> Learn how ConvertBox handles first party cookies, behavioural segmentation and US data transfers, and what GDPR and ePrivacy require before you load it. > > Canonical: https://www.flowconsent.com/en/services/marketing/convertbox Marketing # ConvertBox Preferences · [Official website](https://convertbox.com) ConvertBox is a conversion optimisation platform that displays targeted opt in forms, surveys and call to action pop ups, using first party cookies for visitor segmentation, A/B testing and frequency capping. [Block ConvertBox until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Preferences - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers United States (AWS infrastructure) Overview ## What does ConvertBox do? ## **What is ConvertBox** ConvertBox is a SaaS conversion optimisation tool that displays targeted opt in forms, quizzes, surveys and call to action pop ups on websites. Marketing teams use it to grow email lists, qualify leads and run A/B tests. The product is operated by ConvertBox LLC, a US company based in Texas, and hosted on US cloud infrastructure. ## **Data collected and cookies set** The ConvertBox script writes first party cookies (typically a visitor id, a session id and segmentation flags) so it can recognise returning visitors, run A/B variants and cap the frequency of pop ups. It also collects IP address, referrer, pages viewed, the segments a visitor matches and any form submissions. When a visitor submits a form, identifiers such as email address are passed to email service providers like MailChimp or ActiveCampaign. ## **GDPR and ePrivacy requirements** Because the cookies are not strictly necessary to deliver a service requested by the user, Article 5(3) of the ePrivacy Directive requires prior, informed consent before they are placed. The behavioural segmentation also constitutes profiling under GDPR Article 4(4), so the appropriate legal basis under Article 6 is consent (6(1)(a)). Information must meet the transparency requirements of Articles 12 to 14 and consent must satisfy Article 7. ## **International data transfers** ConvertBox processes data in the United States, so any deployment on an EU or UK site triggers Chapter V of the GDPR (Articles 44 to 49). Controllers must rely on a valid transfer mechanism, either the EU-US Data Privacy Framework if ConvertBox is certified, or Standard Contractual Clauses combined with a transfer impact assessment and supplementary safeguards. ## **Practical implementation steps** Gate the ConvertBox script behind your consent management platform so it only fires after the visitor accepts marketing or personalisation cookies. Sign a data processing agreement with ConvertBox LLC, document the transfer mechanism in your record of processing, list the cookies in your cookie policy and provide a working withdrawal mechanism so visitors can change their mind at any time. Compliance ## ConvertBox and the GDPR ConvertBox is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (GDPR Art 6(1)(a) and ePrivacy Art 5(3)) for non essential first party cookies used for behavioural segmentation, A/B testing and frequency capping. Legitimate interests (Art 6(1)(f)) is not appropriate because of the profiling component. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, UK GDPR, PECR, CCPA/CPRA, LGPD ### Impact assessment (DPIA) A DPIA is recommended when ConvertBox is combined with email capture, behavioural segmentation across pages, or integration with marketing automation. Document the categories of data, the segmentation logic, retention periods, the US transfer mechanism (SCCs or EU-US DPF) and the consent flow that gates the script. ### Sample text for your banner > We use ConvertBox to show personalised forms and offers, measure how visitors interact with them and prevent repeat displays. This uses first party cookies and sends data to ConvertBox in the United States. You can accept, refuse or change your choice at any time. Cookies and trackers ## What ConvertBox sets and contacts - Tracking method JavaScript snippet loaded on the website, sets first party cookies in the visitor's browser and sends segmentation events to ConvertBox servers - Server location United States (AWS infrastructure) - Data transferred outside the EU Personal data (IP address, segmentation identifiers, behavioural events, email when submitted) is transferred from the EU/EEA and UK to the United States. Requires Standard Contractual Clauses and supplementary measures, or reliance on the EU-US Data Privacy Framework if the importer is certified. ### Cookies set (4) | Name | Type | Duration | Purpose | | --------------- | ------------ | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | cb\_visitor\_id | first\_party | 1 year | Persistent visitor identifier used to recognise returning visitors, attribute them to segments and prevent the same pop up from being shown repeatedly. | | cb\_session | first\_party | 30 minutes | Short lived session identifier used to track the current visit and apply per session frequency rules. | | cb\_segment | first\_party | 1 year | Stores the segments a visitor matches (for example new vs returning, country, page rules) so the correct form or pop up variant is shown. | | cb\_ab | first\_party | 6 months | Stores the A/B variant assigned to the visitor so the same variant is shown consistently across visits during a running experiment. | ### Third-party domains contacted (4) - `app.convertbox.com` - `cdn.convertbox.com` - `api.convertbox.com` - `convertbox.com` Questions ## Frequently asked questions about ConvertBox Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does ConvertBox set? ConvertBox sets first party cookies in your domain, typically a long lived visitor identifier, a short session identifier and one or more flags that store the segment a visitor matched or the A/B variant they were shown. The exact names depend on your account and configuration, but they are written by the embed script, not by a third party. ### Do I need user consent before loading ConvertBox? Yes. The cookies are used for behavioural segmentation, A/B testing and frequency capping, which are not strictly necessary to deliver content the visitor requested. Article 5(3) of the ePrivacy Directive and Article 6(1)(a) of the GDPR require prior, freely given, specific and informed consent before the script can run. ### What is the appropriate legal basis under the GDPR? Consent under Article 6(1)(a) is the right basis. Legitimate interests (Article 6(1)(f)) is generally not suitable because ConvertBox builds visitor segments and influences what is shown, which qualifies as profiling under Article 4(4) and is unlikely to pass a balancing test in a marketing context. ### Where is data sent and what about US transfers? ConvertBox LLC is based in Texas and hosts data in the United States. Any deployment on EU, EEA or UK websites involves a Chapter V transfer. You must rely on the EU-US Data Privacy Framework if ConvertBox is certified, or on Standard Contractual Clauses with a documented transfer impact assessment and supplementary measures. ### Do I need a DPIA? A formal DPIA is not automatically required, but it is strongly recommended when ConvertBox is used together with email capture, multi page tracking, integration with marketing automation or large scale segmentation. Document the data flows, US transfer mechanism, retention periods and the consent gate that controls the script. ### How do I implement ConvertBox compliantly? Place the ConvertBox embed code behind a consent management platform so it only loads after the visitor accepts personalisation or marketing cookies. Configure the script as a blocked vendor by default, declare the first party cookies in your cookie notice and respect choices through the platform's API for change and withdrawal. ### What are the main alternatives to ConvertBox? Comparable tools include OptinMonster, Sumo, Thrive Leads, Poptin and Klaviyo onsite forms. From a privacy standpoint they raise the same issues because they all rely on cookies, segmentation and, in most cases, US hosting. The compliant choice depends less on the vendor and more on how you gate the script and inform users. ### How should I update my cookie policy? List ConvertBox as a personalisation and conversion optimisation vendor, name the first party cookies it sets, describe their purpose and duration, identify ConvertBox LLC as the processor, mention the United States as the destination country and link to ConvertBox's privacy policy. Explain how users can withdraw consent. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [CTRWOW](https://www.flowconsent.com/en/services/marketing/ctrwow) [CTRWOW is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. CTRWOW integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, CTRWOW makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/ctrwow) [Marketing](https://www.flowconsent.com/en/services/marketing/ctrwow) · ### [Picreel](https://www.flowconsent.com/en/services/marketing/picreel) [Picreel is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Picreel supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Picreel enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/marketing/picreel) [Analytics](https://www.flowconsent.com/en/services/marketing/picreel) · ### [Popcorn CRM](https://www.flowconsent.com/en/services/marketing/popcorn-crm) [Popcorn CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Popcorn CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Popcorn CRM empowers data-driven relationship management.](https://www.flowconsent.com/en/services/marketing/popcorn-crm) [Marketing](https://www.flowconsent.com/en/services/marketing/popcorn-crm) · ### [StoryStream](https://www.flowconsent.com/en/services/marketing/storystream) [StoryStream is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. StoryStream integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, StoryStream makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/storystream) [Marketing](https://www.flowconsent.com/en/services/marketing/storystream) · ### [Ortto](https://www.flowconsent.com/en/services/marketing/ortto) [Ortto is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Ortto provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Ortto helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/ortto) [Marketing](https://www.flowconsent.com/en/services/marketing/ortto) · ### [Amped](https://www.flowconsent.com/en/services/marketing/amped) [Amped is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Amped enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Amped empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/amped) [Marketing](https://www.flowconsent.com/en/services/marketing/amped) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)