This guide explains how Navu handles website visitor data, what cookies it sets, what controls you have over its behavior, and how to fit all of that into the privacy compliance framework you already run on your site.
Before you start: this is not legal advice
This document describes how Navu works. It is not privacy or legal advice, and it is not a determination that your site is compliant with GDPR, ePrivacy, CCPA/CPRA, LGPD, PIPEDA, Law 25, or any other regime.
Your obligations depend on where your visitors are, what other technology you run, what you disclose, and how you have configured your consent management platform (CMP). Before finalizing your setup, review it with a qualified privacy professional or legal counsel who can assess your specific circumstances.
How Navu processes visitor data
Navu is a first-party processor of your website visitor information. It processes that information on your behalf, for your site.
Two things Navu does not do:
- Navu does not track visitors across different websites. There is no cross-site or cross-domain profile. Data collected on your site stays associated with your site.
- Navu does not sell any of your website data.
The two services Navu provides
Navu offers website owners two services:
- AI Chat — the conversational assistant your visitors interact with.
- Visitor Tracking Analytics — analytics on how visitors move through your site.
You may run either or both.
The three cookies Navu uses
Navu uses three cookies which are all items that are stored in the browser local storage. There is not a one-to-one correlation between the items and the services.
navu-embed-consent
Stores the visitor’s current consent status in browser local storage. It carries no personally identifying information. This item is always stored.
nv-sidebar
Stores the operating state and styling CSS for the Navu sidebar in browser local storage. It carries no personally identifying information. This item is always stored.
navu-embed-state
Stores the information necessary to support Navu’s AI Chat service or Navu’s Visitor Tracking service in browser local storage. This is only stored if one or both services are being provided. Navu’s Visitor Tracking service is only provided if the visitor has explicitly or implicitly granted consent for Analytics Cookies via the CMP.
- For AI Chat, it stores the minimal information needed to keep a chat conversation continuous as the visitor moves through your site.
- For Visitor Tracking, it stores information about the visitor’s journey through your site.
Categorize all as Necessary
These local storage items should be added to the Necessary category in your CMP.
What governs Navu’s privacy behavior
Four inputs determine how Navu behaves for any given visitor:
- Consent management settings
- Navu configuration (set in the Navu Portal)
- Browser Do Not Track (DNT) and Global Privacy Control (GPC) settings
- Visitor location
Consent Management Platform (Cookie Manager) settings
The standard and recommended configuration for the Navu Tracking Settings is to specify your CMP in the Navu Portal. With your CMP identified, Navu’s CMP integration simply honours the settings from your CMP effectively deferring all visitor privacy choices to the CMP. Furthermore, Navu monitors CMP settings throughout the visitor’s journey, not just on the first page load, ensuring Navu remains current with the visitor’s current consent status as that may change throughout the visitor’s journey.
Navu settings
These live in the Navu Portal under Settings → Tracking.
CMP selection (default: Auto)
- Auto — Navu detects the CMP in use automatically. For CMPs it can detect, Navu reads the visitor’s consent state automatically.
- A specific supported CMP — if your CMP appears in the list, select it.
- Ignore CMP and track regardless — Navu ignores the consent state stored in the CMP when deciding whether to provide Visitor Tracking. For testing only.
- Ignore CMP and track non-European visitors — Navu ignores the CMP consent state when deciding whether to provide Visitor Tracking, and never provides Visitor Tracking to visitors from European countries. For testing only.
Always require explicit consent (default: off)
This can be used to override how Navu interprets the initial consent status reported by the CMP. In the unusual case where Navu should ignore the consent status reported by the CMP, this setting, when on, will ensure Navu provides no tracking services (regardless of the visitor’s location) until explicit consent is granted through the CMP. Use this when your framework requires opt-in behavior everywhere (not just in opt-in jurisdictions) AND your CMP does not support that requirement.
Disable tracking (default: off)
When on, Navu will not provide tracking services at all, regardless of every other setting listed here. This is the master switch.
Browser settings
If a visitor has set the Do Not Track or Global Privacy Control flag in their browser, Navu treats that — regardless of the visitor’s location — as equivalent to rejecting analytics tracking. That treatment can be overridden later only by an explicit grant of consent through the CMP.
Visitor location
Opt-in locations: the EEA/EU, the UK, Turkey, Argentina, Colombia, Peru, China, South Korea, Brazil, and Quebec.
In these locations, Navu will not store the navu-embed-state item in local storage unless and until one of two things happens, both of which render this item necessary:
- The visitor expressly consents to visitor tracking via the CMP – typically by enabling analytics cookies. This stores the navu-embed-state item and uses it to support Visitor Tracking.
- The visitor starts interacting with the AI Chat. This stores the navu-embed-state item and uses it to support AI Chat services.
Opt-out locations: every location not listed above.
The navu-embed-state item is stored and both Visitor Tracking and AI Chat services are provided as soon as the visitor arrives. Visitor Tracking stops immediately if and when the visitor withdraws consent for analytics tracking via the CMP.
Integrating with your privacy compliance framework
- Select your CMP from the CMP list under Settings → Tracking. If your CMP is not listed, select Auto. This is sufficient for most frameworks.
- Add the Navu local storage items to your CMP and categorize them as Necessary.
- Check your disclosures. Make sure your consent banner and other public-facing privacy information accurately describe your site’s functionality, including Navu’s AI Chat and analytics.
Exceptions
- If you do not want Visitor Tracking at all, turn on Disable tracking in the Navu Portal under Settings → Tracking.
- If your framework requires that, regardless of location, Visitor Tracking shall not be provided until consent is explicitly given via the CMP, turn on Always require explicit consent under Settings → Tracking.
What you get with the defaults
With default tracking settings, your CMP selected in the Navu Portal, and Navu’s cookies added to your CMP, Navu is designed to support compliance with standard privacy frameworks in both opt-in and opt-out locations. Whether your site as a whole meets its obligations also depends on your other technology, your disclosures, and how your CMP is configured.
Further considerations
Custom privacy compliance frameworks
If your site runs a custom privacy compliance implementation rather than a standard CMP, Navu offers a JavaScript API to support it. See the custom CMP documentation.
Gating the Navu embed code
There is no way to delay loading the Navu embed code based on CMP state or other privacy signals using Navu settings, but if you choose to do this with custom code (not recommended), here are some important considerations.
Consent state consistency. All settings described above dictate Navu’s behavior from the moment the Navu embed code loads. Design carefully so that Navu’s behavior after loading is consistent with the expected behavior before loading. Otherwise you can end up with a mismatch between what the visitor consented to and how Navu initializes.
User experience. Delaying the embed code can produce a poor experience and cumulative layout shift (CLS) since the AI Chat will render noticeably later than the rest of the page.