> Umso (formerly Landen) is an AI website builder for startup landing pages. Which cookies it sets, when GDPR consent is required and what to add to your policy. > > Canonical: https://www.flowconsent.com/en/services/cms/umso CMS # Umso Analytics · [Official website](https://www.umso.com) AI powered SaaS website builder for startup landing pages (formerly Landen). Hosts sites in the EU and the US. Sets first party session cookies on hosted sites and ships built in visitor analytics. [Block Umso until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Analytics - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers European Union (Frankfurt) and United States (AWS) Overview ## What does Umso do? ## **What is Umso** Umso is an AI powered SaaS website builder aimed at startups and product teams who need a fast, no code landing page. It was launched as Landen and renamed Umso in 2021. The platform generates marketing sites from a short prompt, hosts them on its own infrastructure, and offers built in lead capture forms, basic analytics and integrations with CRMs and email tools. ## **What data and cookies Umso collects** Umso hosted sites set a first party session cookie for navigation, a CSRF token cookie to protect forms, and a preferences cookie that stores the visitor cookie banner choice. The built in analytics records page views, referrers, country (from IP, then truncated), browser and operating system. Forms submitted on the page are stored in the Umso dashboard and may be forwarded to the connected email or CRM provider. ## **GDPR and ePrivacy implications** The session and CSRF cookies fall under the strictly necessary exemption of Article 5(3) ePrivacy Directive, so they can be set without consent. The built in analytics, although first party, is not strictly necessary and therefore requires prior consent unless configured in a way that the CNIL considers exempt (no cross site tracking, no audience profiling, anonymous statistics only). Any third party widget the site owner embeds (chat, video, social) brings its own consent requirements. ## **Consent requirements and user controls** Site owners using Umso must add a cookie banner if they activate the built in analytics or any third party widget. The banner must let the user refuse as easily as accept, store the choice for at least six months and allow withdrawal at any time. Form data is processed under Article 6(1)(b) GDPR for pre contractual steps if a quote is requested, or under Article 6(1)(a) consent for marketing newsletters. ## **Data transfers and hosting** Umso runs on AWS with a primary region in Frankfurt and edge nodes in the United States. Static assets and analytics events may transit through US points of presence. Transfers to the US rely on the EU US Data Privacy Framework and on standard contractual clauses signed with Umso. A transfer impact assessment should document the supplementary measures: HTTPS encryption, IP truncation in analytics and limited retention of raw logs. ## **Practical compliance steps** Sign a data processing addendum with Umso, list the company as a processor in your records of processing, configure the built in cookie banner or replace it with a more capable CMP if you embed third party widgets, document the storage period of form submissions, and provide an easy way for visitors to exercise their rights (access, deletion, portability). Review every twelve months whether the analytics is still needed or can be downgraded to a consent free aggregated mode. Compliance ## Umso and the GDPR Umso is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Strict necessity (Article 6(1)(f) GDPR and the strictly necessary exemption of Article 5(3) ePrivacy Directive) for the session and CSRF cookies. Consent (Article 6(1)(a) GDPR) for the built in analytics and for any third party widget added by the site owner. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), TTDSG in Germany, French Data Protection Act, UK GDPR and PECR for visitors from the United Kingdom. ### Impact assessment (DPIA) A DPIA is generally not required for a small marketing site built with Umso, but becomes relevant when the site collects sensitive form data (health, finance, identification), runs targeted advertising or processes a large number of leads. Document the categories of data captured by forms, the routing to email or CRM, the retention of analytics events and the transfer of static assets to AWS regions outside the EEA. ### Sample text for your banner > We use Umso to host this website. Umso sets a session cookie on this page and collects anonymous usage statistics to operate the site. By accepting, you also allow optional analytics and embedded widgets such as forms or chat. You can accept, refuse or withdraw your consent at any time. Cookies and trackers ## What Umso sets and contacts - Tracking method First party session cookies, hosted JavaScript and built in analytics - Server location European Union (Frankfurt) and United States (AWS) - Data transferred outside the EU Yes. Umso (formerly Landen) is a hosted SaaS platform. Static site assets and visitor analytics may be served from AWS regions in the United States as well as in the EU. Transfers rely on the EU US Data Privacy Framework and standard contractual clauses. ### Cookies set (4) | Name | Type | Duration | Purpose | | ------------- | ---------------------- | --------- | ------------------------------------------------------------------------------------------------------ | | umso\_session | first party session | Session | Maintains the visitor session on the hosted site (navigation state, form context). Strictly necessary. | | umso\_csrf | first party security | Session | CSRF token cookie protecting form submissions against cross site request forgery. Strictly necessary. | | umso\_consent | first party preference | 6 months | Stores the visitor cookie banner choice (accept, refuse or per category). | | umso\_uid | first party analytics | 12 months | Anonymous visitor identifier used by the built in Umso analytics to deduplicate sessions. | ### Third-party domains contacted (3) - `umso.co` - `umso.com` - `landen.co` Questions ## Frequently asked questions about Umso Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Umso set? A site published with Umso sets a first party session cookie (umso\_session) for navigation, a CSRF token cookie to protect form submissions, and a cookie that stores the visitor cookie banner choice. If the built in analytics is enabled, an additional first party visitor cookie (umso\_uid) is dropped to deduplicate sessions. ### Is user consent required to load Umso? The strictly necessary session and CSRF cookies do not need consent. The built in analytics, however, requires a prior opt in under Article 5(3) ePrivacy Directive unless configured to be fully anonymous and limited to aggregated audience measurement, as accepted by the French CNIL guidelines on exempted analytics. ### What is the legal basis for processing? Legitimate interest (Article 6(1)(f) GDPR) for the strictly necessary cookies needed to deliver the site. Consent (Article 6(1)(a) GDPR) for the built in analytics and for any third party widget such as chat, video or social embeds. Performance of a contract (Article 6(1)(b)) for form submissions used in pre contractual steps. ### Does Umso transfer data to the United States? Yes. Although the primary AWS region is Frankfurt, edge nodes and some Umso operational systems are based in the United States. Transfers to the US rely on the EU US Data Privacy Framework supplemented by standard contractual clauses, plus encryption in transit and limited retention as supplementary measures. ### Do I need a DPIA for an Umso site? For a standard marketing site a DPIA is not mandatory. It becomes recommended when forms collect special category data (health, finance, employment status), when audiences include minors, when leads are matched to advertising platforms, or when the site processes a large volume of contacts on a regular basis. ### How do I implement Umso compliantly? Sign the Umso data processing addendum, list Umso in your records of processing, replace or extend the built in banner with a CMP that supports refuse, withdraw and proof of consent, gate analytics and third party widgets behind that banner, document the storage period of form submissions and provide a clear privacy notice. ### What alternatives exist if I cannot rely on Umso? Other AI website builders with EU only hosting (Framer, Webflow EU plans), classic CMS with EU hosting (WordPress on OVH or Scaleway, Ghost, Strapi), or static site generators deployed on Netlify EU regions. Each option still requires its own consent banner and DPA. ### How should I update my cookie policy for Umso? List Umso as the hosting processor, describe the session cookie, the CSRF cookie and the analytics cookie if enabled, mention the AWS regions used and the EU US Data Privacy Framework, link to the Umso privacy policy and explain how visitors can refuse or withdraw consent for analytics and third party widgets. Review the entry every twelve months. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Payload CMS](https://www.flowconsent.com/en/services/cms/payload-cms) [Payload CMS is a powerful content management system (CMS) designed to help businesses and developers build, manage, and publish digital content with ease. It offers a flexible architecture that supports custom content types, templates, and workflows, making it ideal for websites of any scale. With Payload CMS, teams can streamline content creation, improve collaboration, and deliver engaging web experiences. Its extensible plugin ecosystem and API-first approach ensure seamless integration with existing.](https://www.flowconsent.com/en/services/cms/payload-cms) [CMS](https://www.flowconsent.com/en/services/cms/payload-cms) · ### [Pagevamp](https://www.flowconsent.com/en/services/cms/pagevamp) [Pagevamp is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Pagevamp offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Pagevamp empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/pagevamp) [Analytics](https://www.flowconsent.com/en/services/cms/pagevamp) · ### [Bump](https://www.flowconsent.com/en/services/cms/bump) [Bump is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Bump supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Bump ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/bump) [CMS](https://www.flowconsent.com/en/services/cms/bump) · ### [Moodle](https://www.flowconsent.com/en/services/cms/moodle) [Moodle is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Moodle integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Moodle helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/moodle) [CMS](https://www.flowconsent.com/en/services/cms/moodle) · ### [Lede](https://www.flowconsent.com/en/services/cms/lede) [Lede is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Lede integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Lede helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/lede) [CMS](https://www.flowconsent.com/en/services/cms/lede) · ### [simploCMS](https://www.flowconsent.com/en/services/cms/simplocms) [simploCMS is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. simploCMS integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, simploCMS helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/simplocms) [CMS](https://www.flowconsent.com/en/services/cms/simplocms) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)