Flowbox

What is Flowbox and how does it work

Flowbox is a Swedish SaaS platform dedicated to user generated content and influencer marketing. It lets brands aggregate social content from Instagram (hashtags, mentions, stories), TikTok, Facebook, Pinterest, YouTube and Twitter, moderate it, secure media rights from the authors, link it to products, and publish it across product pages, category pages, lookbooks, email widgets, mobile apps, in store screens and dynamic product ads.

Flowbox is integrated through a small JavaScript snippet that loads the chosen flow into a container on the merchant page. Each widget can run with cookies enabled or disabled via the allowCookies parameter, which is unusual for this category of tool and a valuable feature for compliance heavy markets.

What data and cookies Flowbox collects

With cookies enabled, Flowbox sets first party cookies on the merchant domain to recognise returning visitors, group engagement events (impressions, clicks, conversions on linked products) and feed the analytics dashboard. With allowCookies set to false, the widget runs without persistent identifiers and only logs aggregated, non identifying signals.

Beyond visitor data, Flowbox processes the personal data of the original content authors: names, profile pictures, social handles, captions and photos pulled from social platforms. The platform also runs a Visual Search engine, which can apply image recognition to the UGC pool.

GDPR and ePrivacy implications

When Flowbox is configured with cookies, the analytics tracking is not strictly necessary under Article 5(3) of the ePrivacy Directive and prior consent is required. When Flowbox runs in cookieless mode, the consent banner can fall back to a simple notice in the privacy policy, provided no other identifier is set client side.

For UGC ingested from third party platforms, the merchant becomes a data controller for the new processing activity (display on the storefront, use in newsletters, in ads). The Flowbox media rights workflow helps document author consent for that re publication.

Data location and transfers

Flowbox is headquartered in Stockholm with offices in Barcelona, Amsterdam and Copenhagen. The core processing infrastructure is hosted in the European Union, which means the visitor and UGC data does not leave the EU under the default configuration. This is a meaningful compliance advantage compared with US based UGC vendors.

Onward transfers can still happen when the UGC DPA feature is used to feed Meta or TikTok dynamic product ads, since those platforms operate globally. That secondary flow must be assessed under Chapter V of the GDPR, with the appropriate safeguards.

How to deploy Flowbox in a compliant way

To use Flowbox on a website that targets EU or UK visitors, you should: decide upfront whether you need analytics tracking or whether the cookieless mode is enough, gate the widget behind consent with a CMP such as FlowConsent when cookies are enabled, name Flowbox in your cookie and privacy policies, sign the Data Processing Addendum, run a DPIA when the UGC DPA retargeting feed is activated, and document the rights granted by each UGC author through the Flowbox media rights workflow.

Alternatives and risk mitigation

For brands looking for an EU hosted UGC stack, Flowbox is one of the strongest options on paper. Comparable vendors include Photoslurp (now part of Flowbox), Stackla and Bazaarvoice for the high end, and Avis Verifies or Trusted Shops when the focus is on reviews rather than visual UGC. To reduce the risk further, run Flowbox with allowCookies set to false on regions where you do not need analytics tracking, and only enable UGC DPA on segments where the social retargeting transfer is documented in your privacy notice.