Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
ConvertFlow is a US no code platform for building personalized calls to action, popups, forms, quizzes, and landing pages that adapt to each visitor. It tracks visitor behaviour and segments, sets cookies to remember who has seen or interacted with a campaign, and captures the leads and answers people submit, along with IP address. Because it sets non essential cookies and profiles visitors from the US, it requires prior consent under the GDPR and the ePrivacy Directive and transfers data to a third country.
ConvertFlow is a conversion marketing platform operated from the United States that lets teams build personalized calls to action, popups, forms, surveys, and landing pages without code. It segments visitors and shows them tailored campaigns based on behaviour and attributes. Adding ConvertFlow loads a script that runs on your pages and stores cookies.
ConvertFlow processes behavioural data such as pages viewed, campaign interactions, and segment membership, the leads and answers visitors submit (often name, email, and survey responses), and technical data like IP address and device. It uses persistent identifiers and cookies to recognise returning visitors and personalise what they see. This builds a profile that drives targeting.
Because ConvertFlow sets non essential cookies and profiles visitors to personalise campaigns, the ePrivacy Directive requires prior consent and the GDPR requires a lawful basis and transparency. Profiling and lead capture are personal data processing that should be explained clearly. ConvertFlow acts as your processor, so a data processing agreement is required.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Obtain prior, opt in consent before ConvertFlow sets cookies and starts profiling, and block the script behind your consent banner. Where campaigns capture leads for marketing, collect separate, clear consent for that. Make consent specific and easy to withdraw, and offer non personalised content to visitors who decline.
ConvertFlow is operated from the United States and processes data there, so its use involves a third country transfer under Chapter V of the GDPR. Transfers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, supported by a transfer impact assessment. Document the behavioural and lead data sent to the US.
To use ConvertFlow compliantly, gate it behind consent, sign a data processing agreement, and complete a transfer impact assessment. Minimise the personal data captured in campaigns, set retention limits for profiles and leads, and avoid profiling on sensitive criteria. List ConvertFlow in your cookie policy and privacy notice and review its subprocessors periodically.
Websites using ConvertFlow must obtain user consent under GDPR regulations.
DPIA considerations
ConvertFlow profiles visitors and captures leads to personalise marketing, which is profiling under the GDPR and raises its risk profile. Key DPIA points: (1) transfer of personal data to ConvertFlow in the United States, requiring SCCs or the Data Privacy Framework and a transfer impact assessment; (2) behavioural profiling and segmentation that determine what each visitor sees; (3) lead capture of names, emails, and survey answers; (4) persistent identifiers enabling cross visit recognition; (5) the need for a data processing agreement, retention limits, and avoidance of sensitive targeting. A DPIA is recommended for detailed personalisation or large lead volumes.
Sample consent text
We use ConvertFlow to show personalised offers and forms. With your consent, ConvertFlow sets cookies and tracks your behaviour to tailor what you see, and it processes any leads or answers you submit along with your IP address. This data is processed by ConvertFlow in the United States under appropriate safeguards. You can withdraw your consent at any time via our cookie settings.
Third-party domains contacted
convertflow.comapp.convertflow.comcdn.convertflow.coCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| cf_uvid | Analytics | 1 year | Stores a persistent visitor identifier used to recognise returning visitors and personalise campaigns. |
| cf_seen | Functional | 1 year | Records which campaigns a visitor has already seen or interacted with to control display. |
| cf_segment | Analytics | 1 year | Stores the visitor segment used to decide which personalised content to show. |
ConvertFlow collects user analytics data — you legally need a consent banner. Try FlowConsent free.
ConvertFlow sets cookies that store a visitor identifier, remember which campaigns a visitor has seen or interacted with, and record segment membership for personalisation. These are non essential and require consent. The leads and answers visitors submit are stored separately as form data.
Yes. ConvertFlow sets non essential cookies and profiles visitors, so obtain prior, opt in consent before its script runs. Lead capture for marketing needs its own clear consent.
The cookies, behavioural profiling, and personalisation rely on consent (Art. 6(1)(a)) and the ePrivacy Directive. Marketing to captured leads also generally relies on consent under ePrivacy marketing rules.
Yes. ConvertFlow is operated from the United States and processes data there, so its use is a third country transfer. It relies on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework, which you should document in a transfer impact assessment.
A DPIA is recommended because ConvertFlow profiles visitors and captures leads. Assess the US transfer, the segmentation and profiling, the lead data collected, and your retention periods, and avoid profiling on sensitive criteria.
Block ConvertFlow behind your consent banner, sign a data processing agreement, and complete a transfer impact assessment. Minimise lead and profile data, set retention limits, offer non personalised content to those who decline, and document ConvertFlow in your cookie policy and privacy notice.
Yes. EU based or self hosted form, popup, and landing page tools reduce third country transfers and give more control over data. They can deliver campaigns with less behavioural profiling, though advanced personalisation may need more setup.
Add a ConvertFlow entry listing its cookies, their purposes and durations, the profiling it performs, and the fact that data is processed in the United States. Link to ConvertFlow''s privacy notice and review the entry when its cookies or subprocessors change.