Cookie and Storage Notice
Effective date: 13 November 2026.
Summary in plain language
- The chat widget sets no cookies. It saves one item in your browser's local storage on the website you are visiting, so your chat carries on when you change page or come back. It is not used to track you across other websites.
- The console (where businesses answer chats) uses one sign-in cookie, plus a short-lived cookie during sign-up, and a few local settings.
- We use no advertising or analytics cookies in the widget or the console.
- Everything listed here is needed for the feature you asked for, so it is set without a consent banner on our own console. Businesses that put the widget on their site decide whether their own law needs consent for it.
The full Cookie and Storage Notice
1. What this notice covers
This notice explains the cookies and similar browser storage ("storage") used by:
- the mlivechat chat widget, which businesses ("Customers") embed on their websites;
- the mlivechat console at https://app.staging.mlive.chat; and
- our website at https://mlive.chat.
How we handle the data itself is explained in our Privacy Policy.
2. Chat widget (on Customers' websites)
| Name | Type | Set on | Purpose | Lasts |
|---|---|---|---|---|
__mlc_t_<organisation ID> |
Local storage | The Customer's website (first-party to that site) | Holds a random visitor identity token so the same chat and history continue across pages and visits. Our servers keep only a hash of it. | Until cleared by the visitor; the token is valid for up to 2 years |
The widget runs in a frame served by mlivechat but does not set cookies, including third-party cookies. If the browser blocks storage (for example in a private window), the widget still works, but each visit starts as a new, anonymous visitor.
The widget also tells the Service which page of the Customer's site you are on (address and title), your referrer, IP address and browser type. This is not stored in your browser; see the Privacy Policy, Part B.
For Customers: the widget's storage is set on your website. Under the EU ePrivacy rules (Art. 5(3) of Directive 2002/58/EC) and similar laws, storing information on a visitor's device needs consent unless it is strictly necessary for a service the visitor explicitly requests. Whether that exemption covers a chat widget that loads before the visitor opens it is for you and your lawyer to decide; if you need consent first, load the widget only after your consent tool allows it.
3. Console (https://app.staging.mlive.chat)
| Name | Type | Purpose | Lasts |
|---|---|---|---|
mlc_session |
Cookie (first-party, HttpOnly, Secure, SameSite=Lax) | Keeps you signed in; holds a random session token (stored only as a hash on our side) | 30 days from last use; removed on sign-out |
mlc_pending |
Cookie (first-party, HttpOnly, Secure, SameSite=Lax, path /v1/auth) |
During sign-up or joining a team, links the confirmation email to the browser that asked, so a link opened elsewhere cannot reuse the password you chose there | 7 days |
mlc.onboarding |
Local storage | Remembers your answers during first-time setup so a reload does not lose them | Until cleared |
mlc.verify |
Session storage | Remembers the email address on the "check your inbox" page | Until the tab closes |
mlc.step |
Session storage | Keeps a sign-in going between the password and the two-step code, so a reload of that page does not restart it | 5 minutes, or until the tab closes |
mlc.notify.<agent> |
Local storage | A copy of your notification and sound settings (the settings themselves are saved to your account), so the console can apply them before it has loaded | Until cleared |
mlc.readOnlyAck |
Session storage | Remembers that you chose to browse a locked account read-only | Until the tab closes |
4. Our website (https://mlive.chat)
This website sets no cookies and uses no analytics or advertising tools. Two things on it store or check data in your browser:
- Our own chat. The corner chat on every page is the mlivechat widget, which stores the visitor identity token described in section 2 (
__mlc_t_<organisation ID>in local storage). - The contact form. When you send the form on our contact page, Cloudflare Turnstile checks in a frame from
challenges.cloudflare.comthat the message comes from a person, not a bot. It is needed to keep the form free of spam. The console sign-in page runs the same check.
5. Managing storage
You can delete cookies and local storage in your browser's settings (usually under Privacy or Site data). Deleting the widget's item means the next visit starts a new chat identity; deleting mlc_session signs you out.