Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Gist is an all in one US marketing and support suite with live chat, email marketing, forms, event tracking and cross session behavioral visitor tracking.
Gist, available at getgist.com, is an all in one marketing and support suite from a United States vendor. It combines live chat, email marketing, popups and forms, event tracking and behavioral visitor tracking that identifies and profiles visitors across sessions.
Gist loads a JavaScript widget and sets cookies such as gist_id and other gist prefixed cookies. It assigns each visitor a unique identifier, records page views and events, captures contact and form data, and builds a behavioral profile that persists across visits to power marketing automation.
Because Gist sets non essential identifiers and tracks behaviour across sessions, Article 5(3) of the ePrivacy Directive requires prior consent before these cookies are set. The profiles and contact records are personal data under the GDPR and UK GDPR.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
The lawful basis is consent under Article 6(1)(a) GDPR. Gist tracking and marketing identifiers must not load until the visitor gives explicit consent, and visitors must be able to withdraw consent as easily as they gave it.
Gist processes data in the United States, so for EEA and UK visitors this is a transfer to a third country. Gist relies on Standard Contractual Clauses together with supplementary measures. Document the transfer and assess the additional risk created by the profiling.
Block all Gist cookies until consent, sign the data processing agreement, review the SCCs and supplementary measures, list the gist cookies in your cookie policy, honour deletion and opt out requests, and set retention limits for profiles and contact data.
Websites using Gist must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is strongly recommended because Gist combines behavioral tracking, marketing automation and cross session profiling, and processes data in the United States. Assess the profiling, the identifiers such as gist_id, the volume of contact data, the US transfer under Standard Contractual Clauses and retention across sessions.
Sample consent text
We use Gist for chat, marketing and visitor analytics. Gist sets cookies that identify you and track your activity across sessions. These run only with your consent, which you can withdraw at any time.
Third-party domains contacted
getgist.comwidget.getgist.comapp.getgist.comcdn.getgist.comtrack.getgist.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| gist_id | Third-party | Persistent | Assigns a unique visitor identifier used to track and profile the visitor across sessions. |
| gist_session | Third-party | Session | Maintains the Gist chat and tracking session within a single visit. |
| gist_visit | Third-party | Persistent | Records visit and behavioral data used for event tracking and marketing automation. |
| gist_contact | Third-party | Persistent | Links captured contact details to the visitor profile for marketing follow up. |
Gist collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Gist sets cookies such as gist_id and other gist prefixed cookies. They assign a unique visitor identifier and track page views, events and behaviour across sessions for marketing and analytics.
Yes. Gist sets non essential identifiers and tracks behaviour across sessions, so prior consent is required under the ePrivacy Directive and Article 6(1)(a) GDPR before any Gist cookie is set.
The legal basis is consent under Article 6(1)(a) GDPR, because Gist combines behavioral tracking, profiling and marketing automation that go well beyond what is strictly necessary.
Yes. Gist is US based and processes data in the United States, so for EEA and UK visitors this is a transfer to a third country. Gist relies on Standard Contractual Clauses and supplementary measures.
Yes. A DPIA is strongly recommended because Gist performs cross session profiling and behavioral tracking combined with marketing automation and a US transfer, which is high risk processing.
Block all Gist cookies until consent, sign the data processing agreement, review the SCCs and supplementary measures, honour deletion and opt out requests and set retention limits for profiles and contact data.
EU based options such as Landbot keep most processing within the EU and have a lighter tracking footprint. Other suites include HubSpot, Brevo and Intercom. Compare hosting region, profiling and consent controls.
List the gist cookies including gist_id with their purposes and durations, state that they support chat, marketing and behavioral tracking, name Gist as the provider and disclose the transfer to the United States.