Visitor context

Every website chat, anonymous or signed in, carries context for the agent. It appears in the conversation's Visitor card, directly under the contact card, so the agent can answer without asking "which page are you on?".

What agents see

Signed customer attributes from identify are shown separately, in the Customer card, as verified.

When it is collected

Nothing about a visitor who never writes leaves their browser. The loader keeps the visit in your site's own storage, and the chat sends it to Kommio only with the visitor's first message. While the conversation lasts, page changes are sent as they happen, including client-side navigation in single-page apps (pushState, replaceState and popstate).

What the loader keeps on your site, in the visitor's browser:

The loader sets no cookies on your site.

Addresses are cut down before they are kept

• Page addresses keep only the scheme, host, path and utm_* parameters. Fragments, credentials and every other query parameter (session ids, tokens, emails in links) are dropped.
• Ad click ids (gclid, fbclid, msclkid, ttclid, li_fat_id, and Google's gbraid, wbraid and dclid) are reduced to the platform they name; the id itself is never kept.
• Page titles are kept up to 300 characters, the trail to the last 20 pages.

What your page can add

Pass the state the agent should see, such as a cart, with Kommio.setContext:

window.Kommio.setContext({ cart_items: 2, cart_total: 49.9, currency: 'EUR' });
window.Kommio.setContext(null); // clears it

A flat object of up to 30 keys (names up to 40 characters, string values up to 200, numbers, booleans), replaced on each call and stored per conversation. It is unsigned, so agents see it as "provided by the page, not verified". For facts they should trust, send signed attributes. Call it after the loader has run, for example from the script tag's onload.

JavaScript errors (opt-in)

Turn on Show agents recent JavaScript errors of the page under Settings → Inboxes → the inbox → Visitor details (capture_js_errors; off by default). The widget then sends the page's last five JavaScript errors with the visitor context: uncaught errors and unhandled promise rejections, each with the message, script file and line, the time and at most five stack lines, with query strings removed. Errors are captured from the moment the loader runs, so load it early if you rely on this. Without the setting, errors never leave the page.

Privacy controls

IP address

How much of the IP address is stored is a workspace setting, under Settings → Privacy (privacy.visitor_ip):

Location is looked up before the address is shortened, so country and city still show with truncated or none. The lookup uses DB-IP's offline Lite databases, so the address is never sent to a third party; the card shows DB-IP's credit next to the location. The IP address is a protected field: the Agent, Restricted agent and Viewer roles see it masked or hidden unless an administrator changes the role.

Retention and erasure

Visitor context, and the page each visitor message was sent from, is deleted a set number of days after it last changed: retention.visitor_context_days, 365 by default, under the workspace's retention settings. Erasing a contact removes it too.

A signed-in visitor's session, the name, email and attributes your site signed, kept apart from Contacts until the visitor chats, has its own setting: retention.widget_sessions_days, 30 by default, deletes sessions whose visitor was not seen for that long. Erasing a contact deletes its sessions as well. Anonymous visitors have no session row to keep or delete; nothing about them is stored until they write.

What is left out on purpose

No typing preview (agents do not see what a visitor types before they send it), no co-browsing, and no browser fingerprinting: an anonymous visitor is recognised only by the random session token their browser keeps (see Identify signed-in visitors). The IP-based location and the browser details above are still collected and shown to agents.

Read it from the API

curl "$KOMMIO_URL/conversations/812/visitor" -H "Authorization: Bearer $KOMMIO_KEY"

const { data } = await api.GET("/conversations/{id}/visitor", { params: { path: { id: 812 } } });
console.log(data.online, data.past_conversations, data.visitor?.trail);

The answer has online, the visitor's number of past_conversations, and visitor with the fields above (trail, current_page, landing_page, referrer, utm, ad_platform, visit_count, first_seen_at, screen, languages, timezone, browser, os, device, ip, country, city, org, tor, likely_vpn, page_context, js_errors and more). Fields the caller's role may not see are listed in _redacted. The full schema is in the OpenAPI contract every server serves at /api/openapi.