> How the Userpilot SDK tracks SaaS users, why its cookies and walkthroughs need consent, how US transfers are covered and how to list it in your notice. > > Canonical: https://www.flowconsent.com/en/services/customer-support/userpilot Customer support # Userpilot Analytics · [Official website](https://userpilot.com) Userpilot is a US based product adoption and user onboarding platform headquartered in Austin, Texas. SaaS companies install the Userpilot JavaScript snippet to identify logged in users, ship walkthroughs and tooltips, run NPS surveys, build resource centers and analyse feature adoption. The SDK sets first party cookies on the SaaS application and processes events on AWS US East, with EU residency in AWS Frankfurt available as a paid add on. Cookies and identifiers require consent in the EU. [Block Userpilot until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=customer_support) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Customer support](https://www.flowconsent.com/en/services/customer-support) - Consent Analytics - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers United States (Userpilot Inc., Austin, Texas, headquarters); production hosted on AWS US East regions; EU data residency on AWS Frankfurt (eu central 1) is available as an enterprise paid add on; engineering presence in Egypt and the United Kingdom Overview ## What does Userpilot do? ## **What is Userpilot?** Userpilot is a product adoption platform incorporated as Userpilot Inc. in Austin, Texas. SaaS companies install the Userpilot JavaScript SDK in their application to deliver onboarding walkthroughs, tooltips, modals, banners, resource centers, NPS surveys and feature adoption analytics. Product teams configure user segments based on attributes (plan, MRR, persona) and events (signed up, completed onboarding) and ship in app experiences targeted at those segments. ## **Cookies and data collected** The Userpilot SDK writes first party cookies on the SaaS application (userpilot\_visitor, userpilot\_session) and a localStorage object that stores the Userpilot user ID, company ID, segments and the in app experiences already shown. The SDK transmits identify and track payloads (user attributes, events, screen) to api.userpilot.io. NPS responses, including free text, are stored on the same backend. ## **GDPR and ePrivacy implications** The Userpilot cookies and localStorage identifiers are not strictly necessary to deliver the SaaS service the customer pays for, so Art. 5(3) ePrivacy requires prior consent in the EU even for authenticated B2B users. The behavioural analytics processing can usually be grounded on B2B legitimate interest, with a documented LIA and a right to object. NPS surveys with free text fields should also be reviewed for sensitive content. ## **International data transfers** By default Userpilot processes EU customer data on AWS US East. EU residency on AWS Frankfurt is available as an enterprise add on. Engineering teams in Egypt and the UK may access data under contract. The Userpilot DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK IDTA, and Userpilot is self certified under the EU US Data Privacy Framework. ## **Practical compliance steps** Sign the Userpilot DPA, request EU residency if your plan allows it, gate the SDK behind a product analytics toggle in user settings or a CMP, list Userpilot in your privacy notice and Article 30 record, complete a DPIA covering NPS and in app nudges, document the US transfer with SCCs and DPF and offer customers a clear way to object to in app messages. Compliance ## Userpilot and the GDPR Userpilot is classified as “Analytics”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for product analytics and in app onboarding on authenticated B2B users with a documented Legitimate Interest Assessment. Consent (Art. 6(1)(a) and Art. 5(3) ePrivacy) for the Userpilot cookies and localStorage on the SaaS application. Consent is also typically required for NPS surveys collecting free text or sensitive feedback. - Risk level medium - Applicable regulations GDPR, UK GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, US CCPA/CPRA, SOC 2 Type II, ISO/IEC 27001 ### Impact assessment (DPIA) A DPIA is recommended when Userpilot is used at scale because it combines behavioural analytics, in app messaging, profile based segmentation and NPS feedback. The DPIA should cover cookies, free text NPS responses, the international transfer to the US and the right to object to in app nudges. ### Sample text for your banner > We use Userpilot (Userpilot Inc., United States) to onboard new users, deliver walkthroughs and surveys and analyse feature adoption. Userpilot sets first party analytics cookies in our app and processes events on AWS US East. International transfers are covered by Standard Contractual Clauses and the EU US Data Privacy Framework. Cookies and trackers ## What Userpilot sets and contacts - Tracking method In product user onboarding, product analytics and feature adoption platform: a JavaScript snippet loaded from js.userpilot.io / userpilot.io tracks authenticated SaaS users (identify and track API), renders walkthroughs, tooltips, modals, NPS surveys and resource centers; sets first party Userpilot session and visitor cookies on the SaaS application and stores events in localStorage when offline - Server location United States (Userpilot Inc., Austin, Texas, headquarters); production hosted on AWS US East regions; EU data residency on AWS Frankfurt (eu central 1) is available as an enterprise paid add on; engineering presence in Egypt and the United Kingdom - Data transferred outside the EU Userpilot Inc. is established in the United States. By default, EU customer data is processed on AWS US East. EU data residency on AWS Frankfurt is available as an enterprise add on. The Userpilot DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK International Data Transfer Addendum, and Userpilot is self certified under the EU US Data Privacy Framework. ### Cookies set (4) | Name | Type | Duration | Purpose | | ------------------------ | ------------ | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | userpilot\_visitor | first\_party | 1 year | Userpilot long lived visitor identifier used to recognise the same user across visits and to attribute events to the right Userpilot contact. | | userpilot\_session | first\_party | 30 minutes | Userpilot session identifier used to mark which onboarding session the current page view belongs to. | | Userpilot.userId | first\_party | Persistent (localStorage) | localStorage key holding the Userpilot user identifier for the logged in SaaS user, used to deliver targeted in app experiences. | | Userpilot.completedFlows | first\_party | Persistent (localStorage) | localStorage object tracking which onboarding flows the user has already completed or dismissed to avoid showing them again. | ### Third-party domains contacted (4) - `userpilot.io` - `js.userpilot.io` - `api.userpilot.io` - `app.userpilot.io` Questions ## Frequently asked questions about Userpilot Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Userpilot set? The Userpilot SDK writes first party cookies on the SaaS application (userpilot\_visitor, userpilot\_session) and a localStorage object that stores the Userpilot user ID, company ID, segment membership and the in app experiences already shown to the user. ### Do I need consent to use Userpilot? Yes for the cookies and localStorage identifiers under Art. 5(3) ePrivacy, even for authenticated B2B users. The behavioural analytics processing can be supported by B2B legitimate interest with a documented LIA. NPS free text fields may also need an explicit warning. ### What is the legal basis for using Userpilot? Legitimate interest (Art. 6(1)(f) GDPR) for product analytics on authenticated B2B users with a documented LIA. Consent (Art. 6(1)(a) and Art. 5(3) ePrivacy) for cookies and localStorage. Contract performance (Art. 6(1)(b)) for onboarding flows directly required to use the SaaS. ### Does Userpilot transfer data to third countries? Yes. By default Userpilot processes EU customer data on AWS US East. EU residency on AWS Frankfurt is available as an enterprise add on. Engineering teams in Egypt and the UK may access data under contract. Transfers are covered by the EU SCCs, the UK IDTA and the EU US Data Privacy Framework. ### Do I need a DPIA for Userpilot? Yes when Userpilot is used at scale, because it combines systematic monitoring, profiling and automated in app nudges. The DPIA should cover cookies, NPS free text, the US transfer and the right to object to in app experiences. ### How do I implement Userpilot compliantly? Sign the Userpilot DPA, request EU residency if your plan allows it, gate the SDK behind a product analytics toggle, list Userpilot in your privacy notice and Article 30 record, complete a DPIA, document the US transfer with SCCs and DPF and offer a clear opt out for in app messages. ### Are there alternatives to Userpilot? Alternatives include Appcues (US with DPF), Pendo (US with EU residency, see our dedicated page), Chameleon (US), WalkMe (US with EU residency), Whatfix (India and US), Userflow (Denmark, EU friendly), Userlist and Customer.io for messaging based onboarding. ### How should I update my cookie and privacy policy for Userpilot? List the userpilot\_visitor and userpilot\_session cookies and the localStorage object in your cookie policy under product analytics. In your privacy notice describe Userpilot as your onboarding and product analytics processor, the US storage on AWS, the SCCs and DPF, the EU residency option and the customer's right to object to profiling. Same category ## More services: Customer support [See the whole category](https://www.flowconsent.com/en/services/customer-support) ### [ClinicSense](https://www.flowconsent.com/en/services/customer-support/clinicsense) [ClinicSense is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ClinicSense enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ClinicSense empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/customer-support/clinicsense) [Marketing](https://www.flowconsent.com/en/services/customer-support/clinicsense) · ### [Qpien](https://www.flowconsent.com/en/services/customer-support/qpien) [Qpien is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Qpien integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Qpien helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/qpien) [Preferences](https://www.flowconsent.com/en/services/customer-support/qpien) · ### [ZyraTalk](https://www.flowconsent.com/en/services/customer-support/zyratalk) [Zyratalk is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Zyratalk integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Zyratalk helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/zyratalk) [Preferences](https://www.flowconsent.com/en/services/customer-support/zyratalk) · ### [ChatPlus](https://www.flowconsent.com/en/services/customer-support/chatplus) [ChatPlus is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ChatPlus integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ChatPlus helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/chatplus) [Preferences](https://www.flowconsent.com/en/services/customer-support/chatplus) · ### [Mioot](https://www.flowconsent.com/en/services/customer-support/mioot) [Mioot is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Mioot integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Mioot helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/mioot) [Preferences](https://www.flowconsent.com/en/services/customer-support/mioot) · ### [Whatfix](https://www.flowconsent.com/en/services/customer-support/whatfix) [Whatfix is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Whatfix integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Whatfix helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/whatfix) [Customer support](https://www.flowconsent.com/en/services/customer-support/whatfix) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)