> How Sprig uses cookies and session replays, what data it collects, the consent required, transfers to the US and how to use Sprig under the GDPR. > > Canonical: https://www.flowconsent.com/en/services/other/sprig Other # Sprig Preferences Sprig is a US based product experience platform that runs in product micro surveys, feedback prompts, and session replays to help teams understand user behaviour. It collects survey responses, interaction events, device and browser data, IP addresses, and can record sessions, using a JavaScript SDK and cookies. Because it is operated from the United States and sets non essential cookies, it requires prior consent under the GDPR and the ePrivacy Directive and transfers data to a third country. [Block Sprig until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Preferences - Prior consent Required - Documented cookies 3 - Third-party domains 3 - Servers United States (Sprig) Overview ## What does Sprig do? ## **What Sprig is** Sprig is a product experience and research platform operated by Sprig (formerly UserLeap) in the United States. Product teams embed its SDK to trigger targeted in product surveys, collect feedback, and optionally record session replays, then use built in analysis to find patterns. Once installed, Sprig loads in the visitor or user browser and can set cookies and identifiers. ## **What data and cookies Sprig collects** Sprig collects survey answers, feedback text, interaction events, and metadata such as device, browser, locale, and IP address. When session replay is enabled it can capture detailed interaction and screen data, which may include personal information shown on screen. It assigns identifiers so responses and sessions can be linked to a user across visits. ## **GDPR and ePrivacy implications** Sprig sets non essential cookies and can record user sessions, so the ePrivacy Directive requires prior consent and the GDPR requires a lawful basis and transparency. Session replay is particularly sensitive because it can capture data entered into forms, so input masking and field exclusion should be configured. A data processing agreement with Sprig is required as it acts as your processor. ## **When consent is required** Obtain prior, opt in consent before the Sprig SDK initialises on a live site or product, and keep consent specific and easy to withdraw. If you enable session replay, make the recording clear to users and mask sensitive fields by default. Block Sprig behind your consent mechanism so it loads only after acceptance. ## **Data transfers outside the EU** Sprig is based in the United States and processes data there, so its use involves a third country transfer under Chapter V of the GDPR. Transfers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, supported by a transfer impact assessment. Document what categories of data leave the EU. ## **Practical compliance steps** To stay compliant, gate Sprig behind consent, sign a data processing agreement, and complete a transfer impact assessment. Enable input masking for session replay, minimise the data collected, set retention limits, and avoid capturing special category data. List Sprig in your cookie policy and privacy notice and review its subprocessors regularly. Compliance ## Sprig and the GDPR Sprig is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for analytics cookies, in product surveys, and session replay - Risk level high - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA ### Impact assessment (DPIA) Sprig combines in product surveys with optional session replay, which can capture detailed and potentially sensitive data, raising its risk profile. Key DPIA points: (1) transfer of personal data to Sprig in the United States, requiring SCCs or the Data Privacy Framework and a transfer impact assessment; (2) session replay that may record form inputs and on screen personal data unless masking is configured; (3) persistent identifiers linking responses and sessions to a user over time; (4) risk of collecting special category data in open ended responses; (5) the need for a data processing agreement, input masking, and retention limits. A DPIA is recommended where replay or large scale surveying is used. ### Sample text for your banner > We use Sprig to run short in product surveys and, where enabled, session replays to improve our product. With your consent, Sprig sets cookies and collects your responses, interaction events, and technical data such as device and IP address. This data is processed by Sprig in the United States under appropriate safeguards. You can withdraw your consent at any time via our cookie settings. Cookies and trackers ## What Sprig sets and contacts - Tracking method JavaScript SDK for in product surveys, feedback prompts, and optional session replay, using cookies - Server location United States (Sprig) - Data transferred outside the EU Sprig is based in the United States and processes data there. Transfers rely on Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, the EU US Data Privacy Framework, and should be supported by a transfer impact assessment. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------- | ---------- | -------- | -------------------------------------------------------------------------------------------- | | sprig.aid | Analytics | 1 year | Anonymous identifier used to attribute survey responses and interaction events to a visitor. | | sprig.uid | Analytics | 1 year | Identifier used to recognise a known user across sessions for targeting and analysis. | | sprig.session | Functional | Session | Maintains the current survey session state while the prompt is displayed. | ### Third-party domains contacted (3) - `sprig.com` - `api.sprig.com` - `cdn.sprig.com` Questions ## Frequently asked questions about Sprig Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Sprig set? Sprig sets functional cookies to run a survey session and analytics identifiers that link responses and sessions to a user across visits. These analytics cookies are not strictly necessary and require consent. If session replay is enabled, additional processing of interaction data occurs. ### Do I need consent to use Sprig? Yes. Sprig sets non essential cookies and can record sessions, so you must obtain prior, opt in consent before its SDK initialises. Make session replay and its purpose clear, and load Sprig only after the visitor accepts. ### What is the legal basis for Sprig? In product surveys, analytics cookies, and session replay rely on consent (Art. 6(1)(a)) and the ePrivacy Directive. Detailed behavioural recording on a live product should not rely on legitimate interest alone. ### Does Sprig transfer data to the US? Yes. Sprig is based in the United States and processes data there, so its use is a third country transfer. It relies on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, which you should document in a transfer impact assessment. ### Is a DPIA needed for Sprig? A DPIA is recommended, especially if you enable session replay or survey at scale. Assess the US transfer, the risk that replays capture form inputs or sensitive data, the identifiers used, and your retention periods. ### How do I implement Sprig compliantly? Block Sprig behind your consent banner, sign a data processing agreement, complete a transfer impact assessment, and enable input masking for session replay. Minimise data, set retention limits, and document Sprig in your cookie policy and privacy notice. ### Are there alternatives to Sprig? Yes. EU based or self hosted survey tools, or feedback collected without session replay, reduce cookies and third country transfers. Tools such as LimeSurvey (self hosted) or EU hosted feedback platforms are more data minimal options. ### How do I update my cookie policy for Sprig? Add a Sprig entry listing its functional and analytics cookies, their purposes and durations, whether session replay is used, and the fact that data is processed in the United States. Link to Sprig''s privacy notice and review the entry when its cookies or subprocessors change. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [Buz Club](https://www.flowconsent.com/en/services/other/buz-club) [Buz Club is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Buz Club provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Buz Club helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/other/buz-club) [Marketing](https://www.flowconsent.com/en/services/other/buz-club) · ### [Mainboard](https://www.flowconsent.com/en/services/other/mainboard) [Mainboard is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Mainboard supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Mainboard ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/mainboard) [Other](https://www.flowconsent.com/en/services/other/mainboard) · ### [Lemcal](https://www.flowconsent.com/en/services/other/lemcal) [Lemcal is a user preference and personalization service that helps websites deliver customized experiences based on individual visitor settings and choices. It manages preferences for content display, communication channels, and interaction styles. Lemcal integrates with website platforms to remember and apply user choices consistently across sessions. With privacy-compliant preference storage, Lemcal enhances satisfaction by ensuring tailored browsing experiences for every visitor.](https://www.flowconsent.com/en/services/other/lemcal) [Preferences](https://www.flowconsent.com/en/services/other/lemcal) · ### [Qualtrics](https://www.flowconsent.com/en/services/other/qualtrics) [Qualtrics is a user preference and personalization service that helps websites deliver customized experiences based on individual visitor settings and choices. It manages preferences for content display, communication channels, and interaction styles. Qualtrics integrates with website platforms to remember and apply user choices consistently across sessions. With privacy-compliant preference storage, Qualtrics enhances satisfaction by ensuring tailored browsing experiences for every visitor.](https://www.flowconsent.com/en/services/other/qualtrics) [Preferences](https://www.flowconsent.com/en/services/other/qualtrics) · ### [7shifts](https://www.flowconsent.com/en/services/other/7shifts) [7Shifts is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. 7Shifts supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, 7Shifts ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/7shifts) [Preferences](https://www.flowconsent.com/en/services/other/7shifts) · ### [Element](https://www.flowconsent.com/en/services/other/element) [Element is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Element supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Element ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/element) [Other](https://www.flowconsent.com/en/services/other/element) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)