> Leanplum (CleverTap) GDPR analysis: SDK tracking, push notifications, consent rules, US data transfers, DPA, SCCs and compliance steps for European apps. > > Canonical: https://www.flowconsent.com/en/services/marketing/leanplum Marketing # Leanplum (CleverTap) Marketing Leanplum is a mobile and multi channel customer engagement platform founded in San Francisco in 2012 and acquired by CleverTap in 2022. It offers mobile and web push notifications, in app messages, email, A/B testing and behavioural analytics for consumer apps. As a US based vendor processing app event data, identifiers and contact information, it is treated as a high risk processor under the GDPR and requires consent for marketing channels in the European Union. [Block Leanplum (CleverTap) until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 6 - Servers United States (Leanplum, Inc., now part of CleverTap) Overview ## What does Leanplum (CleverTap) do? ## What is Leanplum Leanplum is a mobile marketing and customer engagement platform created in San Francisco in 2012 and acquired by CleverTap in 2022. It is now part of the CleverTap customer engagement suite and supports push notifications, in app messages, email, web push, A/B testing, behavioural analytics and audience targeting. The platform is widely used by mobile apps in retail, fintech, media and gaming to power onboarding flows, retention campaigns and personalised content. ## What data Leanplum collects The Leanplum SDK collects mobile advertising identifiers (IDFA, GAID) when granted, app instance identifiers, push notification tokens, user properties (email, name, custom attributes), app events (sessions, screens, custom events with parameters), device model, OS, OS version, app version, language, time zone, network type, IP address and coarse geolocation. When the web SDK is used, it collects browser identifiers and event data similar to a web analytics tool. All these signals are stored in the user profile maintained on Leanplum and CleverTap infrastructure. ## GDPR and ePrivacy implications Mobile push notifications are direct electronic marketing under Article 13 ePrivacy and require prior opt in consent. Reading device storage from the SDK falls under Article 5(3) ePrivacy. App event tracking for analytics or profiling requires a GDPR lawful basis, which is generally consent given the scope of data collected. Combining behavioural data with profiles for targeted offers raises additional obligations under Art. 22 GDPR when decisions have significant effects on users. ## Data transfers and hosting Leanplum and CleverTap process data on AWS infrastructure primarily in the United States. CleverTap offers EU and India data residency on request, which European customers should activate via contract. International transfers are governed by Standard Contractual Clauses under Art. 46(2)(c) GDPR and require a Transfer Impact Assessment that takes FISA 702 into account. CleverTap publishes a Data Processing Addendum and sub processor list to help controllers complete their analysis. ## How to use Leanplum compliantly Compliance checklist: implement a mobile consent flow (App Tracking Transparency on iOS plus an in app consent prompt for marketing); only initialise the Leanplum SDK after the user has accepted analytics and marketing; activate EU data residency where available; sign the Leanplum / CleverTap DPA and the SCCs; document the processing in your RoPA; run a DPIA for retention, profiling and large scale processing; update your privacy policy with the SDK, the processors, the categories of data and the user rights including erasure on request. Compliance ## Leanplum (CleverTap) and the GDPR Leanplum (CleverTap) is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for marketing messages and behavioural analytics; legitimate interest (Art. 6(1)(f) GDPR) may apply to transactional in app messaging - Risk level high - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA, LGPD ### Impact assessment (DPIA) Leanplum collects device identifiers (IDFA, GAID, app instance id), push notification tokens, user attributes, app events, session metadata, app version, OS, language, geolocation (when granted) and behavioural funnels. Key DPIA points: (1) the mobile SDK reads from and writes to terminal storage, triggering Art. 5(3) ePrivacy; (2) push notification tokens and user attributes constitute personal data under the GDPR, with marketing pushes requiring consent under Art. 7 ePrivacy as transposed in EU member states; (3) data is transferred to Leanplum and CleverTap servers in the United States by default, requiring SCCs and a Transfer Impact Assessment; (4) profiling and segmentation for targeted campaigns may trigger Art. 22 GDPR obligations; (5) audience export to advertising platforms must be assessed separately; a DPIA under Art. 35 GDPR is recommended for any large scale or sensitive context deployment. ### Sample text for your banner > We use Leanplum (CleverTap) to send you in app messages, push notifications and tailored content, and to measure how you interact with our application. Leanplum collects technical identifiers, app events and contact data and processes them on Leanplum and CleverTap servers in the United States. You can accept, refuse or fine tune this use at any time through our consent settings. Cookies and trackers ## What Leanplum (CleverTap) sets and contacts - Tracking method Mobile SDK (iOS, Android) and JavaScript SDK - Server location United States (Leanplum, Inc., now part of CleverTap) - Data transferred outside the EU Leanplum data is processed by Leanplum, Inc. (San Francisco) and CleverTap, Inc. (Mountain View) on AWS infrastructure primarily located in the United States. Transfers to the United States are governed by Standard Contractual Clauses under Article 46(2)(c) GDPR and require a Transfer Impact Assessment. CleverTap also operates EU and India data residency options on request. ### Cookies set (4) | Name | Type | Duration | Purpose | | --------------- | --------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | lp\_user\_id | HTTP first party cookie / Local Storage | 12 months | Stores the Leanplum user identifier used to stitch web events to a known profile. | | lp\_session | HTTP first party cookie | Session | Maintains the current Leanplum session metadata for web event collection. | | \_clevertap\_\* | HTTP first party cookie | 12 months | Cookies set by the CleverTap parent product for cross channel user identification, in app messaging targeting and analytics. | | IDFA / GAID | Mobile advertising identifier | Until reset by the user | Mobile advertising identifiers consumed by the Leanplum SDK when the user grants App Tracking Transparency (iOS) or the equivalent Android permission. | ### Third-party domains contacted (6) - `api.leanplum.com` - `www.leanplum.com` - `leanplum-cdn.s3.amazonaws.com` - `eu.api.clevertap.com` - `wzrkt.com` - `d2r1yp2w7bby2u.cloudfront.net` Questions ## Frequently asked questions about Leanplum (CleverTap) Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies and identifiers does Leanplum use? On the web SDK, Leanplum sets first party cookies and uses localStorage to store a visitor identifier. On mobile, the SDK relies on IDFA (iOS, with App Tracking Transparency), GAID (Android Advertising ID), an app instance id, and persistent storage for user properties and event queueing. All of these constitute personal data under the GDPR. ### Is user consent required for Leanplum? Yes. Marketing push notifications require opt in under Art. 13 ePrivacy. SDK initialisation and event tracking require Art. 5(3) ePrivacy consent before reading the device storage or advertising identifiers. On iOS, ATT consent is also required to access IDFA. ### What is the legal basis for processing? Consent (Art. 6(1)(a) GDPR) for marketing, analytics and behavioural segmentation. Legitimate interest (Art. 6(1)(f) GDPR) may apply to purely transactional in app messages tightly linked to the service requested by the user. ### Are data transferred to the United States? Yes by default. Leanplum and CleverTap run on AWS primarily in the United States. EU and India data residency are available on request. Transfers require SCCs under Art. 46(2)(c) GDPR and a Transfer Impact Assessment. ### Do I need a DPIA? Yes in most cases. Large scale processing of behavioural data, profiling for targeted campaigns, and the combination of identifiers across devices typically trigger Art. 35 GDPR DPIA obligations. ### How do I implement Leanplum compliantly? Gate SDK initialisation and push permission requests behind your CMP, activate EU data residency, sign the CleverTap DPA and SCCs, document processing in your RoPA, run a DPIA, configure retention and deletion settings, and update your privacy policy with a section on mobile marketing. ### What are the alternatives to Leanplum? Mobile engagement alternatives include Braze, Iterable, Airship, OneSignal, Batch (France), Bloomreach Engagement (Czech Republic) and Customer.io. Several offer EU hosting which simplifies the transfer analysis. ### How do I update my cookie policy? Add an entry for Leanplum / CleverTap covering the SDK, processed identifiers, retention period, US data transfer, and a clear opt out path through the CMP and the mobile system settings. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Gallabox](https://www.flowconsent.com/en/services/marketing/gallabox) [Gallabox is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Gallabox enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Gallabox empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/gallabox) [Marketing](https://www.flowconsent.com/en/services/marketing/gallabox) · ### [MailerLite plugin](https://www.flowconsent.com/en/services/marketing/mailerlite-plugin) [MailerLite plugin is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. MailerLite plugin supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, MailerLite plugin remains a leading web development choice.](https://www.flowconsent.com/en/services/marketing/mailerlite-plugin) [Analytics](https://www.flowconsent.com/en/services/marketing/mailerlite-plugin) · ### [Ligna](https://www.flowconsent.com/en/services/marketing/ligna) [Ligna is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Ligna enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Ligna empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/ligna) [Marketing](https://www.flowconsent.com/en/services/marketing/ligna) · ### [Pipedrive](https://www.flowconsent.com/en/services/marketing/pipedrive) [Pipedrive is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Pipedrive enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Pipedrive empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/pipedrive) [Marketing](https://www.flowconsent.com/en/services/marketing/pipedrive) · ### [AroSoftware](https://www.flowconsent.com/en/services/marketing/arosoftware) [AroSoftware is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. AroSoftware provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, AroSoftware helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/arosoftware) [Marketing](https://www.flowconsent.com/en/services/marketing/arosoftware) · ### [eKomi](https://www.flowconsent.com/en/services/marketing/ekomi) [eKomi is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. eKomi integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, eKomi helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/marketing/ekomi) [Marketing](https://www.flowconsent.com/en/services/marketing/ekomi) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)