Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
VWO Engage (formerly PushCrew) is a web push notification platform from Wingify, the Indian software company behind VWO. It lets sites send browser push notifications to subscribed visitors with segmentation, triggers and campaigns. For European publishers, VWO Engage involves cross border data transfers to India and explicit consent through the browser push permission prompt, plus appropriate disclosure under GDPR and ePrivacy.
VWO Engage, formerly known as PushCrew, is the web push notification product from Wingify Software Private Limited, an Indian company headquartered in New Delhi and best known for the VWO Testing and Insights platform. VWO Engage lets sites collect push subscriptions via the browser Push API and send targeted notifications to subscribers, with segmentation, automation flows and behavioural triggers. The platform is positioned for publishers, e-commerce sites and content marketers.
VWO Engage captures the browser push subscription (endpoint URL plus public keys), visitor IP, browser, country, OS, language, URLs visited, time on site and any tags or segmentation attributes pushed by the customer. Push deliveries and clicks generate engagement events. The Service Worker required by the Push API runs in the browser and registers on the customer domain.
VWO Engage is a data processor under Art. 28 GDPR for push subscriptions and a controller for its own platform telemetry. The browser push prompt is the technical consent moment, but it must be preceded by a layered notice explaining what notifications cover and how to unsubscribe. Web push is direct marketing under Art. 13 ePrivacy and requires prior consent in B2C. The Push API subscription is a unique identifier triggering Art. 5(3) ePrivacy.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Explicit consent is required for the push subscription itself (granted via the browser permission prompt) and for any behavioural tracking that builds a profile. A double layer prompt (custom in page CTA explaining the value, then browser prompt) is recommended to comply with GDPR validity criteria. An unsubscribe link or in browser revocation must always be available.
Wingify is an Indian company and India has no GDPR adequacy decision. Transfers rely on SCCs and a TIA that accounts for the DPDPA 2023 and the Indian Telegraph Act allowing lawful access by authorities. Some Wingify plans use AWS EU infrastructure for hosted data, but the controller remains an Indian entity.
Sign Wingify''s Data Processing Agreement and SCCs, complete a Transfer Impact Assessment for India, request the EU AWS region when available, use a double prompt for push consent with an explicit value proposition, document VWO Engage in your sub processor list, provide a clear unsubscribe in every notification, and rotate or expire inactive push subscriptions.
Websites using VWO Engage must obtain user consent under GDPR regulations.
DPIA considerations
VWO Engage processes browser push subscription IDs (endpoint URL plus keys), visitor IP, browser, country, page URLs, segmentation attributes and engagement events (deliveries, clicks). Key DPIA considerations: (1) the browser push subscription is itself a unique device identifier and triggers Art. 5(3) ePrivacy; (2) push notifications fall under Art. 13 ePrivacy direct marketing rules and require prior consent in B2C; (3) Wingify is in India with no adequacy decision, SCCs and a TIA are required; (4) segmentation can build a behavioural profile that should be disclosed; (5) the browser permission prompt is the moment of consent but cannot be the only disclosure, a layered notice is needed; (6) integrations with VWO Testing share user IDs between products.
Sample consent text
With your consent and your browser's permission, we use VWO Engage by Wingify to send you web push notifications about new content, offers and updates. VWO Engage processes your browser push subscription, IP and engagement events in the United States, the European Union and India. Transfers to India rely on Standard Contractual Clauses.
Third-party domains contacted
vwo.comengage.vwo.compushcrew.comcdn.pushcrew.comwingify.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| vwo_eng_subscriber | Marketing | 1 year | Stores the VWO Engage subscriber identifier used to associate a browser push subscription with engagement events. |
| vwo_eng_prompt | Functional | 30 days | Tracks whether the visitor has seen or dismissed the push opt in prompt to avoid showing it repeatedly. |
| vwo_eng_segments | Marketing | 6 months | Stores segmentation attributes used to target push notifications to specific subscriber groups. |
VWO Engage places tracking cookies for advertising — comply with GDPR using FlowConsent.
VWO Engage relies primarily on the browser Push API and a Service Worker rather than cookies. The Push subscription endpoint and public keys are identifiers stored by the browser. Some auxiliary first party cookies (vwo_eng_*) may be set for analytics about the prompt and segmentation.
Yes. Web push is direct marketing under Art. 13 ePrivacy and the browser permission prompt alone is not enough. Use a double prompt: an in page CTA explaining the value of notifications, then the browser native prompt. Always provide a clear way to unsubscribe.
Consent (Art. 6(1)(a) GDPR) for the push subscription and for any tracking cookies. The browser push prompt is the technical mechanism but the controller must demonstrate freely given, informed and specific consent. Contract is not sufficient unless push notifications are part of the contracted service the user signed up for.
Wingify is an Indian company. Default processing happens on AWS in India and the United States. EU customers can request the AWS EU region for some plans. Transfers to India rely on Standard Contractual Clauses and a Transfer Impact Assessment that accounts for the DPDPA 2023.
A DPIA is recommended when web push is used at scale, when segmentation builds detailed behavioural profiles or when data is transferred to India. The DPIA should cover the consent UX, retention of subscriptions and engagement events, and the SCC framework for India.
Sign Wingify's DPA and SCCs, run a TIA, request the EU AWS region when available, design a double prompt with clear value proposition, document VWO Engage as a sub processor, provide a one click unsubscribe in every notification and expire inactive subscriptions after a defined period.
EU based or EU friendly web push alternatives include PushPushGo (Poland), Notify Visitors (US/India), OneSignal (US, with EU options), Webpushr (US) and self hosted OpenSource alternatives such as Notiflow or Gotify. Selecting an EU controller with EU data residency simplifies the transfer story.
Disclose Wingify as a data processor based in India, describe the push subscription as an identifier processed for marketing communication, document the categories of behavioural data captured, name AWS EU and India as sub processor locations, mention SCCs and the DPDPA 2023 context, and link Wingify's privacy notice and DPA.