Cookie and opt-in options on our platform
For our users to access our management dashboards, we do use cookies for keeping the authentication state of logged-in managers. This fits within the scope of legitimate interest under the GDPR. However, this page explains how we deal with cookies for end users - i.e. the people who interact with our AI assistants or other components - regular people.
We offer several options for managing opt-ins and cookies on our platform. Please note that this is not legal advice; each situation is unique, so it’s essential to review our Data Processing Addendum and consult legal experts.
By default, Unless does not use cookies
By default, Unless does not use cookies for end users or track end users, allowing you to utilize our components and AI without user tracking. However, to maintain consistent conversations within a session, we do store session-specific user states, which end when the session concludes.
Additional features are available if cookies are permitted. To enable Unless cookies, you have two options:
- User Consent: Visitors can opt-in through your consent mechanism using our Consent API, or you can set consent with this API in the case of legitimate use.
- Identification for Logged-In Users: The Identify API can be used for logged-in users, assuming there’s legitimate interest under GDPR.
For legitimate use under the GDPR, you could also switch on automatic consent in the Unless dashboard, but we recommend managing this with the APIs.
With any of these options enabled, additional features can be applied to consenting users:
- A/B Testing: Tracks control group membership across sessions.
- Audiences: Maintains consistent experiences across visits or sessions, and helps to make specific content available or unavailable.
- User Profiles: Enables accessing content based on information that is supplied by your company to Unless, such as specific help information that is based on the end user's subscription plan.
- Chat History: Enables accessing earlier conversations that the end user had with the Unless AI.
When these APIs are used correctly, our system will only enable tracking after consent, showing only cookieless experiences for users who have not opted in. So, without any form of opt-in, these features simply don't do anything for that particular user.
Cookies used by Unless after consent
When a user has either consented or logged in, the following cookies may be used:
unless_id
- Purpose: Stores a unique visitor ID, set only after user consent.
- Use Case: Allows a visitor to remain a part of specific audiences for A/B testing and ensures consistent experiences.
- Expiration: Expires after one year, upon consent withdrawal, or when cookies are cleared.
unless_sid
- Purpose: Stores a session ID, set only after user consent.
- Use Case: Tracks session goals, such as AI interactions, which contribute to analytics and A/B test results.
- Expiration: Expires at session end or upon consent withdrawal; a new session ID is generated for each visit, if consent is given.
When to explicitly ask for consent
Your use of Unless determines whether you'll need to ask for consent or enable it automatically. In general, you need consent for any non‑essential tracking technology that stores or reads information on a user’s device in the EU (or UK), if it is not strictly necessary to provide the service they asked for.
If tracking is used only to make the service technically work, it can be considered “strictly necessary”. If it is used to measure, optimise, personalise, or advertise, you generally need consent. For anonymous users this is often done via a cookie banner; for logged‑in users it can also be handled through clear terms when they sign up.
Always confirm the right approach with your legal team. However, in general, we advise to be transparent in any case - so even for necessary use of cookies or other tracking.
So, when is your use of Unless tracking strictly necessary? This depends on which features you enable: A/B testing, Audiences, User Profiles, or Chat History. To decide, use this question:
“If I remove this feature, does an important part of the service stop working?”
Applied to the main Unless features:
- A/B testing: This is about optimisation, so you will almost always need consent.
- Audiences:
- If used for marketing (for example, showing promotions to specific groups), you should ask for consent.
- If used to give people the right access or content (for example, showing relevant documentation or AI skills only to a subset of your end users), it may be considered a legitimate, necessary use.
- User Profiles: Follows the same logic as Audiences, but only for identified end users.
- Chat History: Only for identified end users and used to show past conversations in the AI client. In many cases this is seen as a legitimate, expected part of the service.
We hope this helps!
