Woopra

What is Woopra

Woopra is a customer journey analytics platform operated by Woopra Inc., headquartered in San Francisco. It combines web analytics, mobile analytics, and product analytics, attaching every event collected to an identified customer profile rather than to an anonymous session. Marketing, sales and product teams use Woopra to understand individual user paths from first visit through purchase and retention.

Tracking is implemented through a JavaScript snippet (woopra.com tracker), mobile SDKs, and direct REST API calls from backend services. Each user is identified by an email address or other stable ID and tagged with custom properties, then enriched with all subsequent behavioural events.

What data does Woopra collect

On the client side, Woopra processes the IP address (used for geolocation and abuse prevention), browser User Agent, screen size, referrer, current URL, page title, and full event payloads (clicks, form submits, custom track calls). Server side it receives all data that you push via the REST API: email addresses, names, account IDs, plan information, and any custom traits.

These identifiers are correlated using the wooTracker cookie (visitor ID, 1 year lifetime) and the optional Woopra Connect feature that stitches anonymous browsing sessions with identified accounts after sign in.

GDPR, ePrivacy and Schrems II

Woopra is a US controller for its own operations and a US processor for customer data. The transfer of EU personal data to the US is governed by Standard Contractual Clauses. Following the Schrems II ruling (CJEU C 311/18), SCCs alone are insufficient: a documented Transfer Impact Assessment is mandatory, considering FISA Section 702 and Executive Order 12333 access by US authorities.

On the cookie side, wooTracker is not strictly necessary and falls squarely under Art. 5(3) ePrivacy: consent is required before it is written. Because Woopra processes identified personal data, consent is also the safest Art. 6 basis under GDPR. Legitimate interest is risky because the EDPB and several DPAs have ruled against legitimate interest as a basis for cross border behavioural tracking.

Consent requirements

Defer the Woopra script until the visitor has accepted the Analytics or Marketing category in your consent management platform. Make sure the consent banner explicitly names Woopra and mentions the United States transfer, with a link to Woopra privacy policy.

For server side tracking, do not send identified events for EU users who refused consent: use the Woopra API only for users who explicitly accepted Marketing or Product analytics. Implement consent signal propagation between your CMP, your application backend and the Woopra REST API.

Data transfers and processor obligations

Sign the Woopra Data Processing Addendum and the EU SCCs (Modules 2 and 3, controller to processor). Document the transfer in your Records of Processing Activities and complete a Transfer Impact Assessment. Apply supplementary measures: pseudonymise email addresses before sending where possible, restrict the categories of properties pushed, and enable IP truncation if Woopra offers it.

List all downstream sub processors Woopra relies on (notably AWS for hosting in the US) in your privacy notice. Update your retention policy: by default Woopra retains profiles indefinitely, set an explicit deletion schedule.

Practical compliance checklist

Implement granular consent for Woopra (Analytics or Marketing category). Defer woopra.js until consent. Configure the Woopra account to anonymise IP addresses. Document the lawful basis (consent) and the cross border transfer in your privacy policy. Train your product and marketing teams to avoid pushing special category data (health, religious beliefs, sexual orientation, biometric identifiers) into Woopra traits.

For high traffic or sensitive sectors, consider EU alternatives: Matomo, Piwik PRO, Plausible, Fathom, or Mixpanel with EU residency. Document your decision rationale in the DPIA, particularly if Woopra is used to profile users in a way that may produce automated decisions under Art. 22 GDPR.