Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
WotNot is a no code chatbot and conversational AI platform that adds a chat widget to a website to capture leads, answer questions and route conversations. Its widget sets cookies to maintain the chat session and recognise returning visitors, and it stores the content of conversations, which can include personal data. Under the GDPR and the ePrivacy Directive, its non essential cookies require prior consent and conversation data must be handled lawfully.
WotNot is a no code platform for building chatbots and live chat experiences without programming. Websites embed its JavaScript widget to greet visitors, qualify leads, answer common questions and hand over to a human agent when needed. It is aimed at marketing, sales and support teams that want conversational automation.
The WotNot widget sets cookies to keep the chat session active, recognise returning visitors and remember conversation state. It also stores the messages exchanged, which can contain names, email addresses, phone numbers and any other personal data a visitor types. It may read device data such as IP address, browser and page context.
The session and visitor cookies that are not strictly necessary fall under Article 5(3) of the ePrivacy Directive and require consent, while a genuinely essential session cookie for an active chat may be exempt. The conversation content is personal data under the GDPR, so you need a lawful basis, clear information and appropriate retention for the chat logs.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Load the WotNot widget through a Consent Management Platform so its non essential cookies are set only after consent, while still allowing an essential cookie needed for an active conversation the visitor has started. Inform visitors that the chat is recorded, log consent, and let them refuse non essential tracking as easily as they accept.
WotNot is operated from India and may use cloud infrastructure in the United States, so conversation and visitor data may be transferred outside the European Economic Area. Because India does not have an EU adequacy decision, these transfers must rely on Standard Contractual Clauses with a Transfer Impact Assessment. Document the recipients and safeguards.
List the WotNot cookies and domains in your cookie policy and gate the non essential ones behind consent. Sign a data processing agreement, define retention for chat logs, and inform visitors that conversations are stored and where data is processed. Put SCCs and a Transfer Impact Assessment in place and review the integration when WotNot updates its widget.
Websites using WotNot must obtain user consent under GDPR regulations.
DPIA considerations
WotNot sets cookies and stores the content of conversations, which can include names, email addresses, phone numbers and other personal data. Key DPIA considerations: (1) the visitor recognition cookies are not strictly necessary identifiers requiring consent; (2) chat logs are personal data, sometimes sensitive; (3) data may be transferred to India and the United States, requiring safeguards; (4) a retention period for conversations must be set. A DPIA is advisable.
Sample consent text
We use WotNot to offer a chat on our site. The WotNot widget sets cookies, records the content of your conversation and may process data in India and the United States. You can withdraw your consent to non essential cookies at any time through our cookie settings.
Third-party domains contacted
wotnot.iowidget.wotnot.ioapi.wotnot.ioCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| wotnot_session | Functional | Session | Keeps the chat session active and stores the state of an ongoing conversation. |
| wotnot_visitor | Analytics | 1 year | Recognises returning visitors and links conversations across visits. |
WotNot uses cookies for user preferences — inform visitors with a consent banner.
WotNot sets cookies to keep the chat session active, recognise returning visitors and remember conversation state. A cookie strictly needed for an active conversation the visitor started may be essential, but the visitor recognition cookies are not strictly necessary and require consent.
Yes for the non essential cookies. The visitor recognition and analytics cookies WotNot sets need prior consent under the GDPR and the ePrivacy Directive, so they should not load until the visitor accepts. An essential session cookie for a chat the visitor has started can be treated differently.
Consent under Article 6(1)(a) GDPR covers the non essential cookies. Handling the conversation the visitor initiated can rely on legitimate interest or, for a sales or support request, on steps prior to a contract. You must inform visitors that the chat is stored and set a retention period.
Yes. WotNot is operated from India and may use US infrastructure, so conversation and visitor data may be transferred outside the EEA. India has no EU adequacy decision, so transfers must rely on Standard Contractual Clauses with a Transfer Impact Assessment.
A DPIA is advisable because chat logs can contain personal data, sometimes sensitive, and are transferred outside the EEA. Documenting the purposes, the retention, the safeguards and the international transfer supports Article 35 GDPR compliance.
Add WotNot through a CMP that blocks non essential cookies until consent, keep any essential chat session cookie separate, and inform visitors that conversations are recorded. Sign a data processing agreement, set chat log retention, put SCCs in place for the transfer, and disclose cookies and recipients.
Other chatbot and live chat tools include Intercom, Crisp, Tidio and Landbot, some of which process data in the EU and can reduce transfer complexity. All set chat cookies and store conversations, so consent gating, retention limits and clear information remain essential.
Describe the WotNot cookies, their purpose and duration, list the WotNot domains, and state that conversation and visitor data may be processed in India and the United States. Explain in your privacy notice that chats are stored, for how long, and the transfer safeguards.