Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Picreel is a US conversion optimization and exit intent popup tool that detects when a visitor is about to leave and shows targeted offers, email capture forms, and A/B tested messages. It tracks mouse movement and behaviour, sets cookies to control how often popups appear, and collects the details visitors submit, along with IP address. Because it sets non essential cookies and is US operated, it requires prior consent under the GDPR and the ePrivacy Directive and transfers data to a third country; it also has a history that underlines the need to vet third party scripts.
Picreel is a conversion rate optimization tool operated from the United States that displays exit intent popups, overlays, and email capture forms based on visitor behaviour. It watches signals such as mouse movement and time on page to predict when someone is about to leave, then shows a targeted message. Adding Picreel loads a third party script that runs on your pages.
Picreel processes behavioural signals such as mouse movement, scrolling, and time on page, the details visitors submit in popups (often email addresses and names), and technical data like IP address, device, and browser. It sets cookies to remember which popups a visitor has seen and to cap how often they appear. The submitted contact details are personal data you control.
The popup and behavioural scripts set non essential cookies and process behaviour, so the ePrivacy Directive requires prior consent and the GDPR requires a lawful basis and transparency. Because Picreel injects a third party script into your pages, you should also assess supply chain security: a compromised marketing script can be used to steal data, as past incidents in this category have shown. A data processing agreement is required.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Obtain prior, opt in consent before Picreel sets cookies and starts tracking behaviour, and block the script behind your consent banner. Email capture should use clear, separate consent for marketing, not a pre ticked box. Make consent specific and easy to withdraw.
Picreel is operated from the United States and processes data there, so its use involves a third country transfer under Chapter V of the GDPR. Transfers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, supported by a transfer impact assessment. Document the behavioural and contact data sent to the US.
To use Picreel compliantly, gate it behind consent, sign a data processing agreement, and complete a transfer impact assessment. Use subresource integrity or other controls to reduce supply chain risk from the third party script, collect only the contact data you need, and set retention limits. List Picreel in your cookie policy and privacy notice and review it regularly.
Websites using Picreel must obtain user consent under GDPR regulations.
DPIA considerations
Picreel combines behavioural tracking with email capture through a third party script, and the category has a history of supply chain compromise, which raises its risk profile. Key DPIA points: (1) transfer of personal data to Picreel in the United States, requiring SCCs or the Data Privacy Framework and a transfer impact assessment; (2) behavioural tracking of mouse movement and engagement; (3) collection of email addresses and other contact data through popups; (4) supply chain risk from injecting a third party marketing script, which should be mitigated with integrity controls; (5) non essential cookies requiring consent. A DPIA is recommended given the combination of tracking, data capture, and script injection.
Sample consent text
We use Picreel to show relevant offers and to invite you to subscribe. With your consent, Picreel sets cookies and tracks behaviour such as mouse movement to decide when to display a message, and it processes any details you submit along with your IP address. This data is processed by Picreel in the United States under appropriate safeguards. You can withdraw your consent at any time via our cookie settings.
Third-party domains contacted
picreel.comcdn.picreel.comapi.picreel.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| picreel_shown | Functional | 30 days | Records which campaigns have already been shown to avoid repeating popups too often. |
| picreel_visitor | Analytics | 1 year | Visitor identifier used to track behaviour and measure popup conversions. |
| picreel_ab | Analytics | 6 months | Stores the A/B test variant assigned to the visitor for consistent display. |
Picreel collects user analytics data — you legally need a consent banner. Try FlowConsent free.
Picreel sets cookies that remember which popups a visitor has already seen and cap how often they appear, plus identifiers used to track behaviour and measure conversions. These are non essential and require consent. The submitted email or contact details are stored separately as form data.
Yes. Picreel sets non essential cookies and tracks behaviour, so obtain prior, opt in consent before its script runs. Email capture for marketing needs its own clear consent, not a pre ticked box.
The cookies and behavioural tracking rely on consent (Art. 6(1)(a)) and the ePrivacy Directive. Sending marketing to captured emails generally requires consent under ePrivacy marketing rules as well.
Yes. Picreel is operated from the United States and processes data there, so its use is a third country transfer. It relies on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, which you should document in a transfer impact assessment.
A DPIA is recommended because Picreel combines behavioural tracking, email capture, and a third party script. Assess the US transfer, the behavioural data, the contact data collected, and the supply chain risk of injecting a marketing script.
Block Picreel behind your consent banner, sign a data processing agreement, complete a transfer impact assessment, and apply integrity controls to the third party script. Collect only necessary contact data, set retention limits, and document Picreel in your cookie policy and privacy notice.
Yes. EU based or self hosted popup and email capture tools reduce third country transfers and give more control over the script you load. A self hosted popup library or an EU hosted conversion tool can provide similar features with lower privacy and supply chain risk.
Add a Picreel entry listing its cookies, their purposes and durations, the behavioural tracking it performs, and the fact that data is processed in the United States. Link to Picreel''s privacy notice and review the entry when its cookies or subprocessors change.