Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Navattic is a United States based interactive product demo platform used by sales and marketing teams to build guided, clickable demos that are embedded on websites and shared through links. Every embedded demo records detailed engagement analytics such as steps viewed, completion, time spent and drop off, and it can capture lead identifiers, so it reads and writes cookies and localStorage on the visitor device. Because this is non essential behavioural tracking, Navattic must load only after the visitor has given consent.
Navattic is an interactive product demo platform based in the United States. It lets sales and marketing teams capture a live product and turn it into a guided, clickable walkthrough that visitors can explore directly on a website or through a shared link. The demo runs as an embedded widget that loads its code from Navattic servers and renders inside the host page.
When a visitor opens a demo, Navattic records granular engagement analytics: which steps were viewed, where the visitor clicked, how long they stayed and where they dropped off. It stores a first party identifier in cookies and browser localStorage so a returning visitor can be recognised and their actions attributed to a single profile. Where a demo includes a form or a Call to Action, Navattic can also collect lead identifiers such as an email address and forward engagement events to connected CRM and marketing tools.
The engagement analytics and identifiers that Navattic processes are personal data under the GDPR, because they relate to an identifiable visitor. Storing and reading identifiers on the visitor device also falls within Article 5(3) of the ePrivacy Directive, which the CNIL in France, the German authorities under the TDDDG and the AEPD in Spain all enforce as a strict prior consent obligation for non essential trackers.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Consent is required before the Navattic embed loads, because it is not strictly necessary for the visitor to receive the content of the page. That consent must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. Until the visitor accepts, the demo script should not run and no cookies or localStorage entries should be written.
Navattic processes data on United States infrastructure, so European visitor data is transferred outside the European Economic Area. Such transfers require the EU Standard Contractual Clauses within the Navattic Data Processing Addendum and a documented Transfer Impact Assessment that considers United States surveillance law, in line with the Schrems II ruling and the guidance of the European Data Protection Board.
Gate the Navattic embed behind your consent management platform so it fires only after the analytics or marketing category is accepted. Provide clear information about Navattic in your cookie policy, including the identifiers it sets and their lifetime. Sign the Navattic Data Processing Addendum, complete a Transfer Impact Assessment and apply the shortest workable retention on viewer records. Where lead capture is not needed, disable it to minimise the personal data collected.
Websites using Navattic must obtain user consent under GDPR regulations.
DPIA considerations
A Data Protection Impact Assessment is advisable when Navattic demos are used at scale to profile prospects or to capture lead identifiers. Document the behavioural analytics collected by the embedded demo, the first party identifiers stored in cookies and localStorage, the syncing of engagement data into CRM tools such as HubSpot or Salesforce, the transfer of data to the United States and the retention period applied to viewer records. Configure the embed so that it loads only after consent and disable lead capture on pages where it is not strictly necessary.
Sample consent text
We use Navattic, an interactive demo service operated by Navattic Inc. (United States), to show you guided product demos. Navattic records how you interact with the demo and stores identifiers in cookies and localStorage on your device. This data may be transferred to the United States under the EU Standard Contractual Clauses. Navattic will only load if you click Accept.
Third-party domains contacted
navattic.comjs.navattic.comapi.navattic.comcdn.navattic.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| navattic_visitor_id | HTTP cookie (first party) | 12 months | Stores a persistent identifier for the demo viewer so Navattic can recognise returning visitors and attribute engagement events to a single person across demo sessions. |
| navattic_session | HTTP cookie (first party) | Session | Holds the current demo session so that step progression and interactions are grouped together during a single visit. |
| navattic_flow_state | localStorage | Persistent (until cleared) | Stores the progress and state of the interactive demo, such as the last step viewed, so the demo can resume where the viewer left off. |
| navattic_analytics | localStorage | Persistent (until cleared) | Buffers behavioural analytics events (clicks, completions, time spent) before they are sent to Navattic ingestion endpoints. |
Navattic places tracking cookies for advertising — comply with GDPR using FlowConsent.
Navattic sets a first party visitor identifier that persists for about twelve months, a session cookie, and localStorage entries that hold demo progress and buffered analytics events. Together they let Navattic recognise returning viewers and record how each demo is used.
Yes. Navattic performs non essential behavioural tracking and writes identifiers to the visitor device, so under the ePrivacy rules you must obtain prior consent before the embed loads. The demo script should stay blocked until the visitor accepts.
The only valid legal basis is consent under Article 6(1)(a) GDPR, combined with the prior consent requirement of Article 5(3) of the ePrivacy Directive. Legitimate interest cannot be used for this kind of non essential analytics and lead tracking.
Yes. Navattic hosts its platform on United States infrastructure, so European visitor data is transferred there. You need the EU Standard Contractual Clauses in the Navattic Data Processing Addendum and a Transfer Impact Assessment to cover the transfer.
A Data Protection Impact Assessment is recommended when demos are used at scale to profile prospects or to capture leads. Assess the behavioural tracking, the identifiers stored on the device, the CRM enrichment and the United States transfer.
Load the embed only through your consent management platform after the relevant category is accepted, describe Navattic in your cookie policy, sign the Data Processing Addendum and complete a Transfer Impact Assessment. Disable lead capture where it is not needed and apply a short retention period.
Alternatives include Reprise, Walnut, Storylane, Demostack and Supademo. They raise similar consent, cookie and transfer questions, so evaluate their hosting location and data processing terms before assuming any of them is lighter on privacy.
Add a dedicated entry that names Navattic as the provider, lists the visitor and session identifiers with their lifetimes, explains the engagement analytics collected, and discloses the United States transfer and its safeguard. Keep the entry in step with your consent categories.