Cookie Policy
Last updated: 23 September 2026 (version 1.0)
This policy is a separate document from the data processing agreement (DPA), which covers the processing of Reponse customers' data and not the trackers on the public website. Each of the two documents carries its own date of last update.
1. Purpose of this policy
This policy explains which trackers are set when you browse reponse.ai and use the Reponse service, what they are for, who sets them, how long they are kept and how to change your choice at any time.
It is published by Shmore, a simplified joint stock company (SAS) with share capital of 1,000 euros, registered office at 26 Thubert, 44118 La Chevrolière, France, registered with the Nantes trade and companies register under number 990 895 971, publisher of the Reponse service.
It supplements the service privacy policy. The word "cookie" is used here as a convenient shorthand for all trackers written to or read from your device, including data held in the browser's local storage, which falls under the same legal regime under Article 82 of the French Data Protection Act.
Related documents
- Privacy policy: https://reponse.ai/legal/privacy
- Legal notice: https://reponse.ai/legal
- Data processing agreement (DPA): https://reponse.ai/legal/dpa
- Terms of sale, which govern the sale and use of the service: https://reponse.ai/legal/cgv
2. The principle applied
There are two categories of tracker.
Strictly necessary trackers, required for the website and the service to work, are set without consent because they are indispensable to delivering the service you asked for: keeping your session open, showing the website in your language and remembering your cookie choice.
All other trackers, in particular audience measurement, are activated only after you have consented, through the banner displayed on your first visit:
- product analytics (PostHog) is configured to opt out by default: no event is transmitted until you have accepted;
- website audience measurement (Google Analytics 4) is only loaded after you accept: until you do, no request is sent to Google and no Google cookie is set.
The Cal.com scheduling module, a third party service, is described in section 4.3.
Declining does not prevent you from using the website or the service.
3. The consent banner
On your first visit to the public pages of the website, a banner appears a few seconds after the page loads and offers two choices of equal prominence: accept or decline. The banner also has a close button, which hides it without recording a choice: as long as no choice is recorded, no tracker subject to consent is activated, and the banner is offered again on your next visit.
Your choice is stored in your browser's local storage, under the key cookie_consent, with the value accepted or declined, together with its date and time (key cookie_consent_at) and the version of the banner you saw (key cookie_consent_version). It is specific to the browser and device you are using.
The state of your choice is passed to the tools concerned in order to enable them or keep them disabled: it is communicated to the product analytics tool and to Google's consent mode. Details are set out in section 4.
Validity period of consent and renewal. Your choice, whether acceptance or refusal, is valid for six months. Once that period has expired, it is erased and the banner is offered to you again.
Proof of consent. Your choice is timestamped and linked to the banner version, in your browser's local storage. It is not kept on our servers.
The banner is not displayed in the authenticated workspace, in the sign-up flow, or in the chat widget embedded on a third party merchant site, where consent is a matter for the publisher of the site you are visiting. In the workspace, product analytics remains disabled until you have accepted through the banner on the public pages.
4. Trackers set
4.1 Strictly necessary trackers
| Name | Purpose | Publisher | Duration |
|---|---|---|---|
cookie_consent, cookie_consent_at, cookie_consent_version (local storage) | Store your choice to accept or decline non-essential trackers, its date and the banner version, and avoid showing the banner on every visit | Reponse (Shmore) | 6 months, then erased and asked again |
sb- (cookie, possibly split into .0, .1) | Keep your authenticated session in the workspace | Reponse (Shmore), via Supabase | Renewed on each session refresh, deleted on sign-out; 400 days at most |
NEXT_LOCALE (cookie) | Remember the display language of the website | Reponse (Shmore) | Duration of the browsing session |
Our code sets no technical cookie other than those listed above.
4.2 Product analytics, subject to consent
| Name | Purpose | Publisher | Duration |
|---|---|---|---|
ph_ (cookie) | Measure use of the website and of the product: pages viewed, journeys, usage events, in order to improve the service | PostHog | 12 months |
ph_… and __ph_opt_in_out_… entries in local storage | Store the technical analytics identifier and the consent state passed to the tool | PostHog | Until you clear the site's data |
Product analytics is configured to opt out by default. It is enabled only after acceptance through the banner. Persistence is split between local storage and a cookie. Data is sent to PostHog's European instance (eu.i.posthog.com, Frankfurt, Germany).
The purposes covered by this tool include automatic capture of interactions (except on the chat widget pages), measurement of page exits and, where enabled in the PostHog project, session recording and heatmaps. In session recordings, all input fields are masked, as well as the text we flag as sensitive.
4.3 Website audience measurement and other third party trackers
If you accept through the banner, the website loads Google Analytics 4 (Google Ireland Limited) to measure its audience. Only the audience measurement purpose (analytics_storage) is enabled; no advertising purpose is granted. If you decline or withdraw, the tag is not loaded and any _ga cookies already set are deleted.
| Name | Purpose | Publisher | Duration |
|---|---|---|---|
_ga | Distinguish visitors pseudonymously to measure audience | 13 months | |
_ga_* | Keep the state of the measurement session | 13 months |
Scheduling (Cal.com). The demo request page embeds the Cal.com booking calendar, a third party service. On the website's public pages, the Cal.com script is not loaded when the page opens: it is loaded on your first interaction with the page (scroll, mouse movement or touch), or immediately when you arrive through a booking or campaign link. The calendar displayed is served by Cal.com, which may set its own cookies, under its own policy.
No other third party tracker is loaded by our code on the website's public pages.
4.4 Transfers outside the European Union
- Google Analytics 4: Google Ireland Limited (Dublin, Ireland), with possible transfers to Google LLC (United States).
- PostHog: European instance (Frankfurt, Germany).
- Cal.com: service established in the United States.
Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.
5. Changing your choice
You can change your mind at any time.
From the website. Click "Manage cookies" in the footer: the banner is shown again and you can accept or decline, as easily as when you first chose. Declining deletes any audience measurement cookies already set.
From your browser. Every browser lets you block or delete cookies. The settings are usually found under preferences, in the privacy and security section. Blocking strictly necessary trackers may prevent access to your workspace.
Effect of declining. If you decline, product analytics is not enabled and no usage event is transmitted to that tool. The website and the service remain fully accessible.
6. Chat widget embedded on a merchant site
When you use the Reponse chat widget on a merchant's website, it is that merchant who determines the purposes of the processing and who is responsible for informing you and, where applicable, obtaining your consent on its site. Reponse acts as the merchant's processor. The widget uses the technical items needed to keep the thread of your conversation and display the widget correctly.
Items set on the merchant's site:
| Name | Type | Purpose | Duration |
|---|---|---|---|
reponse_session_id_ | Cookie and local storage | Identifier of your conversation session, to find your thread again from one page to the next | Cookie: 12 months; local storage: until you clear the site's data |
reponse_visit_count, reponse_last_seen | Local storage | Count your visits (a new visit after 30 minutes of inactivity) to adapt the widget's greeting, only if you have accepted analytics | Until you clear the site's data |
reponse_launcher_config_ | Local storage | Keep the widget's latest display configuration (colours, avatar, pause) | Until you clear the site's data |
reponse_auto_dismiss_ | Local storage | Remember that you closed an automatic opening, so that it is not offered again for 24 hours | Until you clear the site's data |
reponse_auto_count_, reponse_unread_ | Session storage | Limit automatic openings and show the number of unread messages | Until the tab is closed |
To find an existing session, the widget may also read Shopify's visitor identifier (_shopify_y) on Shopify stores, and the cookie_consent key if it exists on the merchant's site.
Items set in the widget window (reponse.ai domain):
| Name | Type | Purpose | Duration |
|---|---|---|---|
reponse_session_id_ | Local storage | Identifier of your conversation session | Until you clear the site's data |
reponse_messages_ | Local storage | History of your conversation, to show it again when you come back | Until you clear the site's data |
reponse-human-conv-, reponse-takeover- | Local storage | Find a conversation taken over by a human agent | Until you clear the site's data |
7. Data collected by analytics
Analytics events include a technical identifier, the page viewed, a timestamp, information about the browser and device, and the IP address used for the connection. They are used to understand how the product is used and to fix friction points. Audience measurement data (Google Analytics 4 and PostHog) is kept for 13 months.
Legal basis: your consent, Article 82 of the French Data Protection Act and Article 6(1)(a) GDPR. For strictly necessary trackers: the legitimate interest in providing a secure and functional service, and the exemption provided for in the same Article 82.
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port the data concerning you, as well as the right to withdraw your consent at any time. These rights may be exercised by writing to hello@reponse.ai, with the subject "Data protection". No data protection officer has been appointed: this address is the single point of contact.
You may lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
9. Changes to this policy
This policy may change, in particular if new trackers are introduced or if the rules change. The date of last update is shown at the top of the page. If a tracker subject to consent is added, your consent will be sought again.
10. Contact
For any question about this policy: hello@reponse.ai. For technical questions: support@reponse.ai.
This policy is published in French and in English. In the event of a discrepancy, the French version prevails.