How the disclosure record works
The notice is what the law asks you to do. The record is how you show you did it, on a specific day, to a specific visitor, months later. This page explains what is kept, why it holds no personal data, and how it is used when someone asks.
What is kept each time the notice appears
One entry, with these fields and nothing else:
| Field | Example | Personal data? |
|---|---|---|
| Your website | your site's id in BotNotice | No |
| What happened | notice shown, shown again, a person took over the chat, visitor acknowledged | No |
| Page | the page address, without any query text | No |
| Country and region | US, Texas | No |
| Visitor fingerprint | a short code that changes daily | No, see below |
| Chat session id | an opaque id the notice assigns to the session | No |
| Time | date and time in UTC, to the second | No |
| Link to the previous entry | a cryptographic hash | No |
No IP address, no browser details, no name, no email and no chat content are stored. The record cannot expose your visitors if it is ever seen by the wrong person, and it does not create privacy obligations of its own.
The visitor fingerprint
The fingerprint is a one-way hash: a fixed-length code computed from the visitor's connection details and the date. One-way means it cannot be reversed. There is no key and no lookup table that turns it back into an address or a person. Because the date is part of it, the same visitor gets a different fingerprint tomorrow, so entries cannot be joined into a profile over time. Because it is tied to your website, the same visitor on another BotNotice customer's site gets an unrelated fingerprint.
The point of the fingerprint is not to know who visited. It is to let you confirm, later, that a particular visitor was shown the notice, when that visitor's details arrive with a complaint.
Why the record cannot be quietly changed
Each entry contains a cryptographic hash of its own contents and of the entry before it. That links every entry to the whole history before it. Change one character in any entry, or remove an entry, and every link after that point stops matching. Three things then stand guard:
- A daily check recomputes every link for every site and records the result. A break is flagged on our monitoring the same day.
- A nightly copy of each site's record is written to separate storage, with the copy's own checksum recorded. If the live record and the copy ever differed, the difference would be visible.
- Legal holds stop the normal 7-year retention from removing anything for a site while a matter is open.
The method is standard and documented, so an expert on the other side of a dispute can verify the record independently rather than take our word for it.
When a complaint arrives
Nothing is decrypted, because nothing was encrypted. Matching works by recomputing the same fingerprint from information that comes with the complaint. A typical case:
- A letter in March says: "On September 19 I chatted with your site and was never told it was AI."
- You open the incident kit for that site and enter the date. It returns every entry from that day, the chain check for that period, that night's off-site copy and its checksum, the daily monitoring results showing the notice was present on your pages, and the exact notice wording in force that day from your settings history.
- If your chat provider's logs give the visitor's address and browser for that conversation, or the complainant supplies them, the kit recomputes the fingerprint and pulls the matching entries. You can now say: a visitor with those details was shown the notice at 14:02 UTC on the contact page, before the conversation began.
- If your chat platform stored the session id the notice assigns, the match is exact by session.
- The evidence report packages all of it as one PDF for your lawyer, with the method described so it can be checked.
What makes it usable as evidence
We are not lawyers and this is not legal advice, but the record was designed around the properties that matter when records are questioned:
- Made at the time, in the ordinary course of business, by an automated process. Not prepared after a dispute began.
- Integrity can be demonstrated, not just claimed. The hash chain, the daily checks and the off-site checksums let a records custodian describe how the record was kept, and let the other side test it.
- The wording is contemporaneous. Your settings history shows what the notice said on that date, not what it says today.
- No personal data to argue over. The record shows that a visitor matching the complainant's own details was shown the notice, without your business having collected anything about them.
The honest limits
- The fingerprint corroborates; it does not identify. Shared office networks, VPNs and phones on carrier networks mean several people can share a fingerprint for a day.
- Matching by fingerprint needs the visitor's details from somewhere, usually your chat provider's logs. Without them you still have the day's entries, the monitoring proof and the wording, which is often what a lawyer needs first.
- It proves the notice was displayed, not that it was read.
- Records begin the day your plan with records starts. Nothing is recorded before that, and Chatbot Disclosure keeps no record at all.
Common questions
Does the record identify my visitors?
No. Each entry carries a one-way fingerprint that changes every day. It cannot be turned back into an address, a browser or a person. We never store IP addresses, names or chat content.
Then how can I match a complaint to it?
By recomputing the same fingerprint from the details that come with the complaint, such as the visitor address and browser in your chat provider's logs for that conversation, together with the date. If it matches an entry, you can show that visitor was shown the notice, and when.
What stops someone editing the record?
Every entry is linked to the one before it by a cryptographic hash. Changing or removing any entry breaks every link after it. The chain is checked every day, and a copy of each site's record is written to separate storage every night with its own checksum.
Does it prove the visitor read the notice?
No. It proves the notice was displayed to that visitor at that time, on that page, with the wording in force that day. No system can prove someone read something.
Is this legal advice?
No. The record is evidence you can hand to your lawyer. Whether it is enough for a particular claim depends on the claim, the jurisdiction and the other facts.
See also the Terms of Service on retention, the Privacy Policy, and plans with records.