> When Flodesk forms require consent, how subscriber data is processed, US transfers under the DPF, double opt in setup and a compliance checklist. > > Canonical: https://www.flowconsent.com/en/services/marketing/flodesk Marketing # Flodesk Marketing · [Official website](https://flodesk.com) Flodesk is a US email marketing platform known for visually rich newsletters, automated workflows and embed forms for capturing subscribers. [Block Flodesk until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers United States (Flodesk Inc., San Francisco), AWS US regions Overview ## What does Flodesk do? ## **What is Flodesk** Flodesk is a US email service provider popular with small businesses, creators and online stores. It positions itself around visually rich newsletter design, simple automations and a fixed flat price. Subscribers are captured through hosted forms, inline embeds, popup forms or sales pages, and the platform sends emails on your behalf with engagement tracking. ## **What cookies and data Flodesk collects** The Flodesk embed form script writes cookies for form display state, A/B variant and conversion tracking, plus localStorage entries. Subscriber records on the Flodesk side include email address, name, custom fields, the source URL, IP address, user agent and engagement data (opens, clicks, link tracking). Click tracking redirects pass through fld.click and similar Flodesk domains. ## **GDPR and ePrivacy implications** Loading the embed form script writes to the user device, so Article 5(3) ePrivacy applies. The newsletter subscription itself is governed by Art. 6(1)(a) GDPR consent and by national rules on commercial electronic communications. Open and click tracking pixels embedded in emails require a transparent disclosure in the privacy policy and the option to disable tracking for users who request it. ## **Consent and legal basis** Use double opt in on Flodesk subscribe forms; this is mandatory in Germany under TTDSG and strongly recommended in France and Spain. Tie the consent to a specific privacy notice version. For B2B sender soft opt in under the ePrivacy Directive can apply but conditions are narrow. Profiling based on opens and clicks requires its own consent. ## **Data transfers and hosting** Flodesk runs on AWS US regions and routes click tracking through US servers. Transfers from the EU are covered by the EU US Data Privacy Framework certification (verify the current status on the DPF list) and by Standard Contractual Clauses in the Flodesk DPA. EU residency is not advertised; document the transfer in your records of processing activities. ## **Practical compliance steps** Enable double opt in on every Flodesk form. Block embed scripts until consent. Clearly disclose Flodesk and the US transfer in your privacy policy. Honour unsubscribe links promptly and remove the contact from any segment. Audit Flodesk integrations and disable any that you do not actually use. Compliance ## Flodesk and the GDPR Flodesk is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for the newsletter subscription and the embed form cookies; legitimate interest (Art. 6(1)(f) GDPR) for security and anti abuse checks - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, EU US Data Privacy Framework, CAN SPAM, national newsletter rules ### Impact assessment (DPIA) A DPIA is recommended when Flodesk segments subscribers by sensitive interests, when minors can subscribe, when click and open data feeds profiling, or when integrations push subscriber data to other platforms. ### Sample text for your banner > We use Flodesk to send our newsletter and to embed subscription forms. Flodesk writes cookies on your device, processes your email and IP address, and shares them with Flodesk Inc. in the United States under the EU US Data Privacy Framework. We only embed the Flodesk form if you accept. Cookies and trackers ## What Flodesk sets and contacts - Tracking method Email service provider with JavaScript embed forms, click and open tracking pixels and hosted landing pages - Server location United States (Flodesk Inc., San Francisco), AWS US regions - Data transferred outside the EU Flodesk Inc. is US headquartered. All subscriber data, sending infrastructure and analytics run on AWS US regions. Transfers from the EU rely on the EU US Data Privacy Framework and the Standard Contractual Clauses in the Flodesk data processing addendum. ### Cookies set (3) | Name | Type | Duration | Purpose | | ---------------------- | ------------ | -------- | --------------------------------------------------------------- | | flodesk\_form\_session | third\_party | session | Identifies the current form session to avoid duplicate displays | | flodesk\_ab | third\_party | 1 year | Stores the A/B variant assigned to the visitor for a given form | | flodesk\_conv | third\_party | 1 year | Records the successful conversion to attribute later visits | ### Third-party domains contacted (4) - `flodesk.com` - `flodesk-universal.com` - `fld.click` - `assets.flodesk.com` Questions ## Frequently asked questions about Flodesk Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Flodesk set? Flodesk embed forms typically write a flodesk\_form\_session cookie, an A/B variant cookie and a conversion tracking cookie. Click tracking redirects from emails set transient cookies on the Flodesk domain. ### Is consent required for Flodesk? Loading the embed form requires consent under Article 5(3) ePrivacy. The newsletter subscription itself needs Art. 6(1)(a) GDPR consent and complies with national rules on commercial electronic communications. ### Which GDPR legal basis applies? Consent for the subscription and the form cookies. Legitimate interest for fraud prevention and minimal security analytics. Soft opt in for existing customers exists in B2B but with narrow conditions. ### Are there transfers to the United States? Yes. Flodesk runs on AWS US regions. Transfers rely on the EU US Data Privacy Framework and Standard Contractual Clauses in the Flodesk data processing addendum. ### Do I need a DPIA? Recommended when Flodesk segments subscribers by sensitive interests, when minors can subscribe, when click and open data feeds profiling, or when integrations push subscriber data to other platforms. ### How do I implement Flodesk compliantly? Enable double opt in, block embed scripts until consent, document the US transfer in your privacy policy, honour unsubscribes immediately, set short retention and audit integrations. ### Are there alternatives to Flodesk? EU based alternatives include Brevo (France), GetResponse (Poland), Sarbacane (France), CleverReach (Germany), MailerLite EU and self hosted Mautic or Listmonk. ### How do I update my cookie policy? List the Flodesk form cookies (session, A/B variant, conversion tracking) plus the click redirect cookies, with purpose and lifetime. Mention Flodesk as a sub processor with the EU US Data Privacy Framework basis. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [BTOLEAD](https://www.flowconsent.com/en/services/marketing/btolead) [BTOLEAD is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. BTOLEAD provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, BTOLEAD helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/btolead) [Marketing](https://www.flowconsent.com/en/services/marketing/btolead) · ### [Chimpify](https://www.flowconsent.com/en/services/marketing/chimpify) [Chimpify is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Chimpify provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Chimpify helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/chimpify) [Marketing](https://www.flowconsent.com/en/services/marketing/chimpify) · ### [icomm](https://www.flowconsent.com/en/services/marketing/icomm) [icomm is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. icomm enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, icomm empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/icomm) [Marketing](https://www.flowconsent.com/en/services/marketing/icomm) · ### [NexMind](https://www.flowconsent.com/en/services/marketing/nexmind) [NexMind is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. NexMind integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, NexMind makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/nexmind) [Analytics](https://www.flowconsent.com/en/services/marketing/nexmind) · ### [Warm Welcome](https://www.flowconsent.com/en/services/marketing/warm-welcome) [Warm Welcome is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Warm Welcome integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Warm Welcome helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/warm-welcome) [Marketing](https://www.flowconsent.com/en/services/marketing/warm-welcome) · ### [Klaviyo](https://www.flowconsent.com/en/services/marketing/klaviyo) [Klaviyo is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Klaviyo provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Klaviyo helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/klaviyo) [Marketing](https://www.flowconsent.com/en/services/marketing/klaviyo) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)