Sailthru

What Sailthru is

Sailthru is an email marketing, personalisation and customer retention platform founded in 2008 in New York. It was acquired by CM Group (now Marigold) in 2018 alongside Selligent, and the broader Marigold family now includes Campaign Monitor, Emma, Vuture and Liveclicker. Sailthru is positioned for retail, e commerce and media brands that need to combine email marketing with website personalisation. The product features a behavioural tracking SDK called sailthru.js, an email engine with templates and dynamic content, a recommendation engine (Smart Strategies) and audience segmentation tools.

What data Sailthru collects

On the website, sailthru.js writes the sailthru_hid cookie (Sailthru hash ID, default 1 year lifetime) on the operator's first party domain and transmits events to Sailthru servers: page views, product views, add to cart, purchase, search queries and any custom events the operator pushes via the Sailthru SDK. When the visitor identifies themselves (sign up, login, email click), the sailthru_hid is joined to the customer's email profile, creating a deterministic link between website behaviour and the subscriber file. The Sailthru email engine embeds open and click tracking pixels in outgoing messages, which collect the recipient's IP, user agent and read state.

GDPR and ePrivacy implications

Because sailthru.js writes a persistent cookie not strictly necessary, ePrivacy Art. 5(3) requires prior informed consent. Under the GDPR, consent under Art. 6(1)(a) is the appropriate basis for the cookie and behavioural tracking. Marketing emails require their own consent or soft opt in under PECR (UK) and the ePrivacy Directive transposition in each EU member state. The recommendation engine and content personalisation features qualify as profiling under GDPR Art. 22, which adds transparency, opt out and human review obligations when decisions have material impact.

Identity stitching: cookie to email profile

The defining feature of Sailthru is the deterministic link between the website cookie and the email subscriber profile. When a visitor clicks an email link, Sailthru attaches a sthash parameter to the URL that the SDK reads and uses to write the sailthru_hid cookie tied to the subscriber. This is more invasive than pure cookie tracking because it ties browsing history to a real identity. The DPIA must reflect this and the privacy notice must explain it to users.

Data transfers and residency

Sailthru runs on US primary infrastructure with EU regional processing available on Enterprise plans. Customer profile data, email content, behavioural events and recommendation models are processed in the US by default. Marigold self certifies under the EU US Data Privacy Framework and offers Standard Contractual Clauses. EU retailers and publishers should request EU regional processing where their data residency commitments require it.

Practical compliance steps

Gate sailthru.js behind a Consent Management Platform with explicit marketing or personalisation consent. Collect a separate consent for marketing email under PECR or the ePrivacy transposition. Sign the Sailthru/Marigold DPA and Standard Contractual Clauses. Document the processing in the record of processing, including the deterministic identity link, the recommendation engine and the data transfer mechanism. Run a DPIA covering the email plus website profile, the US transfer and the Art. 22 profiling considerations. Subscribe to EU regional processing if available and required.