Legal
Cookie Policy
Last updated: 30 October 2026
Draft — under legal review. This text is not yet in force.
This policy explains the cookies and similar browser storage used by the RagForge AI chat widget (on our customers' websites), our dashboard and ragforgeai.com. We do not use advertising, analytics or social-media tracking cookies.
1. The chat widget on customers' websites
| Name | Where | Purpose | How long | Type |
|---|---|---|---|---|
| rf_visitor_id | Browser storage (local, or session-only until consent) | Recognises a returning visitor so the assistant can continue where it left off | Until cleared by the visitor; session-only until a UK/EU visitor consents | Visit tracking (needs consent in the UK/EU) |
| rf_session_<id>, rf_session_expiry_<id> | Browser storage | Keeps one visit together so a chat or call continues across pages | 30 minutes after the last activity | Strictly necessary |
| rf_chat_<id> | Session storage | Keeps the open chat on screen when the visitor moves between pages | Until the tab is closed | Strictly necessary |
| rf_consent | Browser storage | Remembers the visitor's answer to the consent question | Until cleared by the visitor | Strictly necessary |
Chat, voice calls, human takeover and bookings use only the strictly necessary items. They work even if a visitor declines.
2. How consent works in the widget
- UK and EU/EEA visitors (and Switzerland), decided from the country of the visitor's IP address: until the visitor consents, the widget keeps its identifiers in session storage only (gone when the tab closes) and sends only live presence — that someone is on the page, which page and which country. After consent, the returning-visitor identifier and visit tracking are switched on. Declining keeps everything in session storage.
- Visitors elsewhere: visit tracking is on, with notice in the website's privacy information. A visitor who declines in a consent prompt is treated as having declined, wherever they are.
- Customers who ask everyone: a customer can switch on "Ask for consent from all visitors" (for example in the DIFC or ADGM); then every visitor is asked first.
- Do Not Track and Global Privacy Control: a browser that sends either signal is treated as having declined, wherever the visitor is, unless the visitor then actively agrees on that site (its banner, a consent platform or our bar). Our consent bar is not shown to such visitors.
- Where the answer comes from: the website's own cookie banner (through
RagForge.consent(true)orRagForge.consent(false), or common consent platforms — Cookiebot, OneTrust and CookieYes — detected automatically), or a small RagForge AI consent bar shown only when the site has no banner of its own.
Changing your mind: use the website's cookie settings or clear your browser storage for that site. Withdrawing consent removes the long-lived identifier and the tracked visit details from the visitor's record.
3. The dashboard and ragforgeai.com
| Name | Where | Purpose | How long | Type |
|---|---|---|---|---|
| rf_site_consent | Browser storage (ragforgeai.com) | Remembers the answer given in our cookie banner | Until cleared by the visitor | Strictly necessary |
| access_token, refresh_token | Secure, HttpOnly cookies (dashboard) | Keep a customer signed in to the dashboard | Up to the session lifetime set in the account | Strictly necessary |
| rf_token and dashboard preferences | Browser storage (dashboard) | Sign-in state, selected workspace, sidebar layout | Until sign-out or cleared | Strictly necessary |
| Cloudflare Turnstile | Set by Cloudflare on sign-up, login and contact forms | Tells people and bots apart | Short-lived | Strictly necessary (security) |
Our website shows a cookie banner the first time you visit (not when your browser sends a Do Not Track or Global Privacy Control signal, which we treat as a decline); you can reopen it at any time with Cookie settings in the footer. The answer also applies to our own chat widget on ragforgeai.com. Images and fonts are served from our own domain; no third party is involved.
4. More information
How we use the data collected is explained in our Privacy Policy. Questions: support@ragforgeai.com.
RAGFORGE AI LTD is a company registered in England and Wales, company number 17524862, registered office 128 City Road, London, EC1V 2NX, United Kingdom. Contact: support@ragforgeai.com.