> Is ChurnZero GDPR compliant? How its SDK tracks SaaS users, why consent is required, how EU US transfers rely on SCCs and the DPF, and the privacy policy. > > Canonical: https://www.flowconsent.com/en/services/analytics/churnzero Analytics # ChurnZero Analytics · [Official website](https://churnzero.net) ChurnZero is a US based customer success platform used by SaaS companies to track product usage, score customer health, run NPS surveys and deliver in app messages, walkthroughs and Net Renewal Revenue plays. The JavaScript SDK loaded from analytics.churnzero.net writes first party cookies on the SaaS application, sends events to AWS US East and feeds dashboards visible to Customer Success Managers. EU customers can request data residency in AWS Frankfurt as a paid add on. [Block ChurnZero until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers United States (ChurnZero Inc., Arlington, Virginia, headquarters); production hosted on AWS US East 1 (Northern Virginia) and US East 2 (Ohio); EU data residency on AWS Frankfurt (eu central 1) is available as a paid add on for enterprise plans Overview ## What does ChurnZero do? ## **What is ChurnZero?** ChurnZero is a customer success platform incorporated as ChurnZero Inc. in Arlington, Virginia (USA). SaaS companies install the ChurnZero JavaScript SDK in their product to track every user action, the accounts those users belong to and the contracts behind them. The platform then produces health scores, automated playbooks, journey orchestrations, in app messages, walkthroughs and NPS surveys, and feeds the result back to Customer Success Managers in dashboards and to CRMs such as Salesforce or HubSpot. ## **Cookies and data collected** The SDK writes first party cookies on the customer's SaaS application (cz\_session, cz\_visitor) and a localStorage object that stores the ChurnZero contact ID, the account ID, the last seen timestamp and a synthetic event queue. Every event, page view and feature usage is sent over HTTPS to analytics.churnzero.net. Customer Success Managers can also import data from the customer's CRM, support tool and billing system, which is then enriched with ChurnZero's own behavioural data. ## **GDPR and ePrivacy implications** ChurnZero processes personal data of authenticated users, which under the GDPR is fully covered. Under Art. 5(3) ePrivacy the cz\_session and cz\_visitor cookies and the localStorage identifiers are not strictly necessary to deliver the SaaS service the user has paid for, so they require prior consent in the EU, even for B2B users. Health scoring and account level playbooks are also forms of profiling under Art. 4(4) and may trigger Art. 22 if decisions about the customer (price increases, downsell, automated emails) are taken without meaningful human intervention. ## **Consent and legal basis** For authenticated SaaS users, B2B legitimate interest can support behavioural analytics necessary to operate the contract and to prevent churn, provided a balancing test is documented and the user can object at any time. The cookies and localStorage themselves still require Art. 5(3) ePrivacy consent in most EU member states. In practice many SaaS companies surface a settings toggle Allow product analytics and respect Do Not Track or a CMP signal. ## **International data transfers** By default, ChurnZero processes EU customer data on AWS US East regions. EU data residency on AWS Frankfurt is available as a contractual add on for enterprise plans. The ChurnZero DPA includes the EU Standard Contractual Clauses (modules 2 and 3), the UK International Data Transfer Addendum, and references the EU US Data Privacy Framework. A Transfer Impact Assessment should review US surveillance laws and the additional risk of full text NPS comments and free text in app survey responses being processed in the US. ## **Practical compliance steps** Sign the ChurnZero DPA, request EU data residency if available on your plan, integrate the SDK behind a product analytics toggle in your user settings or CMP, disclose ChurnZero in the privacy notice for your SaaS users, add the tool to your Article 30 record, document a Legitimate Interest Assessment and a Transfer Impact Assessment, and ensure that automated CS plays do not produce decisions with legal or significant effect without meaningful human review. Compliance ## ChurnZero and the GDPR ChurnZero is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for B2B customer success analytics on authenticated SaaS users, after a balancing test, when the data subject is a known business contact. Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the cookies and identifiers stored on the user's device and for any in app pop ups that depend on profiling. Contract performance (Art. 6(1)(b)) for billing and support interactions. - Risk level medium - Applicable regulations GDPR, UK GDPR, ePrivacy Directive 2002/58/EC, US CCPA/CPRA, EU US Data Privacy Framework, SOC 2 Type II, ISO/IEC 27001 ### Impact assessment (DPIA) A DPIA is recommended because ChurnZero combines behavioural analytics, profiling for health scoring and automated in app interactions, often at scale and across multiple personas at customer accounts. The DPIA should cover health score profiling, NPS feedback, in app messaging triggers and the international transfer to the United States. ### Sample text for your banner > We use ChurnZero (ChurnZero Inc., United States) to monitor product usage, score customer health, send in app messages and run NPS surveys for our authenticated users. ChurnZero sets first party analytics cookies, sends event data to AWS US East and may trigger walkthroughs and feedback prompts. International transfers are covered by SCCs and the EU US Data Privacy Framework. Cookies and trackers ## What ChurnZero sets and contacts - Tracking method In product customer success and product analytics SDK: a JavaScript snippet loaded from analytics.churnzero.net writes a first party visitor ID cookie, tracks events, account attributes and product usage, and pushes them to the ChurnZero workspace for health scoring, NPS, in app messages, walkthroughs and customer journey orchestration; also offers a server side REST API and a Salesforce, HubSpot or Gainsight CRM sync - Server location United States (ChurnZero Inc., Arlington, Virginia, headquarters); production hosted on AWS US East 1 (Northern Virginia) and US East 2 (Ohio); EU data residency on AWS Frankfurt (eu central 1) is available as a paid add on for enterprise plans - Data transferred outside the EU ChurnZero Inc. is established in the United States and processes most customer data on AWS US East. EU data residency is available as a contractual add on but not the default. The ChurnZero DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3), the UK International Data Transfer Addendum, and references the EU US Data Privacy Framework where ChurnZero is self certified. ### Cookies set (4) | Name | Type | Duration | Purpose | | -------------------- | ------------ | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | cz\_session | first\_party | Session | Functional session cookie used by the ChurnZero SDK to keep an active tracking session for the authenticated SaaS user during their visit. | | cz\_visitor | first\_party | 1 year | Long lived visitor identifier used by ChurnZero to stitch sessions across visits of the same browser and to map them to a ChurnZero contact ID. | | ChurnZero.contactId | first\_party | Persistent (localStorage) | localStorage key holding the ChurnZero contact identifier for the logged in user, used to attribute events to the right contact and account. | | ChurnZero.eventQueue | first\_party | Persistent (localStorage) | Offline event queue stored in localStorage. The SDK flushes the queue to analytics.churnzero.net when the user is online again. | ### Third-party domains contacted (4) - `analytics.churnzero.net` - `api.churnzero.net` - `app.churnzero.net` - `churnzero.net` Questions ## Frequently asked questions about ChurnZero Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does ChurnZero set? The ChurnZero SDK writes cz\_session (functional session), cz\_visitor (long lived visitor identifier) and ChurnZero localStorage entries (contact ID, account ID, event queue, last seen timestamp). These are first party on the SaaS application but linked back to ChurnZero's US backend over analytics.churnzero.net. ### Do I need consent to use ChurnZero? Yes for the cookies and the localStorage identifiers under Art. 5(3) ePrivacy, even for authenticated B2B users. The behavioural analytics processing itself can sometimes rely on B2B legitimate interest, but only after a documented balancing test and with a working right to object. ### What is the legal basis for using ChurnZero? Legitimate interest (Art. 6(1)(f) GDPR) for product analytics on authenticated B2B users with a documented LIA. Consent (Art. 6(1)(a) and Art. 5(3) ePrivacy) for cookies and localStorage. Contract performance (Art. 6(1)(b)) for support and billing. ### Does ChurnZero transfer data to third countries? Yes. By default ChurnZero processes EU customer data on AWS US East. EU residency in AWS Frankfurt is available as an enterprise add on. Transfers are covered by the EU Standard Contractual Clauses, the UK IDTA and the EU US Data Privacy Framework. ### Do I need a DPIA for ChurnZero? A DPIA is recommended because ChurnZero involves systematic monitoring of authenticated users, behavioural profiling (health scoring) and automated CS plays. Art. 35 GDPR triggers the obligation when at least two of these criteria are met. ### How do I implement ChurnZero compliantly? Sign the DPA, request EU residency if available, gate the SDK behind a product analytics toggle in user settings or your CMP, list ChurnZero in your privacy notice and Article 30 record, document LIA and TIA, and ensure CS playbooks include human review for decisions with legal or similarly significant effect. ### Are there alternatives to ChurnZero? EU friendly customer success platforms include Planhat (Sweden), Custify (Romania, EU clusters), Hook (UK) and Vitally (US with EU residency). Generic product analytics options include Mixpanel EU, Amplitude EU, PostHog Cloud EU and self hosted PostHog or Plausible Events. ### How should I update my cookie and privacy policy for ChurnZero? List cz\_session, cz\_visitor and ChurnZero's localStorage objects under product analytics in your cookie policy. In your privacy notice, name ChurnZero Inc. as a processor for customer success, describe the in app tracking, the US storage on AWS, the EU residency option, the international transfers with SCCs and DPF and the customer's right to object to profiling. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Cloudflare Zaraz](https://www.flowconsent.com/en/services/analytics/cloudflare-zaraz) [Cloudflare Zaraz is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Cloudflare Zaraz offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Cloudflare Zaraz empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/cloudflare-zaraz) [Analytics](https://www.flowconsent.com/en/services/analytics/cloudflare-zaraz) · ### [Dema](https://www.flowconsent.com/en/services/analytics/dema) [Dema is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Dema supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Dema enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/dema) [Analytics](https://www.flowconsent.com/en/services/analytics/dema) · ### [Loglib](https://www.flowconsent.com/en/services/analytics/loglib) [Loglib is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Loglib supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Loglib enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/loglib) [Analytics](https://www.flowconsent.com/en/services/analytics/loglib) · ### [Contentsquare](https://www.flowconsent.com/en/services/analytics/contentsquare) [Contentsquare is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Contentsquare offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Contentsquare empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/contentsquare) [Analytics](https://www.flowconsent.com/en/services/analytics/contentsquare) · ### [SessionStack](https://www.flowconsent.com/en/services/analytics/sessionstack) [SessionStack is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. SessionStack supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, SessionStack enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/sessionstack) [Analytics](https://www.flowconsent.com/en/services/analytics/sessionstack) · ### [Spotler Activate](https://www.flowconsent.com/en/services/analytics/spotler-activate) [Spotler Activate is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Spotler Activate supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Spotler Activate enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/spotler-activate) [Analytics](https://www.flowconsent.com/en/services/analytics/spotler-activate) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)