Convertful

What is Convertful?

Convertful is an onsite conversion optimisation platform launched in 2017 by Convertful Inc. and operated from the United States. It targets ecommerce stores, content publishers, and SaaS companies that want to convert anonymous traffic into newsletter subscribers, leads, or buyers. The product offers a drag, and, drop builder with templates for exit, intent popups, slide, ins, embedded inline forms, gamified opt, ins (spin, the, wheel, scratch cards), survey funnels, and announcement bars. Captured emails sync into 30, plus marketing platforms (Mailchimp, ActiveCampaign, ConvertKit, Klaviyo, HubSpot) through native integrations or webhooks. The widget loads from convertful.com or a CDN endpoint and is added with a single JavaScript snippet.

Cookies and data collected by Convertful

Convertful writes a first, party cookie called cnvf_visitor (typically 1 year) used to recognise returning visitors, enforce frequency caps, and attribute conversions to a popup. A second cookie cnvf_session captures the current session ID. The widget also writes a localStorage entry to remember which popups have been shown and dismissed. On the server side, Convertful logs visitor IP addresses, user agent strings, page URLs, scroll behaviour, and any data the visitor enters into a popup field (typically email, name, phone). When the email is forwarded to a downstream ESP, Convertful retains a copy of the lead in its dashboard for reporting purposes.

GDPR and ePrivacy implications

Convertful sits at the intersection of cookies and direct marketing, both of which are regulated under the ePrivacy Directive and GDPR. The cnvf_visitor cookie and the localStorage entry require prior consent under Article 5(3) ePrivacy because they go beyond strictly necessary functionality. The email address captured in the popup is personal data; processing it for marketing requires a separate, granular consent that meets the Article 7 GDPR requirements (freely given, specific, informed, unambiguous). Crucially, the same checkbox cannot bundle the cookie consent and the marketing consent, that practice has been sanctioned multiple times by the CNIL and the Spanish AEPD.

Consent requirements

Two consents are typically needed. First, the Convertful widget must be loaded only after the visitor has accepted the Marketing or Functional category in the CMP, so the cookies and tracking script do not fire on refusal. Second, every popup that captures personal data must include a clear privacy notice and an explicit opt, in mechanism for the marketing communications that follow. Pre, ticked boxes are not valid consent. The opt, in record (timestamp, IP, exact wording shown) should be stored to demonstrate compliance under Article 7(1) GDPR.

International data transfers

All Convertful data is hosted in the United States on AWS. Convertful Inc. is not currently certified under the EU, US Data Privacy Framework, so the contractual basis for the transfer is the set of Standard Contractual Clauses included in the DPA, complemented by a Transfer Impact Assessment. The TIA must consider the type of data captured (email and name in most cases, but sometimes more sensitive answers in survey funnels), the volume of European visitors, and the additional sub, processors involved (the ESP that ultimately stores the email). For high, scale European deployments, EU, hosted alternatives are easier to defend.

Practical compliance steps

Sign a DPA with Convertful Inc., gate the widget script behind the Marketing or Functional category of your CMP, and never load it before the consent event. Configure each popup with an explicit double, opt, in for the email list (single, opt, in is allowed under GDPR but double, opt, in provides stronger evidence of consent). Set a reasonable retention period for the captured leads in both Convertful and the downstream ESP. Document the chain of sub, processors in the privacy policy. For European audiences sensitive to US transfers, consider EU, hosted alternatives such as Mailerlite Popups (Lithuania), Brevo Forms (France), or open source tools like Sumo replaced by Convert (Belgium).