Concept: juridische controle vereist
This is a working draft prepared for legal review. It is not yet final and does not constitute legal advice. The final text is fixed by the operator’s legal counsel before launch.
What the ZoraMatch widget collects
The chat widget and the embedded form: what they send us, what they leave in your browser, and what they deliberately do not do.
Last updated 1 October 2026
This page explains what happens when you talk to Zora, the assistant ZoraMatch provides to the company whose website you are on. It is written for visitors, and suppliers are welcome to link to it from their own privacy notice.
Two ways you may meet it
- The chat bubble. A small script from ZoraMatch runs on the company's website and opens a chat panel when you click it.
- The embedded form. A quote form served by ZoraMatch inside a frame on the company's page. It replaces an ordinary contact form.
What the chat widget sends, and when
| Moment | What is sent | What we keep |
|---|---|---|
| The page loads | The script asks us how this company's widget should look and whether it is active. Like any web request, it carries your IP address and the address of the site it runs on. | Nothing. No conversation is recorded if you never open the chat. |
| You open the chat | The language of the page, or the language you pick. | A conversation record with the language, the time, and the host name of the website the widget runs on (for example example.com), never the page address. |
| You send a message | The text you typed, and the language. | Your message and Zora's reply, with the conversation. If you give your name, company or work email in the chat, that is part of the message. |
| You switch language | The messages Zora has already shown you, so they can be translated in place. | The translated versions, with the conversation. |
| You send the request | A note that you clicked to send, and the reference to the conversation. | The conversation becomes a request for the company, with the same host name attached, and they receive it in their ZoraMatch inbox. |
What it does not do
- It sets no cookie on the company's website.
- It reads nothing else from the page: no form fields, no other content, no page address, no page title.
- It builds no page-by-page statistics. We count, per company, that a conversation started and that a request was sent, nothing finer.
- It does not follow you to other websites and builds no profile of you across them.
What stays in your browser
The widget keeps two small things in your own browser, on the company's domain. Neither is sent anywhere and neither identifies you elsewhere.
- A session entry holding the reference to your conversation, its signed session key, the messages shown and your language, so a reload does not lose the chat. It lives in the tab's session storage: gone when you close the tab, and ignored after 24 hours.
- If you dismiss the small greeting bubble, one timestamp in local storage keeps it closed for seven days.
The embedded form
The embedded form is served by ZoraMatch from app.zoramatch.com inside the company's page. Because it is our page rather than theirs, it does set one cookie of its own, zoramatch_screening. It holds a signed reference to your conversation and nothing else, it cannot be read by JavaScript, it is limited to the site you are visiting (a partitioned cookie), and it expires after 30 days. It is what lets you reload the page without losing what you typed. The form reads nothing from the page around it.
Because the form is one of our own pages, it also counts as a page view in our hosting provider's analytics. That counter sets no cookie, records the address of the form itself rather than the page it sits in, and is not linked to your conversation.
Your IP address and abuse protection
To keep the chat from being abused, our widget routes count requests per IP address per company. Your IP address is held as part of a counter key in a small table, it is not stored with your conversation, and a daily clean-up deletes those counters once they are more than 48 hours old.
The AI that answers you
Your messages go to the AI providers that generate Zora's replies and turn the conversation into a structured request. Who they are, and where they process, is listed in the Privacy Statement.
What the supplier receives
The company whose website you are on receives the conversation, the structured summary of your request, and the details you gave, such as your name, company and work email. They also see the host name of the site the conversation started on. A request that starts on a company's own widget stays with that company: it is never shown to other suppliers and never enters the marketplace.
Why it is processed, and who is responsible
Your conversation is processed for one purpose: to turn what you asked into a request the company can answer. The company whose website you are on is the party you are dealing with. The request is theirs, they decide what happens with it, and they are responsible for it under data protection law. ZoraMatch runs the platform for them and keeps the platform record, and uses your conversation for nothing else: not for marketing, not for a profile of you, and not for other suppliers.
Two exceptions. If you leave the embedded form after giving an email address, we may send you a single reminder to finish your request. If you sent a request without creating an account, we send you a single reminder two days later, with a link to your request and an invitation to create an account. Both have an unsubscribe link in them. Apart from mail about your request itself, such as the confirmation and the company's replies, we send nothing else.
How long it is kept
A conversation that becomes a request is kept as part of the company's account with us: for as long as that account exists and up to one year after it ends, or until the company or you ask for it to be deleted. A conversation you start and never send is kept on the same terms until it is deleted on request. The abuse counters that hold your IP address are deleted after 48 hours, and the two entries in your own browser expire on their own, as described above.
Your rights and who to ask
You can ask for a copy of your data, for correction or deletion, or object to the processing. Write to the company you contacted, or to us at contact@zoramatch.com.