Privacy Policy

Attributy, Inc. (“Attributy”, “we”, “us” or “our”) provides marketing measurement and attribution software. This Privacy Policy explains what information we collect, why we collect it, who we share it with, and the choices you have.

It covers two situations that are legally very different, and the difference decides who you should contact about your rights:

• Our own websites and business. Visitors to attributy.com and its subdomains, people who fill in our forms, and the individuals at organisations that subscribe to our platform. Here Attributy decides why and how data is processed, and acts as a controller.
• The Attributy platform. The measurement software our customers use to understand their marketing. When a customer measures its own website, apps and campaigns with Attributy, that customer decides what is collected and why. Attributy acts as a processor (a “service provider” under U.S. state privacy laws) on that customer’s instructions.

In this policy, “personal information” and “personal data” mean information that is linked, or reasonably linkable, to an identified or identifiable person.

If you are here because you visited a website that is measured with Attributy, our Consumer Privacy Notice is written for you in plain language.

This Privacy Policy applies to attributy.com and its subdomains, to our customer application and sign-in, to our measurement endpoints, and to the features available through the Attributy platform.

Our role changes depending on the data:

• Our websites, marketing, support and billing. Attributy is the controller. Contact us using the details in the Contact Us section.
• Customer accounts and users. Attributy is the controller for authentication, security and billing, and a processor for the content a customer puts into its account.
• Measurement data collected from visitors to a customer’s website or app. Attributy is a processor. The customer — the brand or agency whose website you visited — is the controller, and is responsible for giving notice, establishing a lawful basis and collecting any consent required by law.
• Advertising and CRM data a customer connects from other platforms. Attributy is a processor acting on the customer’s instruction.

This policy does not cover information about Attributy employees, contractors or job applicants, the independent practices of our customers or of the advertising platforms they connect, or any third-party website you reach from ours.

We collect the following when you visit or interact with our websites.

Information you give us in a form. The fields depend on the form:

• Contact and demo requests. First name, last name, company, email address and the message you write. A verification token from Google reCAPTCHA is submitted with the form to filter automated abuse.
• Campaign and lead pages. First name, last name, business email address, company and, optionally, a phone number. Some campaign pages ask only for an email address. These forms accept business email addresses and reject common personal email domains.
• Booking a demo. After you submit a lead form we show a Calendly scheduling widget. Anything you enter into that widget is collected by Calendly under its own privacy notice, not by our website code.
• Careers. We do not operate an application form. Applications are sent to us by email, and we process what you choose to send us.

Our contact form includes a checkbox asking for permission to contact you for marketing purposes. You must tick it before the form can be submitted.

Information collected automatically. Where you have allowed the relevant cookie category, we collect pages and resources viewed, referring page and campaign parameters in the link you arrived from, clicks on links, browser and operating system, device type and screen size, language, IP address and the approximate location derived from it, and whether you are a new or returning visitor.

Business contact information from other sources. We may collect business contact details — name, job title, company, business email and phone number — from events, referrals, publicly available sources and business networking, in order to assess and pursue potential business opportunities.

Correspondence. We keep records of the support and sales correspondence you have with us.

If you work for an organisation that subscribes to the Attributy platform, we collect the following about your use of it.

• Account and sign-in details. First name, last name, username, email address and password. You can instead sign in with Google, in which case Google confirms your identity to us and we receive your basic profile and email address. When you are signed in we store a session token in a cookie named token so that you stay signed in between pages.
• Profile details. Job role, company name, phone number, postal address, city, region, postcode, country and a profile picture, if you choose to provide them. When you type an address we offer autocomplete suggestions, which sends what you type to our backend address lookup service.
• Organisation and agency details. Company or agency name and email, time zone, reporting currency, address and VAT number.
• Team members you invite. First name, last name, email address, username and the accounts they may access. If you invite a colleague, you are providing us with their personal information and are responsible for having a basis to do so.
• Onboarding and configuration. The websites you want to measure, conversion and goal definitions, tracking settings such as excluded IP addresses, excluded query parameters and excluded user agents, and any data warehouse configuration you supply.
• Usage of the product. Which features, reports, integrations and models you use, saved templates and reports, and the actions taken in your account.
• Billing. Your plan, subscription status and invoices, together with the billing contact and address you provide. Card payments are processed securely. Card numbers are entered directly into a secure payment field and are exchanged for a token — Attributy does not receive or store your full card number. We store a reference to your customer record, and the card brand and last four digits returned to us for display.

We use cookies, pixels, tags and browser storage on our websites. Apart from the strictly necessary items described below, nothing in the analytics or marketing categories loads until you make a choice in our cookie banner. Before you choose, we instruct Google’s tags to default to a denied state.

Your choice is stored in a cookie and in your browser’s local storage. The cookie lasts for 180 days, after which we will ask again. You can opt out of advertising cookies at any time using the Opt-out link in our website footer.

Necessary. Always active, because the site cannot work without them.

• Your sign-in session, held in the token cookie.
• Your cookie choice, held in a cookie and in your browser’s local storage.
• Google reCAPTCHA, which protects our contact and campaign forms from automated abuse. Because it is an anti-abuse measure, reCAPTCHA loads on pages that contain those forms.
• A cookie named sidebar:state, lasting 7 days, which remembers whether the navigation sidebar in the application is expanded.

Analytics. Loads only if you allow this category. Helps us understand how the site is used.

• Google Analytics 4 — page views, traffic sources and on-site behaviour. See the Google Privacy Policy and the Google Analytics opt-out add-on.
• Attributy first-party analytics — our own self-hosted, first-party measurement, recording page views, link clicks and scroll depth on attributy.com. If you decline this category we instruct it to opt you out.

Marketing. Loads only if you allow this category. Used to measure our advertising and to show Attributy ads to people who have visited us.

• Google Ads — conversion measurement and remarketing. See the Google Privacy Policy.
• Meta Pixel — page views and lead events for Meta advertising. See the Meta Privacy Policy.
• LinkedIn Insight Tag — campaign and conversion measurement. See the LinkedIn Privacy Policy.
• OpenAI advertising pixel — campaign measurement for advertising bought through OpenAI. See the OpenAI Privacy Policy.
• Google Tag Manager — a container used to manage the tags above. It loads only when you have allowed both the analytics and marketing categories.

Preferences. This category exists in our consent record but our public website does not currently set any preference cookies, so it is not shown as an option.

Some pages embed content from third parties — a Calendly scheduling widget on our demo thank-you pages, and LinkedIn post embeds. When such content is displayed, the provider may set its own cookies under its own privacy notice.

Because opt-out mechanisms are stored per browser and per device, you will need to repeat your choices on each browser and device you use.

• To answer your enquiry and provide the demo, trial, quote or information you asked for.
• To provide, maintain, support and administer the platform under our contract with your organisation, and to verify that we are dealing with the right person.
• To authenticate you, protect your account and detect unusual or unauthorised activity.
• To issue invoices, take payment and manage your subscription.
• To operate, secure, debug, measure and improve our websites and the platform.
• To send you product announcements, research, event invitations and other marketing where you have agreed or we are otherwise permitted to do so.
• To measure how well our own marketing campaigns perform, where you have allowed the marketing cookie category.
• To detect and prevent fraud, spam, abuse and security incidents.
• To comply with our legal, tax, accounting and audit obligations, and to establish, exercise or defend legal claims.

If you subscribed to a newsletter or other marketing, you can unsubscribe at any time using the link in the message or by writing to [email protected]. Unsubscribing from marketing does not stop service, security or billing messages about your account.

The platform brings a customer’s marketing activity together — paid search, paid social, display, television, radio, out-of-home and organic — and models which of it actually drives conversions and revenue. To do that, it processes information about interactions on the customer’s own websites and apps, and about the performance of the customer’s advertising.

People who visit or interact with a customer’s website, app or campaign are referred to below as end users.

Attributy is a processor for this data. We do not decide which websites are measured, what is collected, or how long it is kept — our customer does. We do not use it to build profiles that follow people between unrelated customers, and we do not sell it.

Data collected through our measurement tag. A customer installs a first-party Attributy tag on its own website, using a plain snippet, a tag manager container, or a ready-made integration for Shopify, Shopware or Magento. The tag reports to Attributy and, subject to the consent the customer is responsible for obtaining, may collect:

• Pages and screens viewed, page titles, the order pages were viewed in and how long the visit lasted.
• Link clicks, scroll depth and other events the customer chooses to send.
• Ecommerce activity, including order identifier, order value, currency, tax, shipping, discounts, and the product name, SKU, category, price and quantity of items purchased.
• The referring URL and campaign parameters in the link the end user arrived from, such as UTM tags and advertising click identifiers.
• Browser and operating system, device type, brand and model, and screen resolution.
• IP address, and the approximate location derived from it — typically country, region and city, with the coordinates of that place. IP addresses are visible to the customer in the live tracking and visit log screens of its own account.
• A pseudonymous visitor identifier stored in first-party storage on the customer’s own domain, so that repeat visits by the same browser can be joined together within that customer’s account.
• A user identifier, only where the customer’s own configuration passes one to us.

What the tag does not do. It is not designed to capture keystrokes, the values typed into form fields, message contents or payment card details, and it does not record or replay screen sessions. Attributy does not set third-party advertising cookies on end users’ devices and does not operate an advertising network.

We ask customers not to send us special category data, government identifiers, financial account or payment card numbers, health information, precise device geolocation, or data they know relates to a child.

At a customer’s instruction, and using credentials that the customer authorises through each provider’s own sign-in screen, we retrieve campaign and performance data through the APIs of platforms the customer already uses. The connectors currently implemented in the product are:

• Google Ads
• Meta (Facebook) Ads
• LinkedIn Ads
• Microsoft Advertising (Bing Ads)
• TikTok Ads
• X (Twitter) Ads
• Snapchat Ads
• Pinterest Ads
• Campaign Manager 360 (DoubleClick)
• Display & Video 360
• Outbrain
• HubSpot
• Google Search Console and Zapier, which are enabled on request

The information returned by these connectors is mainly campaign metadata and aggregate performance figures — campaign, ad set and creative names, spend, impressions, clicks, reach and the conversions the platform itself reports. Some connectors also return click identifiers that allow an ad click to be matched to a visit.

Each of those platforms processes data under its own privacy notice, which customers and their end users should review. Other providers may appear on our marketing pages as planned or supported destinations; only the connectors listed above are implemented in the product today.

Data collected or received through the platform is used only as follows:

• To give the customer attribution results, models, forecasts, dashboards and reports for its own marketing.
• To attribute conversions and revenue across the customer’s channels and touchpoints, and to remove conversions double-counted by several platforms.
• To produce budget recommendations, scenario forecasts and AI-generated written insights for that customer.
• To show live visitor and order activity on the customer’s own live tracking screens.
• To detect and exclude bot and fraudulent traffic so that measurement stays reliable.
• For security, debugging, capacity planning and support.
• To produce aggregated and de-identified statistics that we use to operate and improve the service, in a form that is not reasonably linkable to any individual or household.
• As otherwise instructed in writing by the customer.

Customers can export results, including journey and conversion data and television and radio reports, as files generated by the service or as spreadsheets produced in the browser. What happens to an export after the customer downloads it is the customer’s responsibility.

We do not sell personal information, and we do not share measurement data collected through the platform for cross-context behavioural advertising. We disclose information only as follows:

• To the customer whose account the data belongs to, through reports, dashboards, exports and the application.
• To destinations a customer chooses, where the customer instructs us to send results onwards.
• To service providers who operate parts of our service, only as far as needed and under written confidentiality and data protection obligations. These currently include Amazon Web Services (AWS) for hosting and data storage, Google for reCAPTCHA and for the mapping used in our out-of-home map view, and OpenStreetMap’s Nominatim service, which we query for city boundary outlines using only a city and country name.
• To our professional advisers — auditors, insurers, accountants and lawyers — who are bound by duties of confidentiality.
• For legal reasons, where we believe in good faith that disclosure is required to comply with law, regulation or an enforceable governmental request, or to protect the rights, property or safety of Attributy, our customers or the public. Where we act as a processor and are legally permitted to do so, we will tell the customer before responding.
• In a corporate transaction, such as a merger, financing, reorganisation or sale of assets, subject to contractual data protection commitments.
• As aggregated statistics that cannot reasonably be linked to an individual or household.

Customers who require a current list of the sub-processors used to deliver the service can request one from [email protected].

On our websites. Use the Opt-out link in the footer to turn off advertising cookies at any time. You can also allow or refuse analytics and marketing categories from the cookie banner. Refusing them stops the corresponding tags from loading and instructs our own analytics to opt you out.

On a website measured with Attributy. Because our measurement runs as first-party technology that each customer deploys on its own domain, the most effective way to stop it is to use the privacy controls offered by that website, usually its own cookie or consent banner. You can also write to us at [email protected] and we will pass your request to the relevant customer, who is the controller. Telling us which website or brand your request concerns helps us route it quickly.

Browser and device controls.

• Most browsers let you block or delete cookies and clear local storage. See your browser’s settings, or allaboutcookies.org for general guidance.
• Privacy-focused browsers and tracker-blocking extensions can prevent non-essential tags from loading at all.
• On iOS, App Tracking Transparency is under Privacy & Security; tracking is off by default and must be allowed for each app. On Android, open Settings, then Google, then Ads, and follow the prompts under Ads Privacy.
• To limit interest-based advertising more broadly, see optout.aboutads.info or, in Europe, youronlinechoices.eu.

Opting out does not mean you stop seeing advertising. It means the advertising you see is less likely to be based on your previous activity, and that measurement of your visit is limited.

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law, contract or audit obligations. When it is no longer needed, we delete it or de-identify it.

In practice this means:

• Measurement data processed for a customer is retained for the period that customer configures and instructs, within the limits set out in our agreement with them. Because we are a processor for this data, retention is the customer’s decision, and we delete or return it on their instruction and at the end of their subscription.
• Account, configuration and security records are kept for as long as the subscription is active, and for a limited period afterwards so that we can deal with security, billing and legal questions.
• Billing and tax records are kept for the period required by applicable tax and accounting law.
• Enquiries, marketing contact records and support correspondence are kept for as long as needed to deal with your request and to maintain our business relationship, and are deleted when you ask us to erase them, subject to any legal obligation to retain them.
• Your cookie choice is stored for 180 days, as described above.

Aggregated and de-identified information, which cannot reasonably be linked back to a person, may be kept for as long as it is useful to our business. If you would like the specific retention period that applies to a particular category of data, please contact [email protected].

We take the security of the data we hold seriously and apply administrative, technical and physical safeguards designed to protect it against unauthorised access, alteration, disclosure, loss and misuse. Traffic between your browser and our services is carried over encrypted connections, access to production systems is restricted to the people who need it, and customer accounts are separated from one another within the platform.

Accounts are protected by password requirements enforced at sign-up, and our forms are protected against automated abuse. Where you are given, or choose, credentials to access the platform, you are responsible for keeping them confidential and for activity carried out under your account. Please tell us immediately if you believe your account has been compromised.

No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security. If you believe you have found a vulnerability in our services, please report it to [email protected].

Customers who need detail on our security controls, certifications or audit reports for a vendor assessment can request our current security documentation from [email protected].

Our websites and the Attributy platform are business tools intended for adults. They are not directed to children, and we do not knowingly collect personal information from children. Customers are not permitted to deploy our measurement tag on properties directed to children, or to send us data they know relates to a child.

If you believe a child has provided personal information to us, please contact [email protected] so that we can check and delete it.

Attributy is based in the United States. Information we collect may be transferred to, stored in and processed in a country other than the one you live in, including the United States, and that country may not give personal data the same level of protection as your own.

Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we put an appropriate transfer mechanism in place as required by applicable law, together with technical and organisational measures to protect the data in transit and at rest. Customers can request details of the transfer mechanism and the safeguards that apply to their data, and the current version of our data processing terms, by writing to [email protected].

Where the EU General Data Protection Regulation, the UK GDPR or the Swiss Federal Act on Data Protection applies and we act as a controller, we rely on the following legal bases:

• Performance of a contract, or taking steps at your request before entering into one — providing and supporting the platform under a subscription, and responding to your enquiry.
• Legitimate interests, balanced against your rights and freedoms — securing our services, preventing fraud, improving our products, and business development and administration.
• Consent, which you may withdraw at any time — non-essential cookies and similar technologies, and electronic marketing where consent is required.
• Compliance with a legal obligation — responding to lawful requests and meeting tax, accounting and audit duties.

Where we act as a processor for a customer, that customer is responsible for establishing the lawful basis for the processing it instructs us to carry out.

Your rights. Subject to the conditions and exemptions in applicable law, you have the right to be informed about how your data is processed; to access it; to have inaccurate or incomplete data corrected; to have it erased; to restrict processing; to object to processing based on legitimate interests, and to object to direct marketing at any time; to receive your data in a portable format; and to withdraw consent without affecting processing carried out before withdrawal.

You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects about you. We do not use our websites or the platform to make such decisions about individuals.

How to exercise them. Write to [email protected]. We will respond within one month, which can be extended by two further months for complex requests; we will tell you if that happens. We may need to verify your identity first, and we keep a record of requests for our own compliance purposes.

If your data was collected by us on behalf of a customer, we will refer your request to that customer, who is the controller and is best placed to answer it. If you provided your data as an employee or contractor of a customer, your rights are generally exercised through your employer.

You have the right to lodge a complaint with the supervisory authority in your country of habitual residence, your place of work, or the place where you believe an infringement occurred.

This section provides information required by U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, and comparable laws in other states. It describes how we handle personal information about visitors to our websites and about individuals at our customers.

For measurement data we process on a customer’s behalf, Attributy is a service provider or processor and the customer is the business or controller. Please direct those requests to the customer whose website you visited.

Key concepts.

• “Sale” means disclosing personal information to a third party for monetary or other valuable consideration. Attributy does not sell personal information.
• “Sharing” means disclosing personal information for cross-context behavioural advertising. To the limited extent that the non-essential advertising tags on our own websites could be considered “sharing”, you can opt out through our Opt-out control. We do not share platform measurement data for this purpose.
• “Sensitive personal information” includes government identifiers, account credentials, financial account and payment card numbers, precise geolocation, racial or ethnic origin, religious beliefs, health, sexual orientation, immigration status, genetic and biometric data, and data from a known child. We do not collect sensitive personal information, and customers are not permitted to send it to us.

Categories of personal information we collect about website visitors and customer personnel. For each category below we state whether we collect it and whether we disclose it to service providers for a business purpose. We do not sell any category, and we do not share any category for targeted advertising except where noted.

• Identifiers (name, email address, postal address, phone number, account name, IP address, online identifier) — collected; disclosed for a business purpose. May be “shared” only to the limited extent that our website advertising tags are considered sharing, which you can switch off in Opt-out.
• Customer records (name, address, phone number, employment and billing information) — collected; disclosed for a business purpose; not shared for advertising.
• Commercial information (subscription and plan history, products and services considered) — collected; disclosed for a business purpose; not shared for advertising.
• Internet or network activity (browsing on our websites, clickstream, scroll depth, interactions with our application) — collected; disclosed for a business purpose. May be “shared” only to the limited extent described above.
• Professional or employment information (job title, employer, business role) — collected; disclosed for a business purpose; not shared for advertising.
• Inferences (professional interests and likely product fit) — collected; disclosed for a business purpose; not shared for advertising.
• Approximate location derived from IP address — collected; disclosed for a business purpose; not shared for advertising. We do not collect precise geolocation from a device.
• Protected classifications, biometric information, education information, and sensitive personal information — not collected, not disclosed, not sold and not shared.

We collect these categories from you directly, from your browser and device when you use our websites, from our service providers, and from publicly available and business networking sources. We disclose them to the recipients described in the Disclosure section above.

Your rights. Subject to statutory exceptions, you have the right to know and access the personal information we hold about you and how we handle it; to have it deleted; to have inaccurate information corrected; to receive a portable copy; to opt out of sale or sharing, noting that we do not sell and that you can switch off our advertising tags in Opt-out; to limit the use of sensitive personal information, which does not apply because we do not collect it; to opt out of profiling that produces legal or similarly significant effects, which we do not carry out; to withdraw consent you previously gave; and not to be discriminated against for exercising any of these rights. We do not offer financial incentives in exchange for personal information.

Submitting a request. Write to [email protected]. We will acknowledge your request within 10 business days and respond within 45 days, which may be extended by a further 45 days where reasonably necessary; we will tell you if we need the extra time. We may ask for information to verify your identity and state of residency, and we use that information only to handle your request.

You may use an authorised agent by giving them written permission, which we may ask to see, together with verification of your own identity.

Appeals. If we decline your request you may appeal by replying to our decision, or by writing to [email protected] with “Appeal” in the subject line. Several states also allow you to escalate a denied appeal to the state Attorney General or equivalent consumer protection authority.

For any question about this Privacy Policy, or to exercise your rights, please contact us. Telling us which website, brand or account your request concerns helps us route it correctly.

• Privacy and data subject requests: [email protected]

You can also write to us at Attributy, Inc., Attn: Privacy, 3031 N Rocky Point Dr W, Suite 600 #5001, Tampa, FL 33607, USA.

We may change this Privacy Policy from time to time by posting the updated version at attributy.com/privacy and revising the “Last Updated” date at the top of this page. Where a change materially affects how we handle personal information, we will give additional notice before it takes effect.

Your continued use of our websites or the Attributy platform after an update takes effect indicates your acceptance of the updated policy.

Related documents: Consumer Privacy Notice, Terms of Use.