1. Summary
- We use no advertising, social-media or cross-site tracking cookies or scripts on any of our properties, and we do not build profiles of visitors.
- We do measure how our public websites are used, with software we run ourselves on our own domain. It sets no cookies and no browser storage, records no IP addresses, and cannot recognise you across sites or across days. In the admin platform the same software also records which product steps a workspace completes; that part is pseudonymous personal data and Section 3 explains the legal basis and how to object.
- We use a small number of strictly necessary cookies and browser-storage entries: to keep you signed in, to protect sign-in against forgery, to remember your language, to link you to a trial Mind you built without an account, to deliver notifications you have allowed, and to let a chat conversation continue when you reload the page.
- Two third parties are contacted from our pages, both for strictly necessary reasons: Cloudflare, whose Turnstile bot check runs when a trial Mind is built, and Stripe, on its own checkout and billing pages. Our legal pages serve their fonts from our own domain. Section 4 has the details.
- Under Article 5(3) of the ePrivacy Directive (in the Czech Republic, Section 89(3) of Act No. 127/2005 Coll.), strictly necessary storage does not require consent, and storing nothing on your device is outside that rule altogether. That is why you do not see a cookie banner.
- Where a Mind is embedded on an Operator's own website, that website may use its own cookies under its own notice. The Dialogis widget itself does not set cookies on the Operator's domain.
2. What we use and why
The table lists every cookie and storage entry set by properties we control. "Session" means the entry is deleted when you close the browser tab or window.
| Where | Name or key | Type | Purpose | Lifetime |
|---|---|---|---|---|
| Websites (dialogislabs.com, dialogis.io) | dialogis-lang |
Local storage | Remembers the language edition you chose (English or Czech) | Until you clear it |
| Admin platform (admin.dialogislabs.com) | session cookie (name configured per environment) | Cookie (HttpOnly, Secure, SameSite) | Keeps you signed in to your workspace; the session ends after 24 hours of inactivity and at most 30 days after sign-in | Up to 30 days |
| Admin platform | ds_theme_id, admin_language |
Local storage | Remembers your interface theme and language | Until you clear it |
| Admin platform (trial builder) | dialogis.tryMind.v1 |
Local storage | Holds the random token that links your browser to the trial Mind you built without an account, so you can come back to it until it expires or you save it into a workspace | Until the trial expires or you clear it |
| Admin platform (notifications) | firebase-messaging-database, firebase-installations-database and a service worker |
IndexedDB | Created by our push-notification library only if you allow notifications; stores the push token so we can alert you | Until you withdraw permission or clear site data |
| Trial builder (bot check, challenges.cloudflare.com) | Cloudflare Turnstile | Script and, where Cloudflare needs it, a short-lived cookie on Cloudflare's own domain | Tells people from scripts so that trials cannot be created in bulk; Cloudflare receives your IP address and browser signals and states that it does not use them for tracking or advertising | Session |
| Sign-in service (auth.dialogis.io, Amazon Cognito) | XSRF-TOKEN, cognito, csrf-state and similar |
Cookies | Protect the sign-in flow against cross-site request forgery and carry the state of the sign-in, including Google sign-in | Session, or up to 1 year for the "remember device" cookie where used |
| Chat widget and hosted Mind pages | dialogis_conversation_* |
Session storage | Holds the chat session and conversation identifiers, the welcome message and a short local copy of the conversation so the chat can continue when you reload | Session |
| Chat widget and hosted Mind pages | legal-consent key (prefixed dialogis_conversation) |
Local storage | Records that you accepted the AI notice and the End-User Terms for the current version, so you are not asked again on every visit | Until the terms change or you clear it |
| Billing (checkout.stripe.com, billing.stripe.com) | Stripe cookies (for example __stripe_mid, __stripe_sid) |
Cookies | Fraud prevention and operation of the payment pages, set by Stripe on its own domains under Stripe's cookie policy | Session to 1 year |
We do not read or set cookies through the Telegram, WhatsApp or Instagram apps; those services use their own storage under their own policies.
3. Website measurement without cookies
We need to know whether our public websites work — which pages people read, which links they follow, whether a page is broken on a phone. We do this with Umami, open-source analytics software that we host ourselves at stats.dialogislabs.com. It is not a third-party service: the data goes to our own servers in the European Union, and no advertising or analytics company receives it.
What it does, in full:
- It records the page you viewed, the page or search engine that referred you, and — derived from your IP address and then discarded — your country, browser, operating system and screen size.
- It records how far down a page you scrolled, which sections of it you reached, how long the page stayed open, and which of our buttons you clicked, so we can see where a page stops being useful. For a small sample of visits it also records where on the page clicks land and how far the page was scrolled; this is only ever shown as a heat map aggregated over many visits, never as one person's visit.
- In the admin platform it also records which product steps you complete — for example creating an account, creating a Mind or publishing a page — together with the identifier of your workspace, your role and your plan, never your name or e-mail address, so we can see where new customers get stuck.
- It stores nothing on your device: no cookies, no local storage, no identifier of any kind.
- It does not store your IP address. Visits within one day are grouped using a one-way hash of your IP address, your browser's user-agent string and a secret we hold. That hash is not stored either, and it is rebuilt from a value that changes every day, so the same visitor on two days is two unrelated records. Our public website and the admin platform are measured as one site, so we can see whether a visitor who arrived from the landing page went on to sign up; that link lasts one day and involves no name or e-mail address. No other site is connected.
- It honours Do Not Track: if your browser sends that signal, the script records nothing at all. Few browsers still offer the setting; e-mail is the sure way to object.
Because nothing is stored on your device, Article 5(3) of the ePrivacy Directive does not apply and no consent is required for any of this. On the GDPR side there are two regimes:
- Public websites. The result is statistics about pages, not about people; no record can be traced back to an individual, so it is not personal data. To the extent the brief processing that produces those counts is personal data, our legal basis is our legitimate interest in understanding and improving our own websites (Article 6(1)(f) GDPR).
- Admin platform. The workspace identifier attached to product steps can be linked to the workspace owner, so these records are pseudonymous personal data. We process them on the basis of our legitimate interest in seeing where customers get stuck and fixing it (Article 6(1)(f)); we never attach a name or e-mail address, we never look at individual journeys to make decisions about a customer, and we keep the event-level records for 12 months, after which only aggregates remain. You can object at any time by e-mailing hello@dialogislabs.com or, where your browser still offers the setting, by switching on its Do Not Track signal, which stops the measurement entirely.
This measurement runs on our public websites, legal pages and the admin platform. The chat widget and hosted Mind pages are not measured this way, and we do not record replays of individual visits.
4. Third-party resources
Our websites, legal pages, the admin platform, the chat widget, hosted Mind pages and the Telegram voice mini-app serve their scripts, styles, fonts and code libraries from our own domains (dialogislabs.com, dialogis.io and their subdomains); no font or script request reaches Google or any other third party. The measurement described in Section 3 is served from our own domain too. The third-party resources that do load are these, each strictly necessary for the function you are using:
- Cloudflare Turnstile (challenges.cloudflare.com) loads when you build a trial Mind. It checks that a person, not a script, is building the Mind, so that the free trial cannot be abused. Cloudflare receives your IP address and technical signals from your browser for that check, under its privacy policy, and states that it does not use them to track you across sites or for advertising. Cloudflare is listed on our Sub-processor List.
- Stripe (checkout.stripe.com, billing.stripe.com) loads only when you open the checkout or the billing portal, on Stripe's own pages and under Stripe's cookie policy.
- Firebase Cloud Messaging is contacted only if you allow notifications in the admin platform, to issue the push token described in Section 2.
No advertising pixels, social-media buttons or embedded third-party content are loaded anywhere on our properties.
5. How to control storage
You can delete or block cookies and site data in your browser settings. Blocking the session cookie will sign you out of the admin platform; clearing session storage will end the current chat conversation in the widget (your conversation is still stored by the Operator as described in the Privacy Policy). If your browser sends a "Do Not Track" signal, the website measurement in Section 3 switches itself off; there is no advertising or cross-site tracking anywhere on our properties for a Global Privacy Control signal to turn off.
6. Changes
If we ever introduce optional cookies, or measurement that stores anything on your device or identifies you, we will update this notice, add a consent mechanism before it is used, and, for customers, give notice as described in the Terms of Use. The version and effective date are shown at the top of this page.
7. Contact
Questions about this notice: hello@dialogislabs.com (subject "Privacy"). See also the Privacy Policy and the Sub-processor List.