Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Convertful is a US, based onsite conversion optimisation tool that displays popups, slide, ins, gamified opt, ins and embedded forms to capture email leads. The widget tracks visitor behaviour with first, party cookies to optimise display timing and frequency, then synchronises captured emails to popular CRM and email platforms. Because Convertful both writes identifying cookies and processes lead data on US servers, it requires consent under EU rules.
Convertful is an onsite conversion optimisation platform launched in 2017 by Convertful Inc. and operated from the United States. It targets ecommerce stores, content publishers, and SaaS companies that want to convert anonymous traffic into newsletter subscribers, leads, or buyers. The product offers a drag, and, drop builder with templates for exit, intent popups, slide, ins, embedded inline forms, gamified opt, ins (spin, the, wheel, scratch cards), survey funnels, and announcement bars. Captured emails sync into 30, plus marketing platforms (Mailchimp, ActiveCampaign, ConvertKit, Klaviyo, HubSpot) through native integrations or webhooks. The widget loads from convertful.com or a CDN endpoint and is added with a single JavaScript snippet.
Convertful writes a first, party cookie called cnvf_visitor (typically 1 year) used to recognise returning visitors, enforce frequency caps, and attribute conversions to a popup. A second cookie cnvf_session captures the current session ID. The widget also writes a localStorage entry to remember which popups have been shown and dismissed. On the server side, Convertful logs visitor IP addresses, user agent strings, page URLs, scroll behaviour, and any data the visitor enters into a popup field (typically email, name, phone). When the email is forwarded to a downstream ESP, Convertful retains a copy of the lead in its dashboard for reporting purposes.
Convertful sits at the intersection of cookies and direct marketing, both of which are regulated under the ePrivacy Directive and GDPR. The cnvf_visitor cookie and the localStorage entry require prior consent under Article 5(3) ePrivacy because they go beyond strictly necessary functionality. The email address captured in the popup is personal data; processing it for marketing requires a separate, granular consent that meets the Article 7 GDPR requirements (freely given, specific, informed, unambiguous). Crucially, the same checkbox cannot bundle the cookie consent and the marketing consent, that practice has been sanctioned multiple times by the CNIL and the Spanish AEPD.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Two consents are typically needed. First, the Convertful widget must be loaded only after the visitor has accepted the Marketing or Functional category in the CMP, so the cookies and tracking script do not fire on refusal. Second, every popup that captures personal data must include a clear privacy notice and an explicit opt, in mechanism for the marketing communications that follow. Pre, ticked boxes are not valid consent. The opt, in record (timestamp, IP, exact wording shown) should be stored to demonstrate compliance under Article 7(1) GDPR.
All Convertful data is hosted in the United States on AWS. Convertful Inc. is not currently certified under the EU, US Data Privacy Framework, so the contractual basis for the transfer is the set of Standard Contractual Clauses included in the DPA, complemented by a Transfer Impact Assessment. The TIA must consider the type of data captured (email and name in most cases, but sometimes more sensitive answers in survey funnels), the volume of European visitors, and the additional sub, processors involved (the ESP that ultimately stores the email). For high, scale European deployments, EU, hosted alternatives are easier to defend.
Sign a DPA with Convertful Inc., gate the widget script behind the Marketing or Functional category of your CMP, and never load it before the consent event. Configure each popup with an explicit double, opt, in for the email list (single, opt, in is allowed under GDPR but double, opt, in provides stronger evidence of consent). Set a reasonable retention period for the captured leads in both Convertful and the downstream ESP. Document the chain of sub, processors in the privacy policy. For European audiences sensitive to US transfers, consider EU, hosted alternatives such as Mailerlite Popups (Lithuania), Brevo Forms (France), or open source tools like Sumo replaced by Convert (Belgium).
Websites using Convertful must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended when Convertful is used at scale, when popups capture sensitive data (financial, health, vulnerability indicators), or when the email leads are passed into automated marketing flows for B2C customers. The combination of US storage and persistent visitor tracking elevates the risk profile. Document the DPA with Convertful Inc., the legal basis for both the cookies and the lead capture, the retention period of the leads, and the downstream sub, processors that receive the email addresses (CRM, ESP).
Sample consent text
We use Convertful to display promotional popups and to collect email subscriptions on our website. Convertful sets a first, party cookie (cnvf_visitor) to manage popup display frequency and stores any data you submit on its servers in the United States. Do you accept the use of Convertful for marketing and personalisation purposes?
Third-party domains contacted
convertful.comapp.convertful.comcdn.convertful.comstatic.convertful.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| cnvf_visitor | first-party | 1 year | Unique visitor identifier set by the Convertful widget. Used to recognise returning visitors, enforce popup frequency caps and attribute conversions to a specific opt-in. |
| cnvf_session | first-party | Session | Session identifier used by Convertful to group page views and popup interactions during a single browsing session. |
Convertful places tracking cookies for advertising — comply with GDPR using FlowConsent.
Convertful writes a first, party cookie cnvf_visitor (typically 1 year) used to recognise returning visitors, enforce frequency caps and attribute conversions, and a session cookie cnvf_session for the current session. The widget also writes a localStorage entry to remember which popups have been shown and dismissed.
Yes. Both the cnvf_visitor cookie and the localStorage entry go beyond strictly necessary functionality and require prior consent under Article 5(3) of the ePrivacy Directive. The Convertful widget script must be loaded only after the visitor has accepted the Marketing or Functional consent category in your CMP.
Consent (GDPR Article 6(1)(a)) for the cookies and the marketing email opt, in collected through the popup. The two consents must be granular and cannot be bundled into a single checkbox. Pre, ticked boxes are not valid. Keep an audit trail (timestamp, IP, exact wording) for each subscription.
Yes. Convertful Inc. processes all data on AWS infrastructure in the US. SCCs are signed in the DPA. Convertful is not currently certified under the EU, US Data Privacy Framework, so a Transfer Impact Assessment is recommended, especially for B2C deployments at scale.
A DPIA is recommended when Convertful is used at scale, when popups capture sensitive data, or when leads are pushed into automated marketing flows targeting consumers. The combination of US storage, persistent cookies and direct marketing makes the residual risk medium, which often crosses the DPIA threshold.
Sign a DPA with Convertful Inc., gate the widget behind the CMP, use a granular opt, in inside the popup with explicit privacy notice, prefer double opt, in for the email list, set retention periods in both Convertful and the downstream ESP, and document the SCCs plus a Transfer Impact Assessment for the US transfer.
EU, hosted alternatives include Mailerlite Popups (Lithuania), Brevo Forms (France), Klaviyo with EU residency, Convert (Belgium), Mautic (open source, self, hostable), and Optimonk (Hungary, EU). For minimal privacy footprint, simple HTML forms wired to your own backend are also viable.
List Convertful as a sub, processor with the cookies cnvf_visitor (1 year) and cnvf_session (session), plus the localStorage entry. State that Convertful Inc. is the processor, the United States is the data location, and SCCs are the transfer safeguard. Mention the email lists or CRM systems that ultimately receive the leads.