User Consent

Depending on how you use Refiner and which privacy regulations apply to you, you may need to obtain user consent before Refiner stores information in the browser or communicates with our servers.

The Refiner JavaScript SDK needs to store certain information in the browser, including a user identifier and timestamps, to be fully operational. This information is used for functions such as recognizing returning users and managing survey delivery.

For more details about what is stored and which browser storage methods are used, see our Local Storage documentation.

The Refiner JavaScript SDK includes consent controls that let you keep Refiner inactive until the required consent has been obtained.

For implementation details and method references, see our JavaScript Client Reference.

When consent is required

In most cases, you do not need an additional consent mechanism when surveying logged-in users inside your application.

Users of a web application have typically already agreed to your Terms of Service and Privacy Policy when creating an account or signing up for your service. These documents usually explain how personal data is processed and which third-party service providers are involved.

Make sure Refiner is listed as a service provider or data processor in the relevant legal documents, where required.

Additional consent requirements are more common when using Refiner on a publicly accessible website, particularly when surveying anonymous visitors.

For example, websites operating in the European Union may need to obtain consent before storing certain information in the browser or communicating with third-party services. In these situations, you are likely already using a Consent Management Platform (CMP) or cookie banner for analytics, advertising, or similar services.

Refiner can be integrated into the same consent flow.

The exact consent requirements applicable to your organization depend on your implementation and applicable privacy regulations. Refiner does not provide legal advice.

How consent management works

If your setup requires explicit consent, you can use the requireUserConsent method to keep the Refiner JavaScript SDK inactive until consent has been given.

While Refiner is waiting for consent:

• No information is stored in Local Storage, Session Storage, or cookies.
• No requests are sent to Refiner’s backend servers.
• Automatic survey campaigns are not evaluated or displayed.

Once your Consent Management Platform confirms that the user has given consent, you can activate Refiner using the confirmUserConsent method.

The consent state is persisted in the browser, so users generally only need to provide consent once per browser or device.

If a user later withdraws their consent, you can use revokeUserConsent to return the SDK to its inactive state.

Showing feedback surveys before consent

Manual surveys are an exception to the behavior described above.

The showForm method continues to work while Refiner is waiting for consent. This allows you to provide an always-available, ad-hoc feedback survey without first activating the full Refiner SDK.

When a survey is shown this way before consent is confirmed, Refiner does not store personal data in client-side storage.

Automatic survey campaigns remain disabled until consent has been given.

Limiting browser storage

In addition to requiring consent, you can limit how long Refiner data remains in the browser.

By default, the JavaScript SDK uses Local Storage, with cookies as a fallback. This allows Refiner to recognize the same browser across sessions.

If your compliance requirements do not allow persistent browser storage, you can configure Refiner to use Session Storage instead using the setClientStorageMethod method.

Session Storage is limited to the current browser session and is cleared when that session ends.

For more details about what Refiner stores in the browser, see our Web Storage & Cookies documentation.

Alternative: Load Refiner after consent

Instead of loading Refiner immediately and keeping it inactive until consent is given, you can also defer loading the JavaScript SDK entirely until your Consent Management Platform confirms consent.

Both approaches are valid. The best option depends on how your website loads third-party scripts and how your consent management solution is configured.