Cookie Policy

Last updated 28 October 2026

This policy explains which cookies and similar storage WAButton uses, what each one is for, and how you can control them. It covers our website, our dashboard, and the chat widget our customers embed on their own sites.

Read it with our Privacy Policy, which explains how we handle personal data more widely.

In short

We use cookies and local storage to keep you signed in, to protect sign-in, and to remember choices you make.
We do not use advertising cookies, and we do not load Meta Pixel or other advertising tools on our website or dashboard.
We use Google Analytics 4 on our website and on the dashboard pages for signing in, registering and first setup. In the EEA, the UK and Switzerland its cookies stay off until you accept them in our banner, which has two buttons: Accept and Reject.
A few items on our website are set as soon as a page loads. Your choices and consent says which.
The chat widget does not set cookies. It uses local storage and session storage in the browser of anyone who visits a website that has the widget installed. If you run such a website, read If you use WAButton on your website.

We measure which English homepage headlines lead to new accounts and installed buttons. This uses a random reference in the signup link, without cookies or browser storage. We skip this measurement when your browser sends Do Not Track or Global Privacy Control. Our Privacy Policy explains what we record and how long we keep it.

What cookies and similar storage are

A cookie is a small text file that a website asks your browser to keep. Local storage and session storage do a similar job inside your browser. Local storage stays until it is cleared. Session storage is cleared when you close the tab.

The rules on consent apply to all of them. On this page we call them cookies and similar storage, and we say which kind each item is. Some items are set by WAButton. Some are set by other companies, and we say so.

The three kinds of item we use

Strictly necessary. Needed to give you something you asked for, such as staying signed in, keeping sign-in secure, or keeping a form you are filling in. These do not need your consent.
Preference. Remember a choice you made, such as your language or a collapsed menu. We set these only when you make the choice.
Not essential. Everything else. On our website this is Google Analytics and the live demo widget. In the chat widget on other websites, it includes the items written as soon as the widget loads.

WAButton does not use advertising cookies, so there is no kind for them. Google Analytics cookies are Not essential.

On our website (wabutton.app)

These items are set by WAButton, except the Google Analytics cookies, which Google's script sets on our domain.

Cookies and storage set on wabutton.app
Name	What it does	Lasts	Kind
`wab_consent` cookie, shared by wabutton.app and dashboard.wabutton.app	Remembers whether you accepted or rejected analytics cookies in our banner, so we do not ask again on the website or the dashboard. Set when you choose.	180 days	Strictly necessary
`_ga_ga_<property ID>` cookie, set by Google Analytics on wabutton.app and dashboard.wabutton.app	Let Google Analytics count visits and tell a returning browser from a new one. They hold a random ID, not your name or email. In the EEA, the UK and Switzerland they are set only after you accept analytics cookies. Elsewhere they are set unless you reject them.	Up to 2 years	Not essential
`wab_pref_lang` cookie and local storage	Remembers the language you picked with the language switcher, so the site opens in that language next time. Set only when you pick a language.	Cookie: 1 year. Local storage: until you clear it	Preference
`wabutton_lead_id` local storage	Set by the live demo widget when it loads. What it does is explained in the widget section below.	Until you clear it	Not essential
`wabutton_session_id-landing-…` session storage	Set by the live demo widget when it loads. What it does is explained in the widget section below.	Until you close the tab	Not essential

The live demo widget is the same widget our customers install. In the demo it does not send analytics events or leads to us. Its other storage, such as the chat history in session storage, is listed in the widget section. The demo's widget IDs start with landing-.

In our dashboard (dashboard.wabutton.app)

These items are set by WAButton, by the dashboard itself and by our API at api.wabutton.app. Each row says when it is set.

Cookies and storage set by the dashboard and our API
Name	What it does	Lasts	Kind
`__Host-wab_session` cookie, set by api.wabutton.app, HttpOnly	Keeps you signed in. It holds your sign-in token. Your browser sends it to our API with each request the dashboard makes, and scripts running in your browser cannot read it. Set when you sign in and deleted when you sign out.	Until you sign out or your sign-in expires, which is 7 days with our current settings	Strictly necessary
`wab_session_exp` cookie	Holds the time your sign-in expires, so the dashboard shows your pages instead of the sign-in screen. It holds no sign-in token and does not sign you in by itself. Set when you sign in.	Until you sign out or your sign-in expires, which is 7 days with our current settings	Strictly necessary
`userId` local storage	Your account ID, which the dashboard uses while you are signed in. Set when you sign in.	Until you sign out or your sign-in expires	Strictly necessary
`wab_dev` cookie, set by api.wabutton.app, HttpOnly	Marks a browser that has signed in before, so our sign-in protection can count its attempts separately from other people on the same network. It is a random value signed by us and does not name you or your account. Set when you sign in.	180 days, renewed each time you sign in	Strictly necessary
`google_oauth_state` cookie, set by api.wabutton.app, HttpOnly	Protects signing in with Google against forged sign-in requests. Set when you choose to sign in with Google and deleted when Google sends you back.	Up to 10 minutes	Strictly necessary
`__Host-wab_signup` cookie, set by api.wabutton.app, HttpOnly	Ties a new account to the browser it was created in, so the link in the verification email signs you in only in that browser. Opened anywhere else, the link confirms your email and asks you to set a password. It is a random value and does not name you or your account. Set when you create an account and deleted when the link signs you in.	Up to 24 hours	Strictly necessary
`wab_support_exp` cookie	Only in the browser of a WAButton staff member who opens your dashboard to help you, never in yours. It holds when that support session ends and no sign-in token. Set when the support session opens.	Until the support session ends, at most 30 minutes	Strictly necessary
`wab_supportwab_support_tab` session storage	Only in the browser of a WAButton staff member who opens your dashboard to help you. They keep that support session in its own tab, apart from any other sign-in in the same browser.	Until the tab is closed	Strictly necessary
`wab.pendingInvite` session storage	Keeps a team invitation you opened, so the dashboard can accept it once you have signed in or created your account. Set when you open an invitation link.	Until the invitation is accepted or refused, or you close the tab	Strictly necessary
`wabutton_builder_design` local storage	Carries the button you designed in the builder on our website into your first widget, from creating your account to setting up. Set when you follow the builder's link to create an account.	Until you finish setup. The dashboard ignores it after 7 days	Strictly necessary
`wabutton_active_widget` local storage	Remembers which widget you last opened in the dashboard. Set when you open or select a widget.	Until you clear it	Preference
`wab.sidebar.collapsedwab.overview.hero.collapsed` local storage	Remember whether you collapsed the sidebar and the overview header. Set when you collapse or expand them.	Until you clear them	Preference
`wabutton_ai_draft_v1` session storage	Keeps the draft you are building with the AI assistant during setup, so a page refresh does not lose it. Set while you build a draft.	Until you close the tab, or the draft is saved or discarded	Strictly necessary
`wabutton_consent` local storage, on widget.wabutton.app	Lets the live preview in the widget editor show the widget even when the cookie consent setting is on. The preview runs inside the editor. Set when the preview loads.	Until you clear it	Strictly necessary

Our cookies use SameSite=Lax, except __Host-wab_session and wab_support_exp, which use SameSite=Strict. In production they are sent only over HTTPS. The four set by our API are HttpOnly, which means scripts running in your browser cannot read them.

Other companies

Some features rely on other companies. When you use one, it may set its own cookies or similar storage. We do not control those and cannot list them exactly, so each row links to the company's own information.

Other companies whose services may set cookies
Company	When	What it does	More information
Cloudflare Turnstile	On the dashboard pages for signing in, registering, resetting a password and verifying an email address	Checks that you are a person, to protect those forms from automated abuse. It may set or read cookies or similar storage in your browser while it runs.	Cloudflare cookies
Cloudflare (widget delivery)	When a website loads the widget from widget.wabutton.app	Delivers the widget script and its settings. Cloudflare may set cookies of its own as part of its security services.	Cloudflare cookies
Google Analytics	On our website, and on the dashboard pages for signing in, registering and first setup	Counts visits and sign-ups for us. With analytics cookies on, it sets the _ga cookies listed above. With them off, it receives each page view without cookies or an identifier from your browser.	How Google uses information from sites that use its services
Google	If you choose to sign in with Google	Google runs the sign-in on its own pages and may set cookies there.	How Google uses cookies
Stripe	If you open our hosted payment or billing pages	Stripe runs payment on its own pages and may set cookies there. We do not load Stripe scripts on our own pages.	Stripe cookies policy
WhatsApp	When you, or a visitor to a website with our widget, open WhatsApp from a WAButton link or the widget	WhatsApp runs on its own pages and apps and may set cookies there.	WhatsApp cookies

This section is for website owners who install the widget. It is also for anyone who wants to know what the widget stores when they visit such a website.

Who is responsible

The website owner decides whether to install the widget and what visitors are told about it. That makes the website owner responsible for any notice or consent the law requires for it. For the visitor data the widget collects, we act as the website owner's processor, as our Privacy Policy and Terms of Service explain.

If you are a visitor, please contact the website owner first about what they do with your data. If you cannot reach them, write to us and we will help.

What the widget stores

The widget does not set cookies. It stores the items below in the visitor's browser, on the website's own domain. The rules on consent cover local storage and session storage in the same way as cookies.

Storage written on a website that installs the widget or a chat button snippet
Name	What it does	Lasts	Kind
`wabutton_lead_id` local storage	A random reference code for this browser, for example WB8K2M. The widget can add it, invisibly, to the WhatsApp message it pre-fills for the visitor. The website's own scripts can read it with WAButton.getLeadId(). Set when the widget loads.	Until the visitor clears it	Not essential
`wabutton_cfg:<widget ID>` local storage	A saved copy of the widget's settings, so the widget can still appear if our servers cannot be reached for a while. Set when the widget loads and fetches its settings.	Until the visitor clears it	Not essential
`wabutton_session_id-<widget ID>` session storage	A random ID for the visit in this tab. It is sent to us with a lead if the visitor submits a form. Set when the widget loads.	Until the tab is closed	Not essential
`wabutton_auto_opened:<API URL>:<widget ID>` session storage	Remembers that the chat has already opened itself in this tab, if the website has turned on automatic opening. Set when the chat opens itself.	Until the tab is closed	Not essential
`wabutton_utms` session storage	Campaign tags such as utm_source from the page address, so the website's message template can include them. Set when the widget loads on a page whose address has such tags.	Until the tab is closed	Not essential
`wabutton_consent-<widget ID>` local storage	Records that consent was given, when the website uses the cookie consent setting. Older versions of the widget used the name wabutton_consent. Set only when the website's own code calls WAButton.grantConsent().	Until the website's code calls WAButton.revokeConsent(), or the visitor clears it	Strictly necessary
`wabutton_leadform_<widget ID>wabutton_leadform_done_<widget ID>wabutton_chat_<widget ID>wabutton_leadref_<widget ID>` session storage	Keep what the visitor has typed in the form and the chat so far, whether the form is finished, and the short reference code (for example #AB-7K2M) that links the WhatsApp conversation to the lead, so a page reload does not lose them. The saved form answers can include personal details such as a name or phone number. Set when the visitor uses the form or the chat.	Until the tab is closed	Strictly necessary
`wabutton_popup_dismissed_at` local storage	Remembers that the visitor dismissed the greeting popup, when the website shows it at most once a day. Set when the visitor dismisses it.	Until the visitor clears it. The widget ignores it after one day	Preference
`wabutton_popup_dismissedwabutton_tooltip_dismissed:<API URL>:<widget ID>wabutton_cta_box_dismissed:<API URL>:<widget ID>` session storage	Remember that the visitor dismissed the greeting popup (when it shows once per visit), the tooltip or the call-to-action box, so it does not come straight back. Set when the visitor dismisses it.	Until the tab is closed	Preference
`wab-cb.dismissed` session storage	Written by the snippet our free chat button generator produces, not by the widget. The snippet runs on the website that installs it and does not contact us. Set when a visitor dismisses its button.	Until the tab is closed	Preference

Items described as set when the widget loads are written before the visitor does anything. The cookie consent setting does not hold them back, as the next heading explains.

The cookie consent setting

The widget editor has a setting called "Require cookie consent before showing widget". It is off by default. When it is on, the widget stays hidden until the website's own code calls WAButton.grantConsent(). Calling WAButton.revokeConsent() removes the consent record again. If the visitor's browser blocks local storage, the widget stays hidden.

This setting hides the widget. It does not stop the widget script from loading, and it does not stop the widget from writing the items described above as set when the widget loads. After consent is recorded, the widget may not appear until the visitor's next page load.

If nothing may be stored or requested before a visitor consents, load the WAButton script only after consent has been given.

Browser details the widget reads

When it loads, the widget reads the visitor's browser type, screen size and time zone and turns them into a short code with a one-way hash. The code is not stored in the browser. It is sent to our servers with requests the widget makes, such as submitting a form. We use it to check those requests and to limit abuse. We do not use it for advertising.

Your own analytics tools

If your website already runs Google Tag Manager, Google Analytics 4 or the Meta Pixel, the widget can pass events to them, such as the visitor opening the chat or sending a WhatsApp message. The switches are in the "Analytics & Pixels" tab of the widget editor, and they are on unless you switch them off.

The widget never loads those tools. It only passes events to the ones your page already has. They set their own cookies, under your control, so they belong in your own cookie notice. WAButton does not collect its own visit or click statistics from the widget at the moment.

Your choices and consent

Strictly necessary items do not need your consent, so there is nothing to switch off for them. The dashboard cannot keep you signed in without them.

Preference items are set only when you make the choice they remember. You can delete them at any time.

Items we have marked Not essential are not needed to give you something you asked for.

For Google Analytics we ask first. Visitors whose browser is set to a European time zone see a banner with two buttons of equal weight, Accept and Reject. In the EEA, the UK and Switzerland analytics cookies stay off until you accept, whatever your time zone. Your answer is kept in the wab_consent cookie for 180 days and covers the dashboard too.

The banner does not cover the live demo widget. Its storage is set when a page loads, without a prompt. We say so here rather than imply a choice that does not exist.

You can stop all of these by blocking cookies and site data for wabutton.app in your browser, and you can delete them at any time.

How to manage cookies and site data in the main browsers:

If you block all cookies and site data, you will not be able to stay signed in to the dashboard. To withdraw consent for the widget on someone else's website, use that website's own cookie settings, or clear its data in your browser.

How long they last

Cookies last for the time shown in the tables. Where a row says it is renewed, the clock restarts each time the cookie is set again.
Local storage has no expiry date. It stays until you clear it, or until the website or app removes it, for example when you sign out.
Session storage is cleared when you close the tab.

The rules that apply

European Union

Article 5(3) of the ePrivacy Directive (2002/58/EC), as written into each member state's law, says that storing information on a device, or reading it, needs the user's consent unless it is strictly necessary to provide a service the user asked for. The GDPR covers the personal data involved and sets the standard for valid consent: freely given, specific, informed and unambiguous.

United Kingdom

Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) works in a similar way. The UK GDPR covers the personal data involved and sets the standard for consent.

United States

There is no general cookie consent law in the US. State privacy laws, including California's CCPA as amended by the CPRA, regulate the sale of personal information, sharing it for cross-context behavioural advertising, and targeted advertising, and give residents rights over their data. WAButton does not use the cookies and storage described on this page for any of those purposes. We do not sell personal data.

Our website and dashboard do not currently change how they behave in response to Do Not Track or Global Privacy Control signals. If you are a US resident and have a question about your privacy rights, write to privacy@wabutton.app.

Changes

We will update this page when the cookies and storage we use change, and revise the date at the top. If a change materially affects your rights, we will tell account holders by email.

Contact and complaints

For questions about this policy, write to privacy@wabutton.app.

If you are unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.