Installation, identity and privacy
What privacy checks should you make before adding live chat?
Before adding live chat, identify which data the widget and integrations collect, who can access it, and how long it is needed. Review consent settings and your privacy information for your actual use case. A chat product’s technical controls do not by themselves establish that your implementation meets every applicable requirement.
Which information needs an inventory?
List contact details, messages, attachments, page context, custom fields, and account facts returned by integrations. Avoid sending secrets or unnecessary personal details in custom context. Check URLs before recording page history because some applications place sensitive values in query strings.
What should you decide about access?
Give agents access according to their responsibilities and remove access when it is no longer needed. Consider what is stored in internal notes as well as public messages. Private team visibility is different from a guarantee that data is never retained or processed by another service.
What should you verify in your configuration?
Check any required pre-chat agreement, the wording the customer sees, transcript behavior, deletion and retention choices, and the services involved in delivery or AI processing. Get appropriate advice for your circumstances rather than copying another company’s privacy text without checking its fit.
Practical checklist
- Inventory messages, files, page context and custom data.
- Keep secrets out of browser-supplied context.
- Review access and retention decisions.
- Test the actual consent and transcript configuration.
Worked example
An account page includes a reset token in its URL. Passing that entire URL into a support integration could expose more information than the agent needs. Review the host application’s URLs and context design before relying on automatic browsing context.
How Fire Away fits
Fire Away includes configurable pre-chat consent, site access controls, and transcript options. Its private account integrations require a separate identity and authorization design; assess the whole setup rather than treating a widget setting as a compliance certification.