Does ConvertKit Work in China? ICP, PIPL & Where Your Subscriber Data Lives
ConvertKit — now rebranded Kit — stores your subscribers' personal data on US servers with no mainland-China region, so every China contact is a PIPL cross-border transfer, and its embedded forms put the ICP duty on your own mainland site. A compliance-first look at the doors.
Does ConvertKit work in China?
Yes — ConvertKit, now rebranded Kit, loads and sends from China, but reachability was never the compliance question. It stores your subscribers' personal data on US servers, which makes every mainland contact a cross-border transfer under PIPL — and it gives you nothing of its own to ICP-file.
In its own privacy policy Kit states it "is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries." For a creator's list that means your Chinese subscribers' names, emails, tags and engagement data leave the mainland — a cross-border transfer of personal information PIPL governs (notice, separate consent and a transfer mechanism, Articles 38–43). ConvertKit runs no mainland-China region, so there is nothing on it to ICP-file; its forms embed on your own site, which keeps that filing duty on the page doing the embedding. The table below is Kit's own wording and the rule each point triggers.
This is a risk map, not a verdict — what you owe turns on your entity, your data volumes and who your subscribers are. Our China team can map your exposure with you →
Compliance snapshot
- ! Subscriber data — names, emails, tags — is stored on US servers
- ! Every China subscriber is a PIPL cross-border transfer
- ✕ ConvertKit runs no mainland region, so there's nothing on it to ICP-file
- ! Embedded forms put the ICP duty on your own mainland site
- ! Kit-hosted landing pages load from offshore — a delivery question
What Convertkit's own documentation says about China
| Fact | Primary source |
|---|---|
| ConvertKit stores your subscribers' personal data in the United States, not the mainland. In its own privacy policy — published under the name it now uses, Kit — the company states it "is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries," and that it "take[s] steps to ensure that your personal information receives an adequate level of protection." For a China-facing list, the names, emails, tags and engagement history of your mainland subscribers are held offshore — a cross-border transfer of personal information under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43). | Kit (formerly ConvertKit) Privacy Policy, kit.com/privacy, retrieved 2026-10-07; PIPL Articles 38–43 |
| There is no mainland-China region, so in-country residency duties can't be met on ConvertKit. Kit names only "servers located in the United States and other countries" and publishes no mainland-China region. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty offshore servers cannot satisfy. | Kit (formerly ConvertKit) Privacy Policy, kit.com/privacy, retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
| ConvertKit's forms are an embedded layer — the ICP filing follows the site doing the embedding. Kit's own help center describes a form as "an opt-in embedded directly on your website or blog" and adds, "Anywhere you can embed JavaScript and HTML, you can embed our forms." ConvertKit is not the resource you file; the public mainland site that carries the embed is, under the ICP filing regime (State Council Order No. 292; MIIT Order No. 33). | Kit (formerly ConvertKit) Help Center — "The difference between forms and landing pages," intercom.help/convertkit, retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| Kit-hosted landing pages are served from offshore — a reachability question, not the legal one. For a landing page Kit says plainly, "Kit hosts it for you—once you hit publish, it's live," and that such pages "can't be embedded within pages on your site, because they are standalone pages on their own." A page Kit hosts is delivered from its US-based infrastructure, so whether it paints quickly for a mainland visitor is a delivery consideration — separate from, and downstream of, the PIPL and ICP questions that decide whether you may use it. | Kit (formerly ConvertKit) Help Center — "The difference between forms and landing pages," intercom.help/convertkit, retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question about ConvertKit — the email and audience platform for creators now rebranded as Kit — is not whether it sends email quickly. It is where your subscribers’ personal data is allowed to live, and what a public mainland site carrying its sign-up forms is required to file. ConvertKit answers the first in its own privacy policy: your contacts’ data is stored on servers in the United States. That turns every Chinese subscriber into a cross-border transfer under China’s data law, and because ConvertKit runs no mainland region, there is nothing on it to ICP-file — the forms simply embed on a site you already run, which moves that duty onto the page doing the embedding. Reaching China is real; the data residency and the filing are the exposure.
ConvertKit in China at a glance
| What decides it | In ConvertKit's own terms |
|---|---|
| Where it runs | Kit (ConvertKit's current name) states it is “based in the United States” and names only “servers located in the United States and other countries.” No region is inside mainland China. |
| Where your subscriber data sits | Your Chinese subscribers' names, emails, tags and engagement history are stored offshore in the US — a cross-border transfer of personal information PIPL governs. |
| Data residency | With no mainland region, an in-country storage duty for a CIIO or large-volume handler (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) cannot be met on ConvertKit. |
| Serving the public | A form is “an opt-in embedded directly on your website or blog,” so the ICP filing attaches to that mainland site — not to ConvertKit, which is not the resource you file. |
| Hosted landing pages | “Kit hosts it for you—once you hit publish, it's live”: a landing page is served from Kit's US infrastructure, so reaching mainland visitors is a delivery question, not the legal one. |
Your subscribers’ data lives in the United States
ConvertKit tells you where your list lives in its own privacy policy, now published under its current name, Kit. Under International Transfers the company states it “is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries,” and that it “take[s] steps to ensure that your personal information receives an adequate level of protection.” For a creator running a China-facing list, that one sentence settles the data question: the names, email addresses, tags and engagement history of your mainland subscribers are held offshore.
Under China’s Personal Information Protection Law, moving that data out of the mainland is a cross-border transfer, and the handler — you, the list owner, not ConvertKit — has to give notice, obtain separate consent for the transfer, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator, or you process personal information above the regulated volume thresholds, that data must instead be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no US-based service can meet. ConvertKit publishes no mainland-China region, so there is no in-country option to switch on.
ConvertKit is an embedded layer, so the ICP filing sits on your site
Here ConvertKit differs from a web host, and the difference changes the answer. You do not point your domain at ConvertKit the way you would at a server; its building blocks sit on top of a site you already run. Kit’s own help center is explicit about it: a form is “an opt-in embedded directly on your website or blog,” and, in its words, “Anywhere you can embed JavaScript and HTML, you can embed our forms.”
So for an embedded form, ConvertKit is not the thing that gets filed — the public mainland site carrying the embed is. A website served to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, tied to a hosting resource inside the mainland. Embedding a ConvertKit form on that site neither files it for you nor relieves the obligation; it simply leaves the filing duty with the page doing the embedding. “We use ConvertKit” answers none of that.
The one case where ConvertKit does the hosting is a landing page. Kit says plainly, “Kit hosts it for you—once you hit publish, it’s live,” and that landing pages “can’t be embedded within pages on your site, because they are standalone pages on their own.” A page Kit hosts is served from its US infrastructure — which brings you back to the same offshore footing, now for the page itself as well as for the data behind it.
Reachable from offshore — which is not the question
None of this is a reachability story. A ConvertKit form or a Kit-hosted landing page is served from offshore, so for a mainland visitor the distance can show up as a slower paint — but that is a delivery characteristic, and it sits downstream of the questions that actually decide whether you may use the tool. A page that loads perfectly can still be out of compliance: the exposure is that your subscribers’ data has left the mainland and that the site carrying your opt-ins still owes an ICP filing. Network tuning touches neither fact.
This is a risk map, not a verdict: whether you owe a transfer mechanism, in-country storage, an ICP filing on the embedding site, or all three depends on what you collect, how much of it, and who your subscribers are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running ConvertKit. Your forms, sequences and subscriber list stay exactly where they are. What we add is the piece an offshore creator tool cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of the site that carries your opt-ins — no rebuild, no second codebase, and no move off ConvertKit. Our China team maps the obligations that attach to storing subscriber data offshore and to serving a mainland audience — your PIPL cross-border and data-residency exposure, and where the ICP filing lands once a form is embedded — then stands up the in-country delivery a lawful China presence needs, while your email platform stays put.
Related reading:
Frequently Asked Questions
Is ConvertKit blocked in China?
Reachability is the wrong first question. ConvertKit — now Kit — is an offshore service: its forms embed on your own site and its landing pages are hosted on Kit's US-based infrastructure, so whether a given page paints quickly for a mainland visitor is a delivery matter that can vary. What doesn't vary is the compliance exposure underneath — your subscribers' personal data is stored in the United States, which PIPL treats as a cross-border transfer, and a public mainland site carrying a Kit form still needs its own ICP filing. Those are the facts that decide whether you may use it, reachable or not.
Where does ConvertKit store our subscribers' data?
In the United States. Kit's own privacy policy states it "is based in the United States, and we and our service providers process and store personal information on servers located in the United States and other countries." For a China-facing list that means your mainland subscribers' names, emails, tags and engagement history are held offshore. Under PIPL that is a cross-border transfer requiring notice, separate consent and a transfer mechanism (Articles 38–43), and for a critical information infrastructure operator or large-volume handler the data must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which an offshore service cannot do.
Can 21YunBox help us keep ConvertKit and stay compliant in China?
Yes. You keep running ConvertKit (Kit) exactly as you do now. Our China team maps your exposure — the PIPL cross-border and data-residency obligations that attach to storing subscriber data offshore, and where the ICP filing lands once a Kit form is embedded on a mainland-facing site — and stands up the ICP-filed, in-country delivery a compliant China presence needs, in front of the site that carries your opt-ins. Get in touch to work through your specific case.
