> How CleverTap tracks web and mobile users for engagement campaigns, the cookies it sets, GDPR consent and data transfers to the US and India. > > Canonical: https://www.flowconsent.com/en/services/marketing/clevertap Marketing # CleverTap Marketing CleverTap is a customer engagement and retention platform that combines web and mobile analytics, segmentation, push notifications, in app messaging, email and SMS. The publisher embeds a JavaScript SDK on the website (or a native SDK in iOS and Android apps) which sends every event and a persistent CleverTap identifier to CleverTap servers. By default the data lives in the United States or India; an EU region (Frankfurt) is available on request. Because CleverTap performs large scale behavioural profiling, GDPR consent and a Transfer Impact Assessment are unavoidable. [Block CleverTap until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 5 - Servers United States, India and European Union (CleverTap Inc., San Francisco and Mumbai, with optional EU region) Overview ## What does CleverTap do? ## **What CleverTap does** CleverTap is a customer engagement platform that competes with Braze and Iterable on the mobile first market. It captures web and mobile events, builds rich user profiles, segments them, and orchestrates push notifications, in app messages, emails, SMS and WhatsApp campaigns. The product is sold to consumer brands (retail, fintech, media, gaming) that need to keep app users active across millions of sessions per day. ## **Data and cookies collected** On the web, CleverTap sets WZRK\_G (1 year), WZRK\_S (session), WZRK\_F (1 year, first touch) and WZRK\_CAMP (30 days, campaign source). On mobile, the SDK stores a persistent device identifier plus the push token. It captures every page view, screen view, custom event, and user attributes pushed by the publisher (email, phone, age, country, custom traits). Profiles are kept for the lifetime of the user account on CleverTap until explicit deletion. ## **GDPR and ePrivacy obligations** Persistent identifiers, behavioural profiling and triggered marketing require freely given, informed and specific consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. The SDK must be loaded and the device token registered only after that consent. Push and SMS campaigns trigger Article 13 ePrivacy direct marketing rules. Where the publisher operates in regulated sectors (finance, health) explicit consent under Article 9 may also apply. ## **Data residency choices** CleverTap offers three production regions : us1 (United States), in1 (India) and eu1 (European Union, Frankfurt). European publishers should pick eu1 to keep the data plane inside the EEA. Even with eu1, global engineering and support access from CleverTap teams in the United States and India remain possible under the DPA, so SCCs and a Transfer Impact Assessment are still part of the file. ## **Compliance steps** Pick the eu1 region. Block the SDK behind the CMP consent gate on the web and the iOS App Tracking Transparency prompt on mobile. Hash personal identifiers (email, phone) at the SDK level. Sign the CleverTap DPA, attach SCCs and complete a Transfer Impact Assessment for any non eu1 deployment or for global support access. Run a DPIA covering segmentation logic, push frequency rules and retention. Configure short retention for inactive profiles. Compliance ## CleverTap and the GDPR CleverTap is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for behavioural tracking, push notifications and in app messaging - Risk level high - Applicable regulations GDPR, ePrivacy Directive, CCPA, India DPDP Act ### Impact assessment (DPIA) CleverTap processes persistent device identifiers, event timelines, screen views, user attributes (email, phone, demographic data) and push tokens to build long term behavioural profiles used for segmentation and triggered campaigns. Key DPIA considerations : (1) systematic profiling on a large scale triggers Article 35(3)(b) GDPR; (2) push notifications and SMS bring Article 13 ePrivacy marketing rules into play; (3) by default data is stored in the United States or India, both third countries requiring SCCs and Transfer Impact Assessment, switching to the EU region (eu1) is the simplest mitigation; (4) email and phone are direct identifiers that CleverTap stores in plain text by default, hashing should be configured at the SDK level; (5) integration with CRM, analytics and advertising platforms creates a unified profile across many vendors that the publisher must expose under the right of access. A DPIA is essentially mandatory for any non trivial deployment. ### Sample text for your banner > Our site and mobile apps use CleverTap (CleverTap Inc., San Francisco, United States) to remember what content you view and to send you relevant push notifications and in app messages. CleverTap stores cookies and a persistent identifier in your browser and on your device, and processes your events on its servers (United States, India or European Union, depending on configuration). Transfers to the US and India rely on Standard Contractual Clauses. You can refuse this tracking in the cookie banner and in the mobile app settings; basic site functionality is unaffected. Cookies and trackers ## What CleverTap sets and contacts - Tracking method Web JavaScript SDK plus mobile SDK (iOS and Android) and REST API (customer engagement platform) - Server location United States, India and European Union (CleverTap Inc., San Francisco and Mumbai, with optional EU region) - Data transferred outside the EU CleverTap Inc. is headquartered in San Francisco with engineering teams in Mumbai. Event data, persistent device identifiers and user profiles are transferred to CleverTap data centres in the United States (us1), India (in1) or, on request, in the European Union (eu1, Frankfurt). The US and India transfers rely on Standard Contractual Clauses under Article 46(2)(c) GDPR; the EU region eliminates third country transfer for the data plane but global support and engineering access may still occur from outside the EEA. ### Cookies set (4) | Name | Type | Duration | Purpose | | ---------- | --------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | WZRK\_G | Marketing | 1 year | Persistent unique visitor identifier (CleverTap Guid) used to recognise the same person across sessions and to attribute events to the right profile. | | WZRK\_S | Marketing | Session | Session level identifier used to group events into a single session for retention and journey analytics. | | WZRK\_F | Marketing | 1 year | Stores the first visit timestamp and source so first touch attribution is preserved. | | WZRK\_CAMP | Marketing | 30 days | Stores the campaign source that brought the visitor (for last touch attribution and triggered campaign suppression). | ### Third-party domains contacted (5) - `clevertap.com` - `wzrkt.com` - `eu1.clevertap-prod.com` - `in1.clevertap-prod.com` - `us1.clevertap-prod.com` Questions ## Frequently asked questions about CleverTap Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does CleverTap set? WZRK\_G (1 year, persistent visitor ID), WZRK\_S (session), WZRK\_F (1 year, first touch) and WZRK\_CAMP (30 days, campaign source). All on the publisher domain or on a CleverTap subdomain depending on integration. ### Do I need consent to load CleverTap? Yes. Persistent identifiers, behavioural profiling and triggered push messaging require prior explicit consent under Article 5(3) ePrivacy and Article 6(1)(a) GDPR. The SDK must be blocked behind the CMP and the iOS App Tracking Transparency prompt. ### What legal basis applies? Consent for all CleverTap processing. Legitimate interest is not defensible for the combination of cross session profiling and triggered marketing. Article 13 ePrivacy applies to push, SMS and WhatsApp campaigns. ### Is data transferred outside the EU? Yes by default. Pick the eu1 region to keep the data plane in the EU. Even then, global engineering and support access from the US and India remain possible; SCCs and a Transfer Impact Assessment apply. ### Is a DPIA required? Essentially yes for any meaningful deployment. CleverTap is large scale systematic profiling under Article 35(3)(b) GDPR and combines persistent identifiers with marketing channels regulated by ePrivacy. ### How do I implement CleverTap compliantly? Pick eu1. Block SDK behind CMP. Hash personal identifiers at the SDK level. Sign the CleverTap DPA. Complete TIA. Document the segmentation logic. Configure short retention for inactive profiles. Give users an easy opt out across web and mobile. ### Are there European alternatives? Yes : Bloomreach Engagement (Netherlands, Czech), Emarsys (Hungary, now SAP), Salesforce Marketing Cloud (US with EU regions), Mixpanel EU, Mapp Digital (Germany). Bloomreach and Emarsys are the most EU rooted alternatives for retention plus engagement. ### How should I update my cookie policy? List WZRK\_G, WZRK\_S, WZRK\_F and WZRK\_CAMP with their domain, duration and marketing purpose. Add CleverTap Inc. to the recipient list. Mention the United States, India and the European Union as possible destination countries depending on the chosen region. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Notifly](https://www.flowconsent.com/en/services/marketing/notifly) [Notifly is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Notifly provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Notifly helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/notifly) [Marketing](https://www.flowconsent.com/en/services/marketing/notifly) · ### [Convertri](https://www.flowconsent.com/en/services/marketing/convertri) [Convertri is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Convertri supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Convertri enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/marketing/convertri) [Analytics](https://www.flowconsent.com/en/services/marketing/convertri) · ### [WooChat](https://www.flowconsent.com/en/services/marketing/woochat) [WooChat is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. WooChat provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, WooChat helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/woochat) [Marketing](https://www.flowconsent.com/en/services/marketing/woochat) · ### [Birdeye](https://www.flowconsent.com/en/services/marketing/birdeye) [Birdeye is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Birdeye enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Birdeye empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/birdeye) [Marketing](https://www.flowconsent.com/en/services/marketing/birdeye) · ### [Mailman](https://www.flowconsent.com/en/services/marketing/mailman) [Mailman is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Mailman enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Mailman empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/mailman) [Marketing](https://www.flowconsent.com/en/services/marketing/mailman) · ### [Amazon SES](https://www.flowconsent.com/en/services/marketing/amazon-ses) [Amazon SES is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Amazon SES provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Amazon SES helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/amazon-ses) [Analytics](https://www.flowconsent.com/en/services/marketing/amazon-ses) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)