaps showing where visitors click and how far down a page they read.
Microsoft Corporation acts as an independent data controller for Clarity data, not as our processor: it handles that data under its own privacy statement and may use it for Microsoft's own purposes, including advertising-related purposes. In Clarity's default "Balanced" mode, numbers and email addresses are masked; text typed into input boxes and dropdowns is masked in every mode and cannot be unmasked — but we still see how you used the site. Clarity is grouped with analytics above, so declining analytics stops it. It is never loaded by the Sant Chat AI widget on Customer websites.
Microsoft describes what Clarity collects in its Clarity documentation, and your data is handled under Microsoft's Privacy Statement.
Microsoft retains Clarity playback and recording data for 30 days, and labelled or favourited sessions and heatmap data for 9 months. Clarity data is processed in the United States by Microsoft as a controller under its own privacy statement and transfer terms.
2.3 Marketing Cookies (Consent Required Everywhere)
These cookies are used to measure the effectiveness of our advertising campaigns and to enable retargeting. They are only loaded after you give consent, in every country — we do not load them on the basis of your location.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
_fbp | Meta (Facebook) | Identifies browsers for ad delivery and measurement. Used by Meta Pixel to track conversions from Facebook and Instagram ads. | 3 months |
_fbc | Meta (Facebook) | Stores the last click identifier from a Facebook ad click. Used for conversion attribution. | 2 years |
_gcl_au | Google Ads | Stores conversion data from Google Ads clicks. Set by Google Tag Manager when configured. | 3 months |
3. Browser Storage Used by the Chat Widget
The Sant Chat AI widget (installed on Customer websites) does not set any HTTP cookies. Instead, it uses browser-based storage mechanisms to maintain functionality:
3.1 localStorage (Persistent)
| Key | Purpose | Duration |
|---|---|---|
sant_chat_sessions | Stores conversation history so visitors can resume chats across page navigations on the same website | Until manually cleared by the visitor or browser data cleanup |
3.2 sessionStorage (Per-Tab, Temporary)
| Key | Purpose | Duration |
|---|---|---|
sant_session_id | Unique identifier for the current chat session (randomly generated, not personally identifiable) | Until tab/window closes |
sant_greeting_shown | Tracks whether the welcome greeting has been displayed to avoid showing it repeatedly | Until tab/window closes |
sant_chat_history | Current conversation messages for the active session | Until tab/window closes |
sant_message_count | Counts user messages to determine when to trigger lead capture prompts | Until tab/window closes |
sant_lead_name | Stores the visitor's name if voluntarily provided | Until tab/window closes |
sant_lead_email | Stores the visitor's email if voluntarily provided | Until tab/window closes |
sant_lead_phone | Stores the visitor's phone number if voluntarily provided | Until tab/window closes |
sant_proactive_dismissed | Records whether the visitor dismissed the proactive greeting message | Until tab/window closes |
Important: localStorage and sessionStorage are not cookies. They are browser-based storage mechanisms that stay on the visitor's device and are not transmitted to any server with each request (unlike cookies). However, we disclose them here for full transparency under GDPR and ePrivacy requirements.
4. Third-Party Cookies
When you consent to analytics and/or marketing cookies, the following third-party services may set cookies on your device:
- Google Analytics (Google LLC) — analytics cookies to measure site usage. Subject to Google's Privacy Policy.
- Google Tag Manager (Google LLC) — manages the loading of analytics and marketing scripts. Subject to Google's Privacy Policy.
- Microsoft Clarity (Microsoft Corporation) — analytics cookies for session recording and heatmaps. Subject to Microsoft's Privacy Statement.
- Meta Pixel (Meta Platforms, Inc.) — marketing cookies for ad conversion tracking and retargeting. Subject to Meta's Privacy Policy.
- Supabase — essential authentication cookie. Does not track you across other websites.
Where a banner is shown (see Section 5), no third-party cookies are loaded until you explicitly consent, and choosing "Essential Only" sets no analytics or marketing cookies at all. Where no banner is shown, analytics and session recording load without one; marketing cookies never do.
The Sant Chat AI widget (installed on Customer websites) does not set any third-party cookies. It uses only browser localStorage and sessionStorage as described in Section 3.
5. Cookie Consent
We check the country your request comes from and use it to decide whether to ask you first.
- European Economic Area, United Kingdom and Switzerland — we show the cookie banner and load nothing beyond the essential cookies until you choose. Google Analytics and Microsoft Clarity stay switched off until you enable analytics.
- Everywhere else — no banner is shown. Google Analytics and Microsoft Clarity load once the country check has answered. Marketing cookies still require your opt-in and are never loaded on the basis of location alone.
- If the country check fails or does not answer — we treat you as though a banner were required and ask anyway. Nothing beyond the essential cookies loads in the meantime.
A choice you save travels with you: if you decline and later visit from a country where no banner is required, your decline still applies.
When the banner is shown, it gives you three options:
- Accept All — enables essential, analytics, and marketing cookies.
- Essential Only — enables only the cookies required for the website to function. No analytics or marketing cookies are loaded.
- Manage — lets you choose exactly which categories (analytics, marketing) to enable or disable.
Essential cookies are always active because they are required for authentication and core functionality. Where the banner is shown, analytics and marketing cookies are only loaded after you give explicit consent, in compliance with GDPR and the ePrivacy Directive.
You can change your preferences at any time by clearing your browser's localStorage (which resets the sant_cookie_consent value) and refreshing the page. The consent banner will reappear.
6. How to Manage Cookies
You can control and manage cookies through your browser settings. Most browsers allow you to:
- View what cookies are stored on your device
- Delete individual cookies or all cookies
- Block cookies from specific or all websites
- Set preferences for first-party vs. third-party cookies
Here are links to cookie management instructions for common browsers:
To clear localStorage and sessionStorage, you can use your browser's Developer Tools (usually accessible via F12) and navigate to the Application or Storage tab.
7. Impact of Disabling Cookies
If you block or delete cookies used by sant.chat:
- Authentication cookie blocked: You will not be able to stay logged in to your sant.chat dashboard. You will need to log in again on each visit.
- Consent preferences cleared: The cookie consent banner will reappear so you can set your preferences again.
- Analytics cookies declined/blocked: We will not be able to see your visit in our analytics reports. This has no impact on your use of the Service.
- Marketing cookies declined/blocked: Ad platforms will not be able to attribute your visit to a campaign or include you in retargeting audiences. This has no impact on your use of the Service.
If you block localStorage/sessionStorage on a Customer's website where the chat widget is installed:
- localStorage blocked: Conversation history will not persist across page navigations. Each page load will start a fresh conversation.
- sessionStorage blocked: The widget may not function correctly. Session tracking, lead capture, and greeting logic may be affected.
8. Cookies and the Chat Widget on Customer Websites
If you are a Customer (website owner) using Sant Chat AI on your WordPress site, please note:
- The chat widget does not set any HTTP cookies on your visitors' devices.
- The widget uses localStorage and sessionStorage only, which are subject to the ePrivacy Directive and similar laws in some jurisdictions.
- You should disclose the use of Sant Chat AI and its browser storage in your own website's privacy and cookie policies.
- If you are subject to GDPR or similar laws, you may need to include the browser storage items listed in Section 3 above in your own cookie consent mechanism.
9. Changes to This Policy
We may update this Cookies Policy from time to time. We will post the updated version on this page with a revised "Last updated" date. We encourage you to review this policy periodically.
10. Contact Us
If you have questions about this Cookies Policy, contact us at:
Sant Limited
New Zealand
Email: hey@sant.chat