Cookie Policy
Last updated: a completer : publication date
This policy is a separate document from the data processing agreement (DPA), which covers the processing of Reponse customers' data and not the trackers on the public website. Each of the two documents carries its own date of last update.
a valider : alignment of the title displayed in the website navigation, which announces a single document "Data processing agreement (DPA) and cookie policy" while two separate documents are published
Drafting note: in both language versions, the items still to be verified or completed before publication are flagged with the markers {{A_VALIDER}}, {{A_VERIFIER}} and {{A_COMPLETER}}, deliberately kept in French so that they can be tracked as a single list. All of these markers must be resolved before the document is published.
1. Purpose of this policy
This policy explains which trackers are set when you browse reponse.ai and use the Reponse service, what they are for, who sets them, how long they are kept and how to change your choice at any time.
It is published by Shmore, a simplified joint stock company with share capital of 1,000 euros, registered office at 26 Thubert, 44118 La Chevroliere, France, registered with the Paris trade and companies register under number 978 743 013, publisher of the Reponse service.
a verifier : consistency between registered office and register, the stated office is in Loire Atlantique while the register indicated is Paris
It supplements the service privacy policy. The word "cookie" is used here as a convenient shorthand for all trackers written to or read from your device, including data held in the browser's local storage, which falls under the same legal regime under Article 82 of the French Data Protection Act.
**Related documents**
- Privacy policy: a completer : URL of the privacy policy
- Legal notice: a completer : URL of the legal notice
- Data processing agreement (DPA): a completer : URL of the DPA
- Terms of sale and terms of use: a completer : URL of the general terms
2. The principle applied
There are two categories of tracker.
**Strictly necessary trackers**, required for the website and the service to work, are set without consent because they are indispensable to delivering the service you asked for: keeping your session open, remembering your cookie choice and, where applicable, securing a checkout flow.
a valider : existence of trackers set by the payment provider during a checkout flow, failing which the reference to payment must be removed from this section and the corresponding line in section 4.1 remains inapplicable
**All other trackers**, in particular audience measurement and third party trackers, should be activated only after you have consented, through the banner displayed on your first visit.
That rule is applied differently depending on the tool, and we state this here in the interest of transparency:
- product analytics (PostHog) is configured to opt out by default: no event is transmitted until you have accepted,
- the website audience measurement tag (Google Tag Manager and Google Analytics 4) is currently loaded as soon as the page is displayed, before you have made any choice, with Google's consent mode then being updated according to your answer to the banner. That early loading is not consistent with the principle stated above.
a valider : decision on Google Analytics 4, either its removal from the website or making its loading genuinely conditional on consent, this section to be rewritten once the fix is made
Declining does not prevent you from using the website or the service.
3. The consent banner
On your first visit to the public pages of the website, a banner offers two choices of equal prominence: accept or decline. The banner also has a close button, which hides the banner without recording a choice.
a valider : exact behaviour of the close button, absence of any tracker subject to consent being set while no choice has been recorded, and the delay before the banner appears after the page loads
Your choice is stored in your browser's local storage, under the key `cookie_consent`, with the value `accepted` or `declined`. It is specific to the browser and device you are using.
The state of your choice is passed to the tools concerned in order to enable them or keep them disabled: it is communicated to the product analytics tool and to Google's consent mode. Details are set out in section 4.
**Validity period of consent and renewal.** Your choice is kept until you clear the site's data in your browser.
a completer : introduction of a validity period for consent, the CNIL recommending six months, and of a renewed request once that period has expired
**Proof of consent.** The choice is currently recorded only in your browser, with no timestamp and no server side record.
a valider : introduction of a mechanism to evidence consent, timestamp, banner version and retention, as required by Article 7(1) GDPR
The banner is not displayed in the authenticated workspace, in the sign-up flow, or in the chat widget embedded on a third party merchant site, where consent is a matter for the publisher of the site you are visiting.
4. Trackers set
4.1 Strictly necessary trackers
| Name | Purpose | Publisher | Duration |
|---|---|---|---|
cookie_consent (local storage) | Store your choice to accept or decline non-essential trackers, and avoid showing the banner on every visit | Reponse (Shmore) | Kept until you clear the site's data. a valider : introduction of a six month expiry in line with the CNIL recommendation |
| Authentication session cookie | Keep your authenticated session in the workspace | Reponse (Shmore), via Supabase | Duration of the session and its renewal. a valider : exact cookie name, lifetime and classification, to be captured by inspecting the browser on reponse.ai in production |
a completer : exhaustive list of technical cookies set by the hosting layer and by the authentication layer, to be captured by inspecting the browser on the production site
a completer : trackers possibly set by the payment provider during a checkout flow, to be documented here or removed from section 2
4.2 Product analytics, subject to consent
| Name | Purpose | Publisher | Duration |
|---|---|---|---|
ph_{project-key}_posthog | Measure use of the website and of the product: pages viewed, journeys, usage events, in order to improve the service | PostHog | 12 months a valider : exact duration applied by the configuration |
| Associated local storage entries | Store the technical analytics identifier and the consent state passed to the tool | PostHog | Until you clear the site's data {{A_VALIDER}} |
Product analytics is configured to opt out by default. It is enabled only after acceptance through the banner. Persistence is split between local storage and a cookie.
The purposes covered by this tool include automatic capture of interactions, session recording and heatmaps. Input fields are masked in session recordings.
a valider : exact scope enabled in production, automatic capture, session recording, heatmaps, and masking settings
a valider : instance actually used in production, the European instance eu.i.posthog.com is the default value in the code but it can be overridden by an environment variable, this information must be identical here and in Annex 2 to the DPA
4.3 Website audience measurement and other third party trackers
The website currently loads a Google Tag Manager tag and Google Analytics 4, driven by Google's consent mode. If you accept through the banner, the `ad_storage`, `ad_user_data` and `ad_personalization` states are set to "granted", which authorises advertising purposes on Google's side.
a valider : decision on keeping Google Analytics 4 and on keeping the advertising purposes of consent mode, this section to be rewritten according to the decision taken
a completer : if Google Analytics 4 is kept, a table of the cookies set, name, purpose, publisher and duration, in particular _ga and _ga_*
a completer : trackers possibly set by the scheduling module embedded on the demo page, name, purpose, publisher and duration
a completer : any other tracker not identified at the date of publication, to be captured by inspecting the browser on the production site
4.4 Transfers outside the European Union
The audience measurement tools and the scheduling module are liable to transfer data outside the European Union.
a completer : for each third party tool actually loaded, country of processing and applicable transfer mechanism, adequacy decision or standard contractual clauses, information to be aligned with Annex 2 to the DPA
5. Changing your choice
You can change your mind at any time.
**From the website.** Clear the site data stored by your browser for reponse.ai. The banner will be shown again on your next visit and you will be able to choose again.
a completer : addition of a permanent "Manage cookies" link in the footer, allowing consent to be withdrawn as easily as it was given, which the CNIL expects in practice, this section to be rewritten once that link is in place
**From your browser.** Every browser lets you block or delete cookies. The settings are usually found under preferences, in the privacy and security section. Blocking strictly necessary trackers may prevent access to your workspace.
**Effect of declining.** If you decline, product analytics is not enabled and no usage event is transmitted to that tool. The website and the service remain fully accessible.
6. Chat widget embedded on a merchant site
When you use the Reponse chat widget on a merchant's website, it is that merchant who determines the purposes of the processing and who is responsible for informing you and, where applicable, obtaining your consent on its site. Reponse acts as the merchant's processor. The widget uses the technical items needed to keep the thread of your conversation.
a completer : list of storage items used by the embedded widget, key by key, with their purpose and duration
7. Data collected by analytics
Analytics events include a technical identifier, the page viewed, a timestamp, information about the browser and device, and the IP address used for the connection. They are used to understand how the product is used and to fix friction points.
a valider : absence of any advertising use of the measurement data, to be confirmed in the light of Google's consent mode, which upon acceptance authorises the `ad_storage`, `ad_user_data` and `ad_personalization` purposes
Legal basis: your consent, Article 82 of the French Data Protection Act and Article 6(1)(a) GDPR. For strictly necessary trackers: the legitimate interest in providing a secure and functional service, and the exemption provided for in the same Article 82.
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port the data concerning you, as well as the right to withdraw your consent at any time. These rights may be exercised by writing to hello@reponse.ai.
You may lodge a complaint with the French data protection authority, Commission nationale de l'informatique et des libertes (CNIL), www.cnil.fr.
a valider : up to date postal contact details of the CNIL, to be taken from the official website before publication
a completer : contact details of the data protection officer, if one has been appointed
9. Changes to this policy
This policy may change, in particular if new trackers are introduced or if the rules change. The date of last update is shown at the top of the page. If a tracker subject to consent is added, your consent will be sought again.
10. Contact
For any question about this policy: hello@reponse.ai. For technical questions: support@reponse.ai.
This policy is published in French and in English. In the event of a discrepancy, the French version prevails.