Kit

Kit GDPR compliance starts with double opt-in and a consent checkbox on your forms, then turns on Kit's Data Processing Addendum and where subscriber data is stored. Kit is the product that was called ConvertKit until its 2024 rename, so older ConvertKit GDPR guides describe the same features under the old name.

Under GDPR you are the controller for your list and Kit acts as your processor. Kit gives you the tools to collect valid consent, but it does not decide which forms need a checkbox or what your privacy notice says. The sections below cover what Kit's own documentation supports and where the work is still yours.

Kit's help center states that double opt-in is the default for forms and landing pages. A new subscriber receives a confirmation email and only joins your list after clicking the confirm button. The control sits in the form builder under Settings, on the Confirmation Email tab. Leaving 'Auto-confirm new subscribers' unchecked keeps double opt-in on.

GDPR does not name double opt-in as a requirement, but the confirmation click gives you a timestamped record that the owner of the address asked to subscribe. Our take: keep it on for every form EU visitors can reach, and do not switch on auto-confirm to gain a few extra sign-ups.

Kit offers an account-level GDPR setting that adds an unchecked consent checkbox to your opt-in forms, shown only to visitors Kit locates in the EU/EEA, the UK or Switzerland. According to Kit's GDPR help article, a visitor who leaves the box unchecked still receives the opt-in incentive, such as a free guide, but does not get the tag that marks marketing consent.

That has a practical consequence: your list will contain subscribers without marketing consent. Build broadcast and sequence segments on the consent tag, not on list membership. Kit also documents a flow that redirects new subscribers to a separate GDPR consent page after sign-up, if you prefer to keep the form itself short.

Kit publishes a Data Processing Addendum on its website and describes it as covering the EU GDPR and UK GDPR for creators processing personal data of people in the EU/EEA, the UK and Switzerland. Article 28 of GDPR requires a written processor agreement, so download the current version and file it with your records of processing.

For transfers out of Europe, Kit's GDPR documentation lists the EU-U.S. Data Privacy Framework with its UK and Swiss extensions, and the Standard Contractual Clauses plus the UK International Data Transfer Agreement, both included in the addendum. Name Kit as a processor in your privacy notice and disclose the transfer to the United States.

Kit has no EU-specific hosting option. Its GDPR documentation describes transferring subscriber data from Europe to the United States and elsewhere under the mechanisms above, and there is no setting to pin an account to an EU region.

For most creators this is workable, because the transfer is covered by the Data Privacy Framework and the Standard Contractual Clauses. It becomes a blocker when a client contract or an internal policy requires EU storage. In that case look at ActiveCampaign, which offers an EU data center, or Brevo, which our dataset lists with EU data hosting.

Our take: Kit is a sound GDPR choice for solo creators, bloggers and small newsletter teams. Double opt-in is on by default, and the DPA is published rather than hidden behind a sales call. Our dataset lists a free tier for up to 10,000 subscribers; confirm current limits on Kit's pricing page.

The trade-offs are US hosting, basic reporting and limited template design. If you need EU data residency or complex behavioural automation, you will outgrow Kit. If you are moving an existing list into Kit, check how those contacts originally consented and send a re-permission email to anyone without a record.