FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Marketing

ConvertBox

PreferencesOfficial website

ConvertBox is a conversion optimisation platform that displays targeted opt in forms, surveys and call to action pop ups, using first party cookies for visitor segmentation, A/B testing and frequency capping.

Block ConvertBox until consentScan my site
Overview

What does ConvertBox do?

What is ConvertBox

ConvertBox is a SaaS conversion optimisation tool that displays targeted opt in forms, quizzes, surveys and call to action pop ups on websites. Marketing teams use it to grow email lists, qualify leads and run A/B tests. The product is operated by ConvertBox LLC, a US company based in Texas, and hosted on US cloud infrastructure.

Data collected and cookies set

The ConvertBox script writes first party cookies (typically a visitor id, a session id and segmentation flags) so it can recognise returning visitors, run A/B variants and cap the frequency of pop ups. It also collects IP address, referrer, pages viewed, the segments a visitor matches and any form submissions. When a visitor submits a form, identifiers such as email address are passed to email service providers like MailChimp or ActiveCampaign.

GDPR and ePrivacy requirements

Because the cookies are not strictly necessary to deliver a service requested by the user, Article 5(3) of the ePrivacy Directive requires prior, informed consent before they are placed. The behavioural segmentation also constitutes profiling under GDPR Article 4(4), so the appropriate legal basis under Article 6 is consent (6(1)(a)). Information must meet the transparency requirements of Articles 12 to 14 and consent must satisfy Article 7.

International data transfers

ConvertBox processes data in the United States, so any deployment on an EU or UK site triggers Chapter V of the GDPR (Articles 44 to 49). Controllers must rely on a valid transfer mechanism, either the EU-US Data Privacy Framework if ConvertBox is certified, or Standard Contractual Clauses combined with a transfer impact assessment and supplementary safeguards.

Practical implementation steps

Gate the ConvertBox script behind your consent management platform so it only fires after the visitor accepts marketing or personalisation cookies. Sign a data processing agreement with ConvertBox LLC, document the transfer mechanism in your record of processing, list the cookies in your cookie policy and provide a working withdrawal mechanism so visitors can change their mind at any time.

Compliance

ConvertBox and the GDPR

ConvertBox is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (GDPR Art 6(1)(a) and ePrivacy Art 5(3)) for non essential first party cookies used for behavioural segmentation, A/B testing and frequency capping. Legitimate interests (Art 6(1)(f)) is not appropriate because of the profiling component.
Risk level
medium
Applicable regulations
GDPR, ePrivacy Directive, UK GDPR, PECR, CCPA/CPRA, LGPD

Impact assessment (DPIA)

A DPIA is recommended when ConvertBox is combined with email capture, behavioural segmentation across pages, or integration with marketing automation. Document the categories of data, the segmentation logic, retention periods, the US transfer mechanism (SCCs or EU-US DPF) and the consent flow that gates the script.

Sample text for your banner

We use ConvertBox to show personalised forms and offers, measure how visitors interact with them and prevent repeat displays. This uses first party cookies and sends data to ConvertBox in the United States. You can accept, refuse or change your choice at any time.
Cookies and trackers

What ConvertBox sets and contacts

Tracking method
JavaScript snippet loaded on the website, sets first party cookies in the visitor's browser and sends segmentation events to ConvertBox servers
Server location
United States (AWS infrastructure)
Data transferred outside the EU
Personal data (IP address, segmentation identifiers, behavioural events, email when submitted) is transferred from the EU/EEA and UK to the United States. Requires Standard Contractual Clauses and supplementary measures, or reliance on the EU-US Data Privacy Framework if the importer is certified.

Cookies set (4)

NameTypeDurationPurpose
cb_visitor_idfirst_party1 yearPersistent visitor identifier used to recognise returning visitors, attribute them to segments and prevent the same pop up from being shown repeatedly.
cb_sessionfirst_party30 minutesShort lived session identifier used to track the current visit and apply per session frequency rules.
cb_segmentfirst_party1 yearStores the segments a visitor matches (for example new vs returning, country, page rules) so the correct form or pop up variant is shown.
cb_abfirst_party6 monthsStores the A/B variant assigned to the visitor so the same variant is shown consistently across visits during a running experiment.

Third-party domains contacted (4)

  • app.convertbox.com
  • cdn.convertbox.com
  • api.convertbox.com
  • convertbox.com
Questions

Frequently asked questions about ConvertBox

Can't find your question? Write to us, we answer fast.

Which cookies does ConvertBox set?

ConvertBox sets first party cookies in your domain, typically a long lived visitor identifier, a short session identifier and one or more flags that store the segment a visitor matched or the A/B variant they were shown. The exact names depend on your account and configuration, but they are written by the embed script, not by a third party.

Do I need user consent before loading ConvertBox?

Yes. The cookies are used for behavioural segmentation, A/B testing and frequency capping, which are not strictly necessary to deliver content the visitor requested. Article 5(3) of the ePrivacy Directive and Article 6(1)(a) of the GDPR require prior, freely given, specific and informed consent before the script can run.

What is the appropriate legal basis under the GDPR?

Consent under Article 6(1)(a) is the right basis. Legitimate interests (Article 6(1)(f)) is generally not suitable because ConvertBox builds visitor segments and influences what is shown, which qualifies as profiling under Article 4(4) and is unlikely to pass a balancing test in a marketing context.

Where is data sent and what about US transfers?

ConvertBox LLC is based in Texas and hosts data in the United States. Any deployment on EU, EEA or UK websites involves a Chapter V transfer. You must rely on the EU-US Data Privacy Framework if ConvertBox is certified, or on Standard Contractual Clauses with a documented transfer impact assessment and supplementary measures.

Do I need a DPIA?

A formal DPIA is not automatically required, but it is strongly recommended when ConvertBox is used together with email capture, multi page tracking, integration with marketing automation or large scale segmentation. Document the data flows, US transfer mechanism, retention periods and the consent gate that controls the script.

How do I implement ConvertBox compliantly?

Place the ConvertBox embed code behind a consent management platform so it only loads after the visitor accepts personalisation or marketing cookies. Configure the script as a blocked vendor by default, declare the first party cookies in your cookie notice and respect choices through the platform's API for change and withdrawal.

What are the main alternatives to ConvertBox?

Comparable tools include OptinMonster, Sumo, Thrive Leads, Poptin and Klaviyo onsite forms. From a privacy standpoint they raise the same issues because they all rely on cookies, segmentation and, in most cases, US hosting. The compliant choice depends less on the vendor and more on how you gate the script and inform users.

How should I update my cookie policy?

List ConvertBox as a personalisation and conversion optimisation vendor, name the first party cookies it sets, describe their purpose and duration, identify ConvertBox LLC as the processor, mention the United States as the destination country and link to ConvertBox's privacy policy. Explain how users can withdraw consent.

Same category

More services: Marketing

See the whole category

CTRWOW

CTRWOW is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. CTRWOW integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, CTRWOW makes advanced AI accessible to all teams.

Marketing

Picreel

Picreel is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Picreel supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Picreel enables informed decisions that improve experience and drive results.

Analytics

Popcorn CRM

Popcorn CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Popcorn CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Popcorn CRM empowers data-driven relationship management.

Marketing

StoryStream

StoryStream is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. StoryStream integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, StoryStream makes advanced AI accessible to all teams.

Marketing

Ortto

Ortto is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Ortto provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Ortto helps deliver the right message to the right audience at the right time.

Marketing

Amped

Amped is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Amped enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Amped empowers marketing teams to achieve measurable growth.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site