> Kit (formerly ConvertKit) and GDPR: US transfers under SCCs, signup form cookies, open and click tracking and a compliant newsletter setup in Europe. > > Canonical: https://www.flowconsent.com/en/services/marketing/kit Marketing # Kit Marketing · [Official website](https://kit.com/fanbridge) Kit (formerly ConvertKit) is a US based email marketing and creator platform founded in 2013 and headquartered in Boise, Idaho. It is widely used by bloggers, podcasters, authors and online creators for newsletter signup forms, landing pages, automations and paid newsletters via Kit Commerce. For European audiences, Kit involves cross border transfers to AWS US infrastructure and tracking of opens and clicks, which require consent and clear disclosure. [Block Kit until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 3 - Third-party domains 5 - Servers United States (AWS US East and US West) with operator SeedProd, LLC (rebranded as Kit, formerly ConvertKit) in Boise, Idaho Overview ## What does Kit do? ## **What is Kit** Kit, originally founded in 2013 as ConvertKit by Nathan Barry, is an email marketing and creator platform headquartered in Boise, Idaho. The company rebranded from ConvertKit to Kit in 2024. It targets bloggers, podcasters, authors, course creators and content creators with tools for newsletter signup forms, landing pages, automations, paid newsletters (Kit Commerce) and a Creator Network for referrals. ## **Data and cookies collected** Kit collects subscriber email, name, tags, custom fields, sign up source, IP, opens and clicks. The embedded form widget can set first party cookies on the customer domain (ck\_subscriber\_id, ck\_session) for analytics and form attribution. Email opens are tracked via a 1x1 pixel and clicks via link wrapping through ck.kit.com (formerly convertkit.com). ## **GDPR and ePrivacy implications** Kit is a data processor under Art. 28 GDPR for the newsletter content and an independent controller for some platform analytics. The subscribe widget cookies trigger Art. 5(3) ePrivacy. Email and SMS direct marketing under Art. 13 ePrivacy require consent in B2C. The Creator Network referral feature shares subscriber data between creators and requires explicit, granular consent under GDPR. Tags and automations can build a profile that should be disclosed. ## **Consent requirements** Subscribing is the user's explicit opt in for the newsletter. Open tracking and click tracking should be disclosed. The Creator Network requires distinct consent because it shares subscriber data with other creators. Embedded form cookies should load after consent or in a cookie free mode if available. Kit Commerce payment processing goes through Stripe, which has its own consent and disclosure requirements. ## **Data transfers outside the EEA** Kit runs on AWS US infrastructure, no EU data centre is offered. EU subscriber data is transferred to the US under SCCs and the EU US Data Privacy Framework. Sub processors include AWS, SendGrid for email and Stripe for billing, each with their own transfer chain. ## **Practical compliance steps** Sign Kit's Data Processing Agreement, complete a Transfer Impact Assessment for the US transfers, disable the Creator Network or require explicit additional consent, load embedded forms after consent, disclose open and click tracking, document AWS, SendGrid and Stripe sub processors, and ensure one click unsubscribe on every email. Compliance ## Kit and the GDPR Kit is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for newsletter subscription, marketing emails to B2C subscribers, and any tracking pixels or cookies; Contract (Art. 6(1)(b) GDPR) for delivering the newsletter once a user has subscribed - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CAN-SPAM, CCPA, EU US Data Privacy Framework ### Impact assessment (DPIA) Kit processes subscriber email, name, tags, opens, clicks, sign up source, IP and custom fields on US AWS infrastructure. Key DPIA considerations: (1) the embedded subscribe widget can set first party cookies before consent if loaded eagerly; (2) open pixels and link wrapping process personal data and need a lawful basis; (3) US transfers rely on SCCs and the EU US Data Privacy Framework; (4) Kit Creator Network referrals share subscriber data between creators and need explicit consent; (5) automations and tags can produce profiling that should be documented; (6) Kit Commerce processes payment data through Stripe with its own transfer chain. ### Sample text for your banner > We use Kit (formerly ConvertKit) to manage and send our newsletter. With your consent, Kit processes your email, name, opens and clicks to deliver content and measure interest. Kit is hosted in the United States, your data is transferred under Standard Contractual Clauses and the EU US Data Privacy Framework. You can unsubscribe at any time from any email. Cookies and trackers ## What Kit sets and contacts - Tracking method Newsletter platform for creators with embedded subscribe forms, landing pages, email open tracking via 1x1 pixel and link click tracking; first-party cookies on customer domain via the embedded form widget - Server location United States (AWS US East and US West) with operator SeedProd, LLC (rebranded as Kit, formerly ConvertKit) in Boise, Idaho - Data transferred outside the EU Kit (formerly ConvertKit) operates exclusively on AWS infrastructure in the United States, with no announced EU data centre. EU subscriber data transfers rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and the EU US Data Privacy Framework where applicable. Sub processors include AWS, SendGrid for email delivery and Stripe for billing. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------------ | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | ck\_subscriber\_id | Marketing | 5 years | Persistent first party identifier set by the Kit embedded form to link page views to a known subscriber after the visitor clicks a tracked email link. | | ck\_session | Functional | Session | Session cookie used by Kit landing pages and embedded forms to maintain state during a visit. | | ck\_visitor\_id | Marketing | 1 year | Anonymous visitor identifier used by Kit to attribute future subscriptions and engagement to the same browser. | ### Third-party domains contacted (5) - `kit.com` - `convertkit.com` - `ck.kit.com` - `app.kit.com` - `media.kit.com` Questions ## Frequently asked questions about Kit Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Kit set? Kit can set first party cookies on the customer domain via its embedded subscribe widget, including ck\_subscriber\_id (links pageviews to a known subscriber) and ck\_session. Email opens use a 1x1 pixel, clicks use link wrapping via ck.kit.com without storing browser state. ### Do I need consent to use Kit? Yes for any non essential cookies set by the embedded form widget and for direct email marketing in B2C. The subscription itself is the user's opt in for the newsletter. The Creator Network referral feature needs a separate explicit consent. ### What is the legal basis for processing data via Kit? Consent (Art. 6(1)(a) GDPR) for newsletter subscription, email marketing in B2C and tracking pixels/cookies. Contract (Art. 6(1)(b) GDPR) for delivering the newsletter once subscribed. Legitimate interest (Art. 6(1)(f) GDPR) only for very narrow B2B promotional cases with an opt out. ### Where does Kit store data, and are there transfers to the US? Kit processes data on AWS US infrastructure, with no EU data centre. EU subscriber data is transferred under SCCs and the EU US Data Privacy Framework where applicable. Sub processors include AWS, SendGrid for email delivery and Stripe for billing. ### Is a DPIA required for Kit? A DPIA is recommended for large lists, paid newsletters via Kit Commerce or use of the Creator Network for referrals. The DPIA should cover open/click tracking, the Creator Network data sharing, US sub processors and retention of engagement history. ### How do I deploy Kit in a GDPR compliant way? Sign Kit's Data Processing Agreement, complete a TIA, disable the Creator Network or require explicit consent, load the embedded form after cookie consent, disclose pixels and link wrapping, document AWS, SendGrid and Stripe and provide one click unsubscription. ### What are GDPR friendly alternatives to Kit? EU based newsletter platforms include Brevo (France), Mailerlite (Lithuania), GetResponse (Poland), CleverReach (Germany) and Newsletter2Go/Sendinblue. For paid newsletters specifically, Ghost (open source, UK foundation), Substack (US) or Buttondown (US) can be considered, with self hosting being the strongest privacy choice. ### How should I update my privacy policy for Kit? Disclose Kit (formerly ConvertKit) as a sub processor, name AWS, SendGrid and Stripe as sub processors, describe the cookies set by embedded forms and their duration, document open and click tracking, declare the Creator Network as an optional sharing requiring separate consent and link Kit's privacy notice. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [CASAFARI](https://www.flowconsent.com/en/services/marketing/casafari) [Casafari is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Casafari provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Casafari helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/casafari) [Marketing](https://www.flowconsent.com/en/services/marketing/casafari) · ### [Formrun](https://www.flowconsent.com/en/services/marketing/formrun) [Formrun is a form building and data collection platform that helps businesses create professional online forms, surveys, and questionnaires without coding. It offers a drag-and-drop builder, conditional logic, file uploads, and payment collection. Formrun integrates with CRM, email marketing, and productivity tools to automate workflows triggered by submissions. With responsive designs and spam protection, Formrun helps capture leads and collect data securely.](https://www.flowconsent.com/en/services/marketing/formrun) [Marketing](https://www.flowconsent.com/en/services/marketing/formrun) · ### [Kudobuzz](https://www.flowconsent.com/en/services/marketing/kudobuzz) [Kudobuzz is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Kudobuzz integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Kudobuzz helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/kudobuzz) [Preferences](https://www.flowconsent.com/en/services/marketing/kudobuzz) · ### [Tripadviser.Widget](https://www.flowconsent.com/en/services/marketing/tripadviser-widget) [Tripadviser.Widget is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Tripadviser.Widget supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Tripadviser.Widget ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/marketing/tripadviser-widget) [Marketing](https://www.flowconsent.com/en/services/marketing/tripadviser-widget) · ### [eKomi](https://www.flowconsent.com/en/services/marketing/ekomi) [eKomi is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. eKomi integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, eKomi helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/ekomi) [Marketing](https://www.flowconsent.com/en/services/marketing/ekomi) · ### [CleanCore](https://www.flowconsent.com/en/services/marketing/cleancore) [CleanCore is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. CleanCore enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, CleanCore empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/cleancore) [Marketing](https://www.flowconsent.com/en/services/marketing/cleancore) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)