> Understand how Wootric by InMoment collects NPS and CSAT data, which GDPR and ePrivacy rules apply, and how to implement compliant consent for European users. > > Canonical: https://www.flowconsent.com/en/services/analytics/wootric Analytics # Wootric by InMoment Analytics · [Official website](https://www.wootric.com) Wootric by InMoment is an in-app and email micro-survey platform for NPS, CSAT, and CES measurement. It collects scores and verbatim feedback tied to individual user identities, and transfers data to US servers operated by InMoment. Consent is required when deployed client-side with cookies; legitimate interest may apply to cookieless email surveys where a prior customer relationship exists. [Block Wootric by InMoment until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=analytics) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Analytics](https://www.flowconsent.com/en/services/analytics) - Consent Analytics - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers United States (InMoment, AWS-based) Overview ## What does Wootric by InMoment do? ## **What Is Wootric and How Does It Collect Feedback** Wootric, now part of the InMoment experience intelligence platform, is a micro-survey tool specialising in Net Promoter Score (NPS), Customer Satisfaction (CSAT), and Customer Effort Score (CES) measurement. It can be deployed in two primary ways: as a client-side JavaScript SDK embedded in a web application or mobile app that displays in-app survey modals, or as an email survey delivered directly to users' inboxes. In both cases, each respondent is identified by their email address or an external user ID passed at SDK initialisation, meaning all survey responses are linked to a specific individual rather than collected anonymously. The SDK communicates with api.wootric.com to authenticate the account, determine survey eligibility, and submit responses. The client-side script is loaded from cdn.wootric.com. Survey timing and eligibility rules (such as days since last survey or plan type) are evaluated against user properties passed at initialisation, which may include account metadata, subscription tier, or other custom traits. ## **Data and Cookies Collected** Wootric collects the survey response score (a numerical rating), verbatim comments provided by the user, the email address or external user ID used at initialisation, any custom user properties passed via the SDK, and technical metadata including page URL, timestamp, and browser information. When deployed as a client-side SDK, Wootric sets cookies to manage survey eligibility windows and prevent survey fatigue. These cookies store a unique user token and the timestamp of the last survey interaction. Email surveys do not set browser cookies but do involve processing the user's email address and tracking link clicks. ## **GDPR and ePrivacy Implications** Under the ePrivacy Directive, client-side deployment of Wootric requires prior consent because the SDK sets non-essential cookies. For email-based NPS surveys, the ePrivacy rules on cookies do not directly apply (no cookies are set on the device), but GDPR still governs the processing of personal data. Under GDPR, the legal basis depends on the deployment channel: consent under Article 6(1)(a) is the safest and most straightforward basis for in-app surveys using the SDK; for email surveys sent to existing customers as part of a service improvement programme, legitimate interest under Article 6(1)(f) may be defensible, provided a Legitimate Interest Assessment (LIA) is documented and users can easily opt out of future surveys. ## **International Data Transfers** All Wootric data is processed by InMoment on servers located in the United States. This constitutes a transfer of personal data to a third country under GDPR Chapter V. InMoment participates in the EU-US Data Privacy Framework (DPF), providing an adequacy-equivalent basis for such transfers. Operators deploying Wootric for EEA users should verify that InMoment's DPF certification is current, document the transfer mechanism in their Records of Processing Activities (RoPA), and consider requesting Standard Contractual Clauses (SCCs) from InMoment as an additional safeguard. The InMoment Data Processing Agreement (DPA) should be reviewed and signed before going live with EEA audiences. ## **Consent Requirements and Legal Basis Selection** For in-app SDK deployments, integrate the Wootric script loading with your Consent Management Platform (CMP) so it only initialises after the user has accepted the relevant cookie category. For email surveys, if relying on legitimate interest, complete a LIA demonstrating that the processing is necessary, proportionate, and that users' interests do not override the business interest. Always include an opt-out link in survey emails and honour opt-out requests promptly. In both cases, document the legal basis per processing activity in your RoPA. ## **Practical Compliance Steps for Operators** To deploy Wootric compliantly: gate the CDN script behind CMP consent for in-app use; list all Wootric cookies in your cookie policy (name, type, duration, purpose); include wootric.com, api.wootric.com, and cdn.wootric.com in your Privacy Policy as InMoment-operated third-party endpoints; sign InMoment's DPA and verify DPF certification; document your legal basis and transfer mechanism; include a DPIA or risk assessment for large-scale or identity-linked deployments; and provide users with a clear explanation of what survey data is collected and how to opt out. Compliance ## Wootric by InMoment and the GDPR Wootric by InMoment is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) is required when Wootric sets cookies or processes data via client-side tracking. Legitimate interest (Art. 6(1)(f)) may apply for transactional email-based NPS surveys where the relationship with the user is established and no cookies are used, provided a legitimate interest assessment is documented and the user can easily opt out. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, EU-US Data Privacy Framework (DPF), CCPA ### Impact assessment (DPIA) A Data Protection Impact Assessment (DPIA) should be considered for Wootric deployments that tie NPS or CSAT scores to individual user profiles at scale, especially where feedback is combined with CRM or behavioural data. Key risks include: the transfer of personal data (including email addresses and verbatim comments) to InMoment servers in the United States; the systematic profiling of customer satisfaction linked to identifiable individuals; the potential for open-ended verbatim responses to contain sensitive personal data; and the use of cookies or persistent identifiers in the client-side SDK. Operators should document the chosen legal basis (consent vs. legitimate interest), conduct a Legitimate Interest Assessment (LIA) if relying on Article 6(1)(f), and ensure a valid transfer mechanism such as the EU-US DPF or SCCs is in place before processing EEA personal data. ### Sample text for your banner > We use Wootric by InMoment to send you short satisfaction surveys (NPS, CSAT, or CES) to help us improve our products and services. Your feedback, including any comments you provide, is processed by InMoment on servers in the United States. Wootric may use cookies to manage survey delivery. By clicking "Accept", you consent to this processing. You can withdraw your consent at any time by contacting us. Cookies and trackers ## What Wootric by InMoment sets and contacts - Tracking method JavaScript SDK embedded in-app or via tag manager; email-based NPS delivery; user identified by email or external ID passed at SDK initialisation - Server location United States (InMoment, AWS-based) - Data transferred outside the EU Survey data, NPS scores, verbatim comments, and user identifiers are processed by InMoment on US-based servers. InMoment participates in the EU-US Data Privacy Framework (DPF) and offers Standard Contractual Clauses (SCCs) for EEA data transfers. ### Cookies set (4) | Name | Type | Duration | Purpose | | --------------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------- | | wootric\_user\_token | persistent | 1 year | Stores a unique user token to identify the respondent and manage survey eligibility across sessions. | | wootric\_last\_survey | persistent | 1 year | Records the timestamp of the last survey shown or completed to enforce survey frequency limits and prevent fatigue. | | wootric\_session | session | Session | Manages survey display logic and eligibility checks within a single browsing session. | | wootric\_surveyed | persistent | 90 days | Flags that the user has already been shown a specific survey to avoid repetition within the suppression window. | ### Third-party domains contacted (3) - `wootric.com` - `api.wootric.com` - `cdn.wootric.com` Questions ## Frequently asked questions about Wootric by InMoment Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Wootric set in users' browsers? When deployed as an in-app JavaScript SDK, Wootric sets cookies to manage survey eligibility windows and prevent survey fatigue. These typically include a unique user token cookie and a timestamp cookie recording when the user last received or responded to a survey. The exact cookie names may vary by SDK version. Email-based Wootric surveys do not set any browser cookies, though they do involve tracking whether the email link was clicked. ### Is consent required before using Wootric? Consent is required for client-side in-app deployment of Wootric because it sets non-essential cookies in the user's browser. For email-based NPS surveys sent to existing customers, consent may not be strictly required if the deployment relies on legitimate interest under GDPR Article 6(1)(f), provided a Legitimate Interest Assessment is documented and users can easily opt out. When in doubt, obtaining explicit consent is the safest approach for EEA audiences. ### What legal basis applies to Wootric survey processing? For in-app SDK deployments using cookies, consent under GDPR Article 6(1)(a) is the recommended legal basis. For transactional email surveys to existing customers without cookies, legitimate interest under Article 6(1)(f) may apply, subject to a documented Legitimate Interest Assessment (LIA) and a clear opt-out mechanism. In all cases, the legal basis must be documented per processing activity in your Records of Processing Activities, and users must be informed of the basis in your Privacy Policy. ### Does Wootric transfer personal data to the United States? Yes. Wootric is operated by InMoment, a US-based company, and all survey data including scores, verbatim comments, and user identifiers is processed on US servers. This constitutes a third-country transfer under GDPR Chapter V. InMoment participates in the EU-US Data Privacy Framework (DPF), which provides an adequacy-equivalent basis. Operators should verify InMoment's DPF certification is current, and may also request Standard Contractual Clauses (SCCs) from InMoment as additional protection. ### Do I need a DPIA before deploying Wootric? A DPIA is recommended if you use Wootric to systematically link satisfaction scores to individual user profiles at scale, particularly if combined with CRM, behavioural, or demographic data. A DPIA is mandatory under GDPR Article 35 when the processing is likely to result in a high risk to individuals. Even where not strictly required, a documented risk assessment before deploying any tool that transfers EEA personal data to the US is considered good practice by most data protection authorities. ### How do I implement Wootric in a GDPR-compliant way? For in-app SDK use, gate Wootric initialisation behind your CMP so the SDK only loads after the user consents. For email surveys, document a Legitimate Interest Assessment, include an opt-out link in every survey email, and handle opt-out requests without delay. In both cases, sign InMoment's Data Processing Agreement, list Wootric cookies in your cookie declaration, reference InMoment as a data processor in your Privacy Policy, and document the EU-US DPF or SCCs as your transfer mechanism in your Records of Processing Activities. ### What are privacy-friendly alternatives to Wootric for NPS surveys? EU-based or privacy-focused alternatives for NPS and CSAT measurement include Nicereply (EU hosting available), Survicate (GDPR-compliant with EU data residency), or Delighted (with privacy controls). For complete data ownership, open-source tools such as Formbricks or self-hosted survey platforms allow NPS collection with data remaining on your own infrastructure. The best alternative depends on your integration needs, user volume, and preference for managed vs. self-hosted solutions. ### How should I update my cookie and privacy policy to include Wootric? Add Wootric to your cookie policy table listing the cookie name, type (analytics or functional), duration, and purpose. Reference wootric.com, api.wootric.com, and cdn.wootric.com as the third-party domains. Update the processors section of your Privacy Policy to name InMoment as a data processor and describe the US transfer, the mechanism (DPF or SCCs), and user rights regarding survey data. If you use automated cookie scanning, scan after deploying Wootric to capture any cookies set by the SDK. Review and update at least annually. Same category ## More services: Analytics [See the whole category](https://www.flowconsent.com/en/services/analytics) ### [Lexer](https://www.flowconsent.com/en/services/analytics/lexer) [Lexer is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Lexer offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Lexer empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/lexer) [Analytics](https://www.flowconsent.com/en/services/analytics/lexer) · ### [AvidTrak](https://www.flowconsent.com/en/services/analytics/avidtrak) [AvidTrak is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. AvidTrak supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, AvidTrak enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/analytics/avidtrak) [Analytics](https://www.flowconsent.com/en/services/analytics/avidtrak) · ### [Marchex](https://www.flowconsent.com/en/services/analytics/marchex) [Marchex is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Marchex offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Marchex empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/marchex) [Analytics](https://www.flowconsent.com/en/services/analytics/marchex) · ### [Prisme](https://www.flowconsent.com/en/services/analytics/prisme) [Prisme is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Prisme integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Prisme makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/analytics/prisme) [Analytics](https://www.flowconsent.com/en/services/analytics/prisme) · ### [Ackee](https://www.flowconsent.com/en/services/analytics/ackee) [Ackee is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Ackee offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Ackee empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/ackee) [Analytics](https://www.flowconsent.com/en/services/analytics/ackee) · ### [UI Avenue](https://www.flowconsent.com/en/services/analytics/ui-avenue) [UI Avenue is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. UI Avenue offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, UI Avenue empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/analytics/ui-avenue) [Analytics](https://www.flowconsent.com/en/services/analytics/ui-avenue) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)