Cookie notice

Essential browser storage

Onact uses the turnit_identity cookie to remember a guest browser. It is HTTP-only, SameSite=Lax and secure on HTTPS, with a maximum one-year lifetime. The server stores a keyed hash, not the cookie value. Clearing it can remove access to guest-owned actions.

WordPress sets its own authentication and preference cookies when people sign in or use the administration area. These include logged-in and secure-auth cookies, and administrator UI preferences. Exact cookie names depend on the site URL and WordPress configuration.

Session storage

The app can remember a participant display name and an unfinished builder draft in browser session storage. That data stays in the browser session and should not contain sensitive information. Shared computers should be signed out and closed after use.

Optional analytics and marketing

The bundled plugin does not install ad pixels or newsletter open-tracking pixels. Other plugins, embeds, hosting or analytics may add storage. The operator must audit the actual site, list each provider and purpose, and obtain any required consent before loading nonessential tracking.

Managing storage

Use your browser’s site settings to inspect or remove cookies. Blocking essential cookies may prevent guest ownership, sign-in or secure form submissions. Newsletter consent is separate from cookie choices.

Starter notice, version 1, 8 November 2026. Review with the actual plugin stack before publication. See privacy, help, or contact us.

Essential browser state

The platform uses essential state for signed-in sessions, guest ownership, security and request validation. A guest identity helps update the same response from the same browser; clearing it can prevent that browser from recovering an earlier guest record. A display name alone does not restore the identity. Private workspace access still depends on membership and account permissions.

Privacy preferences are stored for the current browser with a finite expiry. Another device can have a different selection. Essential storage is distinct from newsletter consent, and choosing optional analytics does not subscribe a person to email. Browser settings can also affect whether a session or local worker remains usable.

Optional advertising and analytics

Advertising and optional aggregate visits stay off until the visitor makes the applicable choice. Paid ad exclusion is rechecked by the server before loading a network script. Eligible public placements are separate from private actions and checkout. If required, the operator must configure a suitable certified CMP; the built-in preference panel does not claim that certification.

Use Privacy choices to withdraw or change a preference. If an external script has already run, reload as instructed to clear the page’s loaded state. Withdrawing consent cannot recall data already transmitted to an independent service. The operator should list the actual enabled providers and review this notice when their behavior changes.

Help and local processing

The assistant loads public site knowledge and performs matching in the browser without an external AI service. It does not persist the conversation to local storage. Receipt recognition uses bundled local code and an English model; an accepted capture job is recorded separately by the server, and retaining a temporary encrypted image is an explicit choice.

The operator should test the actual configured storefront, gateway and mail services on staging. A third-party extension can introduce storage beyond the core platform. Keep this notice aligned with the real installed services and use the privacy contact route for a specific question rather than assuming every WordPress installation behaves identically.

Your next useful step

Read the product guides · Compare current plans · Contact Onact