Legal

Configure > Legal holds the two policy links the chat shows, what ARCY stores from visitors, and whether your policies describe ARCY.

ARCY writes nothing to a visitor's device until that visitor has accepted your cookie policy. Page measurement, with no identifier, runs whatever the answer is, unless Do Not Track or Global Privacy Control is on (What ARCY collects).

Before you start

• Only an admin changes this page. A member sees the saved values.
• Your cookie policy must describe what arcy.js stores. Paste the cookie policy disclosure into it.
• Every call below needs init() first; earlier, it only logs a warning.

Setting it up

Consent. The Privacy policy URL and the Cookie policy URL are the pages the chat links when it asks for consent. Both start with https://; Insert variable adds the visitor's language. A link ARCY found on your site shows From your site until you Keep or change it.

Store conversations. On by default. On, ARCY stores what visitors type in the widget, which conversation history and insights read. Off, ARCY keeps only usage details, never the text.

Element screenshots. On by default. On, picking an element for a flow step stores a small cropped image of it, which is how you recognise the step. Off, nothing is captured and a step shows text and an icon.

ARCY in your policy. ARCY reads both policy pages and shows Found, Missing or Out of date for each. Write it with your coding agent hands the section to your agent, which also proposes your two links. Writing it yourself, start from the Legal templates.

Wiring your banner. A visitor can say yes in two places, and both count. Your banner calls arcy.consent(true) on accept and arcy.consent(false) on reject. A visitor who reaches for the chat with no grant on record is asked there, with your two links. Closing the panel means "not now" and the ask returns next time.

The in-chat ask names what the grant covers: answering the visitor, remembering the conversation, offering or starting a flow from how they use your Product, and asking them a short question about it. That last clause is what an Ask NPS Experiment runs on (Specialists). ARCY writes the sentence in the visitor's language and you do not edit it, so your own policy pages should cover the same ground.

Three calls keep both sides on one answer:

consent(granted: boolean): void
consentState(): "granted" | "refused" | null
onConsent(callback: (granted: boolean) => void): () => void

consentState() returns null when the visitor has never answered, or answered an older disclosure and must be asked again. Use it to decide whether your banner shows. onConsent fires on every change from any source and returns an unsubscribe function.

A plain banner on the HTML install path waits for ready:

<div id="cookie-banner" hidden>
  We use cookies. <a href="/cookie-policy">Read more</a>
  <button id="cookie-accept">Accept</button>
  <button id="cookie-reject">Reject</button>
</div>

<script>
  arcy.on("ready", function () {
    var banner = document.getElementById("cookie-banner")
    if (arcy.consentState() === null) banner.hidden = false

    document.getElementById("cookie-accept").onclick = function () {
      arcy.consent(true)
      banner.hidden = true
    }
    document.getElementById("cookie-reject").onclick = function () {
      arcy.consent(false)
      banner.hidden = true
    }

    arcy.onConsent(function (granted) {
      if (granted) banner.hidden = true
    })
  })
</script>

Google Consent Mode, so an accept in the chat unlocks your analytics too:

arcy.onConsent((granted) => {
  gtag("consent", "update", {
    analytics_storage: granted ? "granted" : "denied",
  })
})

A consent management platform, checked first so the two never loop:

cmp.onAccept(() => arcy.consent(true))
cmp.onReject(() => arcy.consent(false))

arcy.onConsent((granted) => {
  if (granted && !cmp.hasConsent()) cmp.acceptAll()
})

What it changes

• Until both policy links are saved as https addresses, the widget links ARCY's own policy pages instead of yours.
• Switching Store conversations or Element screenshots off changes collection from that moment; nothing already stored is deleted. Both apply to Development and Production.
• Grant. ARCY writes its anonymous id cookie and starts the session. What it writes from then on is listed on What ARCY collects.
• Refusal. Recorded for six months. ARCY stops speaking first: a matching flow will not open on its own. The visitor can still reach for the chat, which asks again.
• No answer. A matching flow may raise the ask itself.
• Withdrawal. A consent(false) after a grant. Collection stops, every cookie and key ARCY wrote is deleted, and the refusal is recorded. Only arcy.cap.<token> stays, the 24-hour value the chat's daily limit counts against, so a withdrawal cannot reset it. Nothing stored on our side is deleted; erasure is a separate request.

The widget has no consent control: your banner is where a visitor changes their mind. Every answer reaches ARCY, on Users and Organizations.

See also

• Legal templates
• Cookie policy disclosure
• Reference