> Navattic embeds interactive product demos that track engagement and can capture leads. How to deploy them under the GDPR: consent, cookies and US transfers. > > Canonical: https://www.flowconsent.com/en/services/marketing/navattic Marketing # Navattic Marketing · [Official website](https://www.navattic.com/) Navattic is a United States based interactive product demo platform used by sales and marketing teams to build guided, clickable demos that are embedded on websites and shared through links. Every embedded demo records detailed engagement analytics such as steps viewed, completion, time spent and drop off, and it can capture lead identifiers, so it reads and writes cookies and localStorage on the visitor device. Because this is non essential behavioural tracking, Navattic must load only after the visitor has given consent. [Block Navattic until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=marketing) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Marketing](https://www.flowconsent.com/en/services/marketing) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers United States. Navattic Inc. hosts its application and analytics data on Amazon Web Services in United States regions. There is no documented European Union data residency option, so demo engagement data is processed on United States infrastructure by default. Overview ## What does Navattic do? ## **What Navattic is** Navattic is an interactive product demo platform based in the United States. It lets sales and marketing teams capture a live product and turn it into a guided, clickable walkthrough that visitors can explore directly on a website or through a shared link. The demo runs as an embedded widget that loads its code from Navattic servers and renders inside the host page. ## **What data and cookies Navattic collects** When a visitor opens a demo, Navattic records granular engagement analytics: which steps were viewed, where the visitor clicked, how long they stayed and where they dropped off. It stores a first party identifier in cookies and browser localStorage so a returning visitor can be recognised and their actions attributed to a single profile. Where a demo includes a form or a Call to Action, Navattic can also collect lead identifiers such as an email address and forward engagement events to connected CRM and marketing tools. ## **GDPR and ePrivacy implications** The engagement analytics and identifiers that Navattic processes are personal data under the GDPR, because they relate to an identifiable visitor. Storing and reading identifiers on the visitor device also falls within Article 5(3) of the ePrivacy Directive, which the CNIL in France, the German authorities under the TDDDG and the AEPD in Spain all enforce as a strict prior consent obligation for non essential trackers. ## **When consent is required** Consent is required before the Navattic embed loads, because it is not strictly necessary for the visitor to receive the content of the page. That consent must be freely given, specific, informed and unambiguous, and it must be as easy to refuse as to accept. Until the visitor accepts, the demo script should not run and no cookies or localStorage entries should be written. ## **Transfers of data to the United States** Navattic processes data on United States infrastructure, so European visitor data is transferred outside the European Economic Area. Such transfers require the EU Standard Contractual Clauses within the Navattic Data Processing Addendum and a documented Transfer Impact Assessment that considers United States surveillance law, in line with the Schrems II ruling and the guidance of the European Data Protection Board. ## **Practical steps for compliant use** Gate the Navattic embed behind your consent management platform so it fires only after the analytics or marketing category is accepted. Provide clear information about Navattic in your cookie policy, including the identifiers it sets and their lifetime. Sign the Navattic Data Processing Addendum, complete a Transfer Impact Assessment and apply the shortest workable retention on viewer records. Where lead capture is not needed, disable it to minimise the personal data collected. Compliance ## Navattic and the GDPR Navattic is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior, freely given, specific, informed and unambiguous consent under Article 6(1)(a) GDPR is required, because the embedded demo reads from and writes to the visitor terminal (cookies and localStorage) and records behavioural analytics that qualify as personal data. Article 5(3) of the ePrivacy Directive 2002/58/EC, transposed as Article 82 of the French Loi Informatique et Libertes, section 25 of the German TDDDG and Article 22.2 of the Spanish LSSI CE, makes prior consent mandatory before Navattic loads. Legitimate interest is not a valid basis for this non essential tracking. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, French TDDDG and CNIL guidelines on trackers, German TDDDG, Spanish LSSI CE and AEPD cookie guide, EDPB Schrems II Transfer Impact Assessment, EU Standard Contractual Clauses 2021/914 ### Impact assessment (DPIA) A Data Protection Impact Assessment is advisable when Navattic demos are used at scale to profile prospects or to capture lead identifiers. Document the behavioural analytics collected by the embedded demo, the first party identifiers stored in cookies and localStorage, the syncing of engagement data into CRM tools such as HubSpot or Salesforce, the transfer of data to the United States and the retention period applied to viewer records. Configure the embed so that it loads only after consent and disable lead capture on pages where it is not strictly necessary. ### Sample text for your banner > We use Navattic, an interactive demo service operated by Navattic Inc. (United States), to show you guided product demos. Navattic records how you interact with the demo and stores identifiers in cookies and localStorage on your device. This data may be transferred to the United States under the EU Standard Contractual Clauses. Navattic will only load if you click Accept. Cookies and trackers ## What Navattic sets and contacts - Tracking method Asynchronous JavaScript embed loaded from js.navattic.com and served through api.navattic.com and cdn.navattic.com. The embedded interactive demo instruments viewer actions (steps opened, clicks, completion, time spent and drop off) and can capture lead identifiers such as email through demo forms and Calls to Action. Navattic identifies viewers with a first party identifier stored in cookies and browser localStorage and can forward engagement events to CRM and marketing tools such as HubSpot, Salesforce and Marketo. - Server location United States. Navattic Inc. hosts its application and analytics data on Amazon Web Services in United States regions. There is no documented European Union data residency option, so demo engagement data is processed on United States infrastructure by default. - Data transferred outside the EU Navattic Inc. is a company incorporated in New York, United States, and processes demo engagement and viewer identifiers on United States based Amazon Web Services infrastructure. European visitor data is therefore transferred to the United States and must be covered by the Navattic Data Processing Addendum incorporating the EU Standard Contractual Clauses 2021/914, together with a Transfer Impact Assessment as required by the Schrems II ruling. ### Cookies set (4) | Name | Type | Duration | Purpose | | --------------------- | ------------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | navattic\_visitor\_id | HTTP cookie (first party) | 12 months | Stores a persistent identifier for the demo viewer so Navattic can recognise returning visitors and attribute engagement events to a single person across demo sessions. | | navattic\_session | HTTP cookie (first party) | Session | Holds the current demo session so that step progression and interactions are grouped together during a single visit. | | navattic\_flow\_state | localStorage | Persistent (until cleared) | Stores the progress and state of the interactive demo, such as the last step viewed, so the demo can resume where the viewer left off. | | navattic\_analytics | localStorage | Persistent (until cleared) | Buffers behavioural analytics events (clicks, completions, time spent) before they are sent to Navattic ingestion endpoints. | ### Third-party domains contacted (4) - `navattic.com` - `js.navattic.com` - `api.navattic.com` - `cdn.navattic.com` Questions ## Frequently asked questions about Navattic Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies and storage does Navattic set? Navattic sets a first party visitor identifier that persists for about twelve months, a session cookie, and localStorage entries that hold demo progress and buffered analytics events. Together they let Navattic recognise returning viewers and record how each demo is used. ### Do I need consent before loading Navattic? Yes. Navattic performs non essential behavioural tracking and writes identifiers to the visitor device, so under the ePrivacy rules you must obtain prior consent before the embed loads. The demo script should stay blocked until the visitor accepts. ### What is the legal basis for Navattic? The only valid legal basis is consent under Article 6(1)(a) GDPR, combined with the prior consent requirement of Article 5(3) of the ePrivacy Directive. Legitimate interest cannot be used for this kind of non essential analytics and lead tracking. ### Does Navattic transfer data to the United States? Yes. Navattic hosts its platform on United States infrastructure, so European visitor data is transferred there. You need the EU Standard Contractual Clauses in the Navattic Data Processing Addendum and a Transfer Impact Assessment to cover the transfer. ### Do I need a DPIA for Navattic? A Data Protection Impact Assessment is recommended when demos are used at scale to profile prospects or to capture leads. Assess the behavioural tracking, the identifiers stored on the device, the CRM enrichment and the United States transfer. ### How do I implement Navattic compliantly? Load the embed only through your consent management platform after the relevant category is accepted, describe Navattic in your cookie policy, sign the Data Processing Addendum and complete a Transfer Impact Assessment. Disable lead capture where it is not needed and apply a short retention period. ### Are there alternatives to Navattic? Alternatives include Reprise, Walnut, Storylane, Demostack and Supademo. They raise similar consent, cookie and transfer questions, so evaluate their hosting location and data processing terms before assuming any of them is lighter on privacy. ### How do I update my cookie policy for Navattic? Add a dedicated entry that names Navattic as the provider, lists the visitor and session identifiers with their lifetimes, explains the engagement analytics collected, and discloses the United States transfer and its safeguard. Keep the entry in step with your consent categories. Same category ## More services: Marketing [See the whole category](https://www.flowconsent.com/en/services/marketing) ### [Connectif](https://www.flowconsent.com/en/services/marketing/connectif) [Connectif is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Connectif integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Connectif makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/marketing/connectif) [Marketing](https://www.flowconsent.com/en/services/marketing/connectif) · ### [Klaviyo](https://www.flowconsent.com/en/services/marketing/klaviyo) [Klaviyo is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Klaviyo provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Klaviyo helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/klaviyo) [Marketing](https://www.flowconsent.com/en/services/marketing/klaviyo) · ### [Satori](https://www.flowconsent.com/en/services/marketing/satori) [Satori is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Satori enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Satori empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/satori) [Marketing](https://www.flowconsent.com/en/services/marketing/satori) · ### [HubSpot Ads](https://www.flowconsent.com/en/services/marketing/hubspot-ads) [HubSpot Ads is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. HubSpot Ads provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, HubSpot Ads helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/marketing/hubspot-ads) [Marketing](https://www.flowconsent.com/en/services/marketing/hubspot-ads) · ### [Airship CRM](https://www.flowconsent.com/en/services/marketing/airship-crm) [Airship CRM is a customer relationship management (CRM) platform that helps businesses organize, track, and nurture customer interactions across the entire lifecycle. It provides contact management, sales pipeline tracking, and automated workflows. Airship CRM centralizes customer data from multiple touchpoints, enabling personalized experiences, faster deal closing, and improved retention. With reporting dashboards and integrations, Airship CRM empowers data-driven relationship management.](https://www.flowconsent.com/en/services/marketing/airship-crm) [Marketing](https://www.flowconsent.com/en/services/marketing/airship-crm) · ### [Zevioo](https://www.flowconsent.com/en/services/marketing/zevioo) [Zevioo is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Zevioo enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Zevioo empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/marketing/zevioo) [Marketing](https://www.flowconsent.com/en/services/marketing/zevioo) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)