1. Categories
Essential: required for sessions, security, CSRF, routing, language, dashboard preferences, cookie banner, passkeys and admin impersonation.
Analytics: traffic and usage measurement such as Google Analytics, only after consent and if configured.
Marketing: campaign attribution and remarketing such as Meta Pixel, Google Ads or LinkedIn Insight Tag, only after consent and if configured.
2. Identifiers
AIVoice may use aivoice_cookie_consent_v1, aivoice_consent_subject_id_v1, NEXT_LOCALE, sidebar:state, next-auth.session-token, __Secure-next-auth.session-token, __Host-next-auth.session-token, voiceai_passkey_reg_challenge, voiceai_passkey_auth_challenge and voiceai_admin_impersonation.
Retention depends on the feature: passkey challenges are short-lived, consent and language may last up to 12 months, and sessions expire according to security settings.
3. Consent ledger
When preferences are saved, we store a local decision and a server-side consent event with subject ID, anonymous/authenticated mode, categories, policy versions, language, IP, user-agent, referer and timestamp.
Optional consent can be withdrawn through the banner, privacy settings or support.
4. Customer widget
A widget embedded on a customer website may require cookies or storage for the conversation session, language, connection stability and security. Customers should describe their widget deployment in their own privacy/cookie notice.
AIVoice does not require a public Gemini key in the browser; AI runtime goes through gateway/server-side flows and provider-key pools.