> Yampi Checkout is hosted in Brazil and sets functional and marketing cookies. Learn about GDPR consent, third-country transfers, and compliant implementation. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/yampi-checkout E-commerce # Yampi Checkout Preferences · [Official website](https://www.yampi.com.br/checkout) Yampi Checkout is a Brazilian e-commerce checkout solution that lets merchants accept payments through a hosted or embedded flow integrated with multiple payment gateways. It includes cart management, one-page checkout, abandoned cart recovery, A/B testing, and detailed conversion analytics. Yampi is widely used by Brazilian retailers on Shopify, WooCommerce, Nuvemshop, and other platforms. Because the infrastructure is hosted in Brazil, any use targeting EU customers raises a third-country transfer issue under the GDPR. [Block Yampi Checkout until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 6 - Third-party domains 4 - Servers Brazil Overview ## What does Yampi Checkout do? ## **What Yampi Checkout is and how it works** Yampi Checkout is a SaaS checkout product developed by Yampi, a Brazilian e-commerce platform headquartered in São Paulo. It replaces the native checkout of platforms such as Shopify, WooCommerce, Nuvemshop or Magento with an optimised cart, one-page payment, and post-purchase flow. Merchants connect Yampi to one or several payment gateways (Cielo, Stone, PagSeguro, Stripe, Mercado Pago) and offer Pix, boleto, card and digital wallets. The checkout runs either as a redirect to seguro.yampi.com.br or as an embedded iframe. It includes abandoned cart recovery, A/B testing, upsells, and a backend that the merchant uses to monitor conversion in real time. ## **Data and cookies collected** Yampi sets several first-party cookies. A session cookie keeps the cart linked to the visitor, a CSRF token protects checkout forms, and a customer identifier links anonymous browsing sessions to subsequent logged-in or paid sessions. In addition, Yampi may set A/B testing cookies, conversion tracking cookies, and an e-mail-capture cookie used to send abandoned cart messages. Personal data collected typically includes name, e-mail, CPF or other tax identifier, billing and shipping address, phone number, IP address, device information, and the full order content. Some merchants enable Facebook Pixel, Google Ads or TikTok Pixel inside Yampi: those further extend the cookie footprint to advertising networks. ## **GDPR and ePrivacy implications** Strictly necessary cookies (cart session, CSRF) do not require consent under Article 5(3) of the ePrivacy Directive. However, the A/B testing, conversion tracking, e-mail capture for abandoned cart, and any advertising pixels enabled on top of Yampi do require informed prior consent. The legal basis differs accordingly: contract performance for the checkout itself, consent for marketing features. ## **Data transfers to Brazil** Yampi hosts its infrastructure on cloud providers located in Brazil. Brazil benefits from a modern data protection regime (LGPD) but has not yet been granted an adequacy decision by the European Commission as of 2026. EU controllers must therefore implement appropriate safeguards: Standard Contractual Clauses, a transfer impact assessment, and supplementary measures such as encryption in transit and at rest. ## **Consent and DPIA** The non-essential cookies set by Yampi must be blocked until the visitor opts in. The abandoned cart e-mail flow requires either consent or, in B2B contexts, a soft opt-in covered by an existing customer relationship. A DPIA is recommended because the processing combines profiling for conversion optimisation, marketing remarketing, and a transfer to a third country. ## **Practical compliance steps** Sign a data processing addendum with Yampi including SCCs, disable A/B testing and abandoned cart capture for users who refuse marketing, document the subprocessors used by the platform, configure your consent banner to gate the non-essential Yampi cookies, and reference Yampi explicitly in your privacy policy with a clear statement on the transfer to Brazil. Compliance ## Yampi Checkout and the GDPR Yampi Checkout is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis consent\_for\_marketing\_and\_analytics\_cookies\_contract\_for\_session\_cookies - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, LGPD ### Impact assessment (DPIA) A DPIA is recommended whenever Yampi is used on stores that target EU residents, because the combination of marketing cookies, conversion tracking, abandoned cart e-mails, and a transfer to Brazil increases the overall risk. The DPIA should cover the consent mechanism, the SCCs signed with Yampi, the retention periods of cart and transaction logs, and the safeguards applied to e-mail-based remarketing. ### Sample text for your banner > We use Yampi Checkout to operate our cart, payment, and abandoned cart recovery. Some cookies are strictly necessary for the checkout to function; others (A/B testing, conversion tracking, marketing) require your consent. Your purchase data is processed in Brazil under Standard Contractual Clauses. Cookies and trackers ## What Yampi Checkout sets and contacts - Tracking method first\_party\_cookies\_and\_javascript - Server location Brazil - Data transferred outside the EU Yampi hosts data on servers in Brazil. For EU users, this constitutes a transfer to a third country. Brazil benefits from a partial recognition through the LGPD framework, but no adequacy decision has been issued by the European Commission as of 2026. Standard Contractual Clauses and a transfer impact assessment are required. ### Cookies set (6) | Name | Type | Duration | Purpose | | ----------------------- | ---- | --------- | ------------------------------------------------------------------------------ | | yampi\_session | http | session | Maintains the cart and checkout session for the visitor. | | XSRF-TOKEN | http | session | Cross-site request forgery protection for checkout forms. | | \_yampi\_cid | http | 12 months | Customer identifier that links anonymous browsing to subsequent paid sessions. | | \_yampi\_ab | http | 90 days | A/B testing cookie used to assign and persist checkout experiments. | | \_yampi\_cart\_recovery | http | 30 days | Stores the e-mail and cart contents used for abandoned cart recovery messages. | | \_yampi\_conv | http | 30 days | Conversion attribution cookie set after a successful purchase. | ### Third-party domains contacted (4) - `yampi.com.br` - `seguro.yampi.com.br` - `cdn.yampi.io` - `api.yampi.com.br` Questions ## Frequently asked questions about Yampi Checkout Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Yampi Checkout set? Yampi sets a session cookie and a CSRF token (strictly necessary), a customer identifier that links browsing to purchase, an A/B testing cookie, a cart recovery cookie that stores e-mail and cart content, and a conversion attribution cookie. Advertising pixels (Meta, Google, TikTok) can be enabled by the merchant on top. ### Is consent required for Yampi Checkout? Yes for the non-essential layers. Cart session and CSRF cookies are exempt, but A/B testing, conversion tracking, abandoned cart e-mail capture, and any advertising pixels require informed prior consent. Block these cookies until the visitor opts in through your consent management platform. ### What is the legal basis? Two distinct legal bases apply. Article 6(1)(b) GDPR (performance of a contract) covers the checkout, payment, and order fulfilment. Article 6(1)(a) GDPR (consent) covers A/B testing, conversion tracking, abandoned cart marketing, and advertising pixels enabled inside Yampi. ### Does Yampi transfer data outside the EU? Yes. Yampi operates from Brazil, so EU customer data is transferred to a third country. As of 2026 Brazil does not benefit from an EU adequacy decision, so the transfer must rely on Standard Contractual Clauses, a transfer impact assessment, and supplementary measures such as encryption. ### Is a DPIA required? A DPIA is strongly recommended when Yampi is deployed on stores that target EU customers, because the processing combines large-scale profiling (A/B testing, conversion tracking, remarketing) with a transfer to a non-adequate third country. The DPIA should document risks, safeguards, and the consent design. ### How do I implement Yampi compliantly? Sign a data processing addendum with SCCs, configure your consent banner to block A/B testing and marketing cookies until opt-in, disable abandoned cart e-mail capture for visitors who refuse marketing, document Yampi as a subprocessor in your records, and inform customers in your privacy policy about the transfer to Brazil. ### What are the alternatives to Yampi for EU merchants? EU-based or EU-hosted checkout solutions include Shopify Checkout (with EU data residency options), Mollie, Adyen, Stripe Checkout (EU), Bold Commerce, or building a custom checkout on top of headless commerce. These options reduce or eliminate the third-country transfer concern for European customers. ### How should I update my cookie policy for Yampi? List each Yampi cookie with its name, type, duration, and purpose. Mark cart session and CSRF as strictly necessary, and A/B testing, conversion tracking, cart recovery, and any advertising pixels as subject to consent. Mention Yampi by name as a processor, reference the SCCs for the Brazil transfer, and refresh the page when Yampi updates its subprocessor list. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [ABOUT YOU Commerce Suite](https://www.flowconsent.com/en/services/ecommerce/about-you-commerce-suite) [ABOUT YOU Commerce Suite offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. ABOUT YOU Commerce Suite integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven business decisions.](https://www.flowconsent.com/en/services/ecommerce/about-you-commerce-suite) [Preferences](https://www.flowconsent.com/en/services/ecommerce/about-you-commerce-suite) · ### [Iamport](https://www.flowconsent.com/en/services/ecommerce/iamport) [Iamport is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Iamport supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Iamport ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/iamport) [Preferences](https://www.flowconsent.com/en/services/ecommerce/iamport) · ### [Loop Returns](https://www.flowconsent.com/en/services/ecommerce/loop-returns) [Loop Returns is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Loop Returns integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Loop Returns helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/loop-returns) [E-commerce](https://www.flowconsent.com/en/services/ecommerce/loop-returns) · ### [Returnly](https://www.flowconsent.com/en/services/ecommerce/returnly) [Returnly is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Returnly supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Returnly ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/returnly) [E-commerce](https://www.flowconsent.com/en/services/ecommerce/returnly) · ### [SunShop](https://www.flowconsent.com/en/services/ecommerce/sunshop) [Sunshop is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Sunshop integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Sunshop helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/sunshop) [Preferences](https://www.flowconsent.com/en/services/ecommerce/sunshop) · ### [American Express](https://www.flowconsent.com/en/services/ecommerce/american-express) [American Express is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. American Express supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, American Express ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/american-express) [Preferences](https://www.flowconsent.com/en/services/ecommerce/american-express) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)