whichaisent
Trust & data at a glance

The short answer for your security questionnaire

One page for agencies, buyers and app reviewers: what Which AI Sent collects, what it never touches, and how the data is protected. The full details are on Data & tracking, Security, the Privacy policy and the Data processing agreement. Last updated October 22, 2026.

At a glance

What the script collects

  • A random visitor ID and visit ID (first-party cookie _ta_vid, 90 days, and local storage _ta)
  • Where the visit came from: the referring site’s address only, campaign tags (utm_*), and whether an ad click ID was present (never its value)
  • Pages viewed (path and title), phone or computer, active time on the site
  • Clicks on phone, email, WhatsApp, text and booking links (kind of link and page)
  • From contact and quote forms: the visitor’s name, email, phone, and “how did you hear about us” answer

What it never touches

  • Passwords, sign-in, verification-code and payment fields, and any form that contains one
  • Message boxes, free text and hidden fields
  • Sign-in, sign-up, newsletter, checkout and search forms
  • Keystrokes, screen recordings or anything after “?” or “#” in a page address
  • IP addresses (not stored), advertising cookies, cross-site tracking

The questions buyers ask

QuestionAnswer
Who chooses which forms are read?On Webflow, the site owner: they tick the form and pick each field (name, email, phone) in our dashboard, and nothing else is read. On other platforms the script reads only forms that show they are for contact or a quote, and owners can include or exclude any form with one attribute.
Does it respect cookie consent?Yes. With “wait for consent” on, nothing is stored or sent until the visitor accepts analytics cookies. It reads the site’s own consent command and common banners (Cookiebot, CookieYes, OneTrust, Complianz, Finsweet, Google consent mode). Global Privacy Control is supported.
What happens if a visitor withdraws consent?The script stops on that page: it deletes its cookie and storage and sends, stores and reads nothing more. On Webflow it also removes its listeners and anything it added to the page.
Does it change our website?No, apart from one optional question (“How did you first hear about us?”) that is off unless you switch it on.
Is the script safe to load?One asynchronous script that loads no other code. On Webflow it is a fixed, versioned file with an integrity hash, so browsers refuse it if a single byte changes.
Where is data stored?On Cloudflare (hosting and database). It may be processed in the United States, the European Union and other countries where Cloudflare operates.
Is it encrypted?In transit: HTTPS only, with HSTS. At rest: Cloudflare encrypts stored data; platform access tokens are additionally encrypted by us (AES-GCM, key kept outside the database); passwords are salted one-way hashes.
Who can see a client’s data?Only that client’s logins, plus view-only links they create (and can turn off). Data is never combined across customers, sold or used for advertising.
How long is data kept?While the account is active. After it ends: 30 days to export, deleted from live systems within 90 days, backups roll off within a further 30.
Breach notification?Without undue delay, and within 72 hours where feasible (see the DPA).
Subprocessors?Cloudflare (hosting, database), Resend (account emails), Paddle (payments, merchant of record), OpenAI / Anthropic (help chat and AI visibility checks only: never visitor or customer data). 14 days’ notice before changes.
Access to our platforms?Only through each platform’s own approval screen, with the narrowest permissions: Google Tag Manager (one permission, Google-verified), WordPress (plugin reviewed by WordPress.org), Webflow (read sites, edit custom code). We never publish on your behalf.
Can we remove it?Any time: “Stop tracking this website” in Setup stops collection at once and removes our script where the platform allows it. Deleting a website deletes its data.
Who is the company?Which AI Sent is built and operated by Tamitechs. Security contact: info@whichaisent.com (subject “Security”), reply within 2 business days. security.txt.

Documents