Privacy Policy

1. Who we are

Attributely is a B2B marketing-attribution service for lead-generation websites, operated by SOLAR CODE SRL, registered at str. Republicii 33, MD-3909 Cahul, Republic of Moldova, company registration number 1024603002594 ("Attributely", "we", "us"). Our customers — business owners and marketing agencies — embed a small first-party JavaScript snippet on their websites. Attributely then attributes visits, form submissions (leads), and inbound phone calls back to the marketing source that earned them. Customers can also connect their Google Ads and Meta (Facebook/Instagram) ad accounts to see ad spend next to their results and to send conversions back to their own ad accounts, and can have alerts for new calls, missed calls, and new form leads posted to a Telegram group they choose.

This policy explains what personal data we handle, why, and what rights you have. It applies to the Attributely application at attributely.io (marketing site) and app.attributely.io (app) and to the data our tracking and call-tracking infrastructure processes on behalf of our customers.

This policy is effective as of June 12, 2026.

2. Our role: controller vs. processor

Attributely handles personal data about three different groups of people, and our legal role is different for each. Understanding this split tells you who to contact about your data:

If you are a visitor or a caller, the website owner or business you interacted with decides why and how your data is processed; we act only on their instructions under a data processing agreement. Please direct privacy requests to them first — we assist them in fulfilling those requests (see Your rights).

The same split applies to Meta: we are the controller for the Facebook identity and access token of the account user who connects Meta, and a processor for the visitor and lead data sent to the customer's own Meta Dataset on the customer's instructions (see Meta (Facebook) Platform Data).

It applies to the Telegram Bot integration too: we are the controller for the Telegram identity of an account user who connects the customer's Telegram group or joins it through their Attributely invite link, and a processor for the lead and caller data in the alerts sent to that group, and for the details of other people in the group, on the customer's instructions (see Telegram Bot integration).

3. Data we collect from account users (we are the controller)

Identity and authentication

When you create an account we collect your email address and password (handled by Supabase Auth — we never see your plaintext password), or your Google identity if you choose Google OAuth sign-in, plus the first and last name on your profile.

Billing

Billing is handled by Stripe. We store your Stripe customer ID and subscription ID and link to Stripe-hosted invoices. Attributely never stores card numbers; Stripe is the merchant processor.

Usage and configuration

We store your workspace and website configuration and usage counters (leads, call minutes, pageviews) to operate the service, enforce plan quotas, and calculate billing.

Connected ad platforms

If you connect Meta, we receive your Facebook user ID and name, the list of permissions you granted, and an access token, which we store encrypted. If you connect Google Ads, we store an encrypted OAuth refresh token. See Google user data and Meta (Facebook) Platform Data for exactly what each connection is used for.

Telegram

If you join a website's Telegram group through your personal Attributely invite link, or connect the group yourself, we store your Telegram user ID, display name, and username, linked to your Attributely account. See Telegram Bot integration for everything the integration stores.

Transactional email

We send transactional email via Resend: authentication emails (through Resend SMTP via Supabase Auth) and app emails such as workspace invites, usage warnings, and payment-failed notices (through the Resend API). We do not currently send a marketing newsletter. If we ever introduce marketing emails, they will be opt-in only, with consent captured separately and an unsubscribe link in every message.

Sessions

Your sign-in session uses a JWT access token that expires after 1 hour with silent auto-refresh. Sessions expire after 7 days of inactivity and have an absolute cap of 30 days. Refresh tokens are single-use with reuse detection. Session state persists in your browser's localStorage (see our Cookie Policy).

4. Data we process about website visitors (we are a processor)

Our tracking script (track.js) runs in one of two modes, chosen per site by the website owner. We never set third-party cookies in either mode, and the script does not run for known crawlers.

Standard mode (default)

Standard mode is designed to be GDPR-friendly first-party analytics. It collects:

• A first-party cookie, la_vid (anonymous visitor ID, 90 days), plus tab-scoped sessionStorage keys for session/pageview IDs and cached configuration.
• A lightweight server-side fingerprint hash computed from user agent, language, timezone, screen size, color depth, device pixel ratio, and platform — used only for exact-match visitor recovery in the same browser after a cookie wipe.
• Page URLs, referrers, UTM parameters, and visible time per page.
• Ad click IDs from the page URL: Google Ads gclid, gbraid, and wbraid, Meta fbclid, and Microsoft msclkid. If the website already runs Meta Pixel, the script also reads the values of Meta's first-party _fbc and _fbp cookies — it reads them only and never sets or changes them.
• Your IP address, stored on visit and event rows. Its purpose is to let site owners export repeat ad-fraud IPs into ad-platform exclusion lists; raw IPs are only ever exposed to the site owner, never publicly. A salted, derived IP hash is also computed for rate limiting and joins. Raw IPs are deleted with the rows that hold them: visit rows after 180 days and queued event rows within 30 days. Meta conversion uploads keep the visitor IP sent to Meta for matching, and follow the lead they belong to.
• Coarse geolocation (country / region / city) derived from request headers at the network edge — not from GPS.
• On form submission (a "conversion"): the email and/or phone number and name you submitted, the form URL, and brief network/DOM signals captured for roughly 3 seconds after submit, used server-side for AI verification that a real submission happened. Leads are merged across visits by email/phone.
• Clicks on tel: links (the phone number clicked and a timestamp) for call attribution.
• Bot and crawler filtering: known crawlers are dropped at ingest; suspected bots are scored from fingerprint signals and hidden from analytics.

Advanced mode (opt-in per site — requires visitor consent)

If the website owner enables Advanced mode, the following is collected in addition to Standard mode:

• Device fingerprinting: canvas hash, WebGL renderer/vendor/scene hash, AudioContext oscillator hash, hardware concurrency, device memory, and maximum touch points.
• Persistent ID redundancy: the visitor ID is mirrored to localStorage and IndexedDB and restored if the cookie is cleared.
• Fuzzy server-side identity matching across browsers on the same device, with multiple guards, /24 IP-prefix tiebreakers, and time windows.

Advanced mode uses device fingerprinting and persistent storage, which under GDPR/ePrivacy typically requires explicit visitor consent. The website owner, as the controller, is responsible for capturing that consent on their site.

Telegram alerts (optional)

If the website owner turns on the Telegram Bot integration with form-lead alerts, each new lead is sent to the Telegram group they chose: the lead's name, email address, and phone number, the traffic source, the page path of the form, the lead's value if one is set, and the full form response. See Telegram Bot integration.

5. Data we process about phone callers (we are a processor)

Customers can rent tracked phone numbers (provisioned via Twilio) that forward to their real business line. Inbound calls only — there is no outbound dialer. For each inbound call we process:

• The caller's phone number, the caller ID name when available, the caller's approximate location (city and region, from the phone network), the dialed tracked number, call status, duration, and timestamps.
• Call recordings (mp3), stored in private storage and accessible only via short-lived signed URLs.
• Transcripts (dual-channel, speaker-labeled, produced by AssemblyAI) and, generated from them (OpenAI, gpt-4o-mini), a short summary and an analysis of the call: a quality rating and score, the outcome, sentiment, intent, and tags.

Every tracked number plays a recording disclaimer before the call is bridged (default: "This call may be recorded for quality and attribution purposes", with a controller-identifying variant for the UK, Germany, France, the Netherlands, and Ireland). The disclaimer always plays, even when recording is disabled. Twilio receives the recording first; a background worker copies it into Attributely's storage and deletes the Twilio copy. Recordings and transcripts are kept while the customer's account is open, and are deleted when the customer deletes a recording or closes the account.

The business you called is the data controller for call recordings. A documented right-to-erasure workflow exists for callers (identified by phone number + website): erasure removes the audio and transcript and nulls all personal-data columns.

If the business turns on the Telegram Bot integration with call alerts, an alert for each call is sent to the Telegram group it chose: the caller's phone number, caller ID name when available, approximate location (city or region, from the phone network), the call source, the tracked number's label, talk time, an AI-generated quality rating and outcome, the name of the matched lead, and an AI-generated summary of the call. Call recordings and transcripts are never sent to Telegram. See Telegram Bot integration.

6. Purposes and legal bases

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract — providing the Attributely service to our customers (account management, attribution, billing, support).
• Legitimate interest — Standard-mode first-party analytics, fraud and abuse prevention (including bot filtering and ad-fraud IP exports), and rate limiting.
• Consent — Advanced-mode device fingerprinting and persistent storage, where applicable. This consent is captured by the website owner on their own site.
• Legal obligation — retaining tax and billing records.

We never sell personal data, and we never use the data we process on behalf of customers for our own advertising. The only outbound data flows to ad platforms are the optional, customer-enabled conversion send-backs: to the customer's own Google Ads account (see section 8) and to the customer's own Meta Dataset through the Conversions API (see section 9).

The Telegram Bot integration is optional in the same way. If a customer turns it on, we deliver call and form-lead alerts to the Telegram group the customer chose (see section 10). For the visitor and caller data in those alerts, we act on the customer's instructions as a processor, and the customer, as controller, is responsible for having a legal basis for sending it to their group. Storing the Telegram identity of an account user who joins the group through their Attributely invite link is part of providing the service (contract).

7. Subprocessors and third parties

We use the following service providers to operate Attributely:

Meta acts as an independent party for the data it receives through the Conversions API, under its own Business Tools Terms. Telegram likewise acts as an independent party for the alerts delivered to a customer's group, which it processes and stores on its own servers under its own Privacy Policy.

8. Google User Data and the Google Ads API

When you connect a Google Ads account, Attributely requests two scopes:

• https://www.googleapis.com/auth/adwords — to list the accounts you can connect, to create and manage the conversion actions Attributely writes to your account, and to read campaign reporting metrics (spend, impressions, clicks) so we can show you a return-on-ad-spend report alongside your attributed conversions. We use this reporting access read-only; we do not modify your campaigns, ad groups, keywords, budgets, or account settings.
• https://www.googleapis.com/auth/datamanager — to upload the offline click conversions you've attributed (click ID and conversion value only) back to your Google Ads account.

We store an encrypted OAuth refresh token (AES-256) to perform these operations on your behalf. We transfer only click IDs and conversion values to your own Google Ads account; we do not send any personally identifiable information to Google. Data obtained through Google APIs is used solely to provide the conversion-import and ROAS-reporting features you enabled. We do not use it for advertising, we do not sell it, and we do not transfer it to third parties or use it to train AI/ML models.

You can disconnect at any time in the app, or revoke access at https://myaccount.google.com/permissions, which immediately stops all uploads. Stored tokens are deleted on disconnection and within 30 days of account closure.

Attributely's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Meta (Facebook) Platform Data

When you connect Meta, you sign in with Continue with Facebook (Facebook Login for Business) and choose which ad accounts and Pixels/Datasets to share, or paste an access token you generated in Meta Business Settings. The connection is per website in your Attributely workspace. Attributely requests two permissions:

• ads_read — to read campaign reporting (spend, impressions, clicks) for the ad accounts you chose, so we can show your cost per lead and return on ad spend.
• ads_management — to send lead conversion events to the Pixel/Dataset you chose through the Conversions API.

What we receive from Meta

Through Facebook Login and the Meta Marketing API we receive:

• your Facebook user ID and name (to show "Connected as …");
• the list of permissions you granted and the token's expiry;
• an access token, stored encrypted and never shown back in the app or shared;
• the ad accounts you can access (ID, name, currency) and the Pixels/Datasets on the ad account you chose (ID, name);
• per campaign, per day: campaign ID, name, objective, spend, impressions, clicks, account currency, and delivery status.

We use this only to show you your own Meta ad spend next to the leads and calls Attributely captured, so you can see cost per lead and return on ad spend. Reporting data is synced roughly every hour.

What we send to Meta

When a visitor who arrived from a Meta ad later becomes a lead (a form submission or a qualifying phone call), we send one server-side Lead event through the Conversions API to your own Pixel/Dataset. It contains:

• the event name, time, a de-duplication ID, and the page URL where the lead happened;
• fbc (Meta click ID, from Meta's _fbc cookie or the fbclid URL parameter) and fbp (Meta's _fbp browser ID cookie), when present;
• the lead's email address and phone number, normalized (lowercased and trimmed; digits-only E.164) and SHA-256 hashed on our servers before they are sent — Meta never receives them from us in plain text;
• the visitor's IP address;
• the lead value and currency you configured.

Events are sent only for leads attributable to a Meta ad click, only to your own Dataset, and only while the integration is connected with a Pixel selected. The purpose is to let your own Meta campaigns measure and optimize for real leads. As the customer, you are the controller for this visitor data and are responsible for having a legal basis — including any required consent — for sharing it with Meta.

What we do not do

• We do not sell Meta Platform Data or share it with anyone other than the customer who connected it.
• We do not use it for our own advertising, for profiling, or to build audiences.
• We do not combine one customer's Meta data with another customer's.
• We do not create, edit, pause, or delete your campaigns, ads, or budgets. Access is used read-only for reporting, plus sending conversion events.
• We do not access Facebook Pages, Instagram accounts, friends lists, posts, or messages.

Security

The Meta access token is encrypted with AES-256-GCM. Only the systems that perform the reporting sync and the conversion upload can decrypt and use it.

Retention

• Access token and connection settings: kept until you disconnect, revoke access, or delete your account. They are deleted immediately when you disconnect, and otherwise within 30 days of account closure (backups within 90 days).
• Campaign metrics (spend, impressions, clicks): kept while your account is active so historical reports keep working; deleted with your account (within 30 days, backups within 90 days), or earlier on request to support@attributely.io.
• Conversion-upload queue rows: follow the same plan-based retention as the rest of your lead data (see Data retention).

Disconnecting and deletion

You can disconnect at any time in the app under Settings → Website → Integrations → Meta Ads → Disconnect, which immediately deletes the stored token and connection settings. You can also remove Attributely from your Facebook account under Settings & privacy → Settings → Business integrations, or from Meta Business Settings. Step-by-step instructions, including how to have all of your data deleted, are on our Data Deletion Instructions page.

Attributely's use of data received from Meta complies with the Meta Platform Terms and Developer Policies.

10. Telegram Bot integration

The Telegram Bot integration posts alerts for new calls, missed calls, and new form leads to a Telegram group. It is optional and off by default. A website editor connects it in the app under Settings → Website → Integrations → Telegram Bot. Each website can send alerts to one Telegram group, and a group can receive alerts for only one website. You choose which of the three alert types the group gets. Email alerts are unaffected.

What we send to Telegram

Every alert names the website and has a View call or View lead button linking to the Attributely app, where sign-in is required. Depending on the alert, it contains:

• Form leads: the lead's name, email address, and phone number; the traffic source (for example "Google Ads" or "Direct"); the page path of the form; the lead's value, if one is set; and the full form response — every answer the visitor submitted, shown collapsed.
• Calls (new calls, voicemails, missed calls, and callers who hung up during the greeting): the caller's phone number; the caller ID name, when available; approximate location (city or region, from the phone network); the source — the website channel (for example "Website · Google Ads") or where the dialed number is published (for example "Google Business Profile"); the tracked number's label; talk time; an AI-generated quality rating and outcome; the name of the matched lead; and an AI-generated summary of the call.

Call recordings and transcripts are never sent to Telegram. Calls detected as robocalls are not posted; calls flagged as possible spam are posted with a label.

Everyone in your Telegram group can read the alerts, and you control who is in the group. Telegram group messages are not end-to-end encrypted: they are processed and stored on Telegram's servers under Telegram's Privacy Policy. Once delivered, messages stay in the group until group members or admins delete them; removing the integration in Attributely does not delete messages already sent. As the customer, you are the controller for the visitor and caller data in these alerts and are responsible for having a legal basis for sending it to your group.

What the bot receives, and what we ignore

When you connect a group, you give the bot these admin rights in it: change group info, invite users via link, pin messages, and ban users. They are used to:

• name a new group and set its photo to the website's icon (only if you tell us the group is new);
• pin a welcome message;
• create personal invite links;
• remove people (see Membership controls).

Because the bot is an admin, Telegram delivers every message posted in the group to it. Attributely discards every message that isn't a command addressed to the bot, without storing or logging it. The only commands we handle are /start, used once to connect the group, and /status, which replies with the website the group gets alerts for.

We also use group events to keep the connection accurate: the bot being added or removed, its rights changing, the group being renamed or upgraded, and people joining or leaving.

What we store

• The group: its Telegram chat ID, title, and type; the bot's admin rights and the member count; the alert switches and connection status; when the last alert was sent and the last delivery error; and which Attributely user connected it.
• People in the group we know of (those who joined through Attributely, or joined after the group was connected): Telegram user ID, display name, username, and whether they joined, left, or were removed. For teammates who joined through their personal Attributely invite link, this is linked to their Attributely account.
• Invite links: each teammate's personal invite link, which is single-use and expires after 24 hours.
• Connect link: the one-time link used to connect a group, stored only as a SHA-256 hash; it expires after 15 minutes.

Membership controls

Every Attributely member with access to the website gets their own single-use invite link to the group. When someone loses access to the website in Attributely — they are removed from the workspace, their access is narrowed, or their account is deleted — the bot removes them from the group within about 5 minutes and posts a short notice.

People who were already in the group before it was connected can't be linked to an Attributely account, because Telegram doesn't let bots list group members. People who joined some other way after the group was connected are shown to the website's editors, who can remove them.

Security

Telegram's requests to Attributely are authenticated with a secret, and the bot token is kept server-side only. The data for this integration can only be read through access checks scoped to the website; browsers have no direct access to it.

Retention and disconnecting

• Removing the group: when you remove the group in the app, the bot posts a goodbye message and leaves the group. All stored data for that group is then deleted, including the people records and invite links.
• Deleting or moving a website: all Telegram integration data for a website is also deleted when the website is deleted or moved to another workspace.
• Connect links: expired one-time connect links are deleted after a day.
• Delivered messages: alerts already delivered stay in Telegram until group members or admins delete them, as described above.

11. International data transfers

Our primary infrastructure is hosted in the European Union: our database, authentication, and file storage (Supabase) run in the eu-north-1 region (Stockholm, Sweden), and our application and API hosting (Vercel) runs in Ireland. Some of our subprocessors — Stripe, Twilio, AssemblyAI, OpenAI, Resend, and Google — are based in the United States and may process personal data there. If you connect Meta, data is exchanged with Meta Platforms Ireland Ltd (Ireland) and Meta Platforms, Inc. (United States). If you turn on the Telegram Bot integration, alerts are delivered to Telegram Messenger Inc., which is located outside the EEA; Telegram states that the data of users who signed up for Telegram from the UK or the EEA is stored in data centers in the Netherlands. Where data is transferred to the United States, we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified (as Meta Platforms, Inc. is), the EU–US Data Privacy Framework. For data delivered to Telegram, we rely on the Standard Contractual Clauses.

Where personal data is transferred outside the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, as detailed above.

12. Data retention

Leads (form submissions and calls), call recordings and transcripts are kept while the customer's account is open, on every plan; the customer can delete them earlier. Report history and visit-level detail are retained according to the customer's plan:

• Report history keeps, per visit, an anonymous visitor ID, the traffic source and campaign, approximate location (country, region, city), device, browser, operating system and the pages viewed, but never the IP address or user agent.
• Data past these windows is purged by a nightly job. Leads and calls keep their attribution after their visits are purged.
• Raw event queue rows retain payload, IP hash, geolocation, and user agent for audit and debugging. Queue rows are retained for 30 days.
• Raw IPs are deleted with the rows that hold them: visit rows after 180 days and queued event rows within 30 days. Meta conversion uploads keep the visitor IP sent to Meta for matching, and follow the lead they belong to.
• Meta access tokens and connection settings are deleted immediately on disconnect; Meta campaign metrics are kept while the account is active so historical reports keep working (see section 9).
• Telegram Bot integration data (group details, people records, and invite links) is deleted when the group is removed in the app, and when the website is deleted or moved to another workspace. Expired one-time connect links are deleted after a day. Alerts already delivered stay in Telegram until group members or admins delete them (see section 10).
• On account deletion: All customer data is deleted within 30 days of account closure, and from backups within 90 days.

13. Security

Measures we use to protect personal data include:

• Multi-tenancy isolation: every row is scoped to a site or workspace, with Postgres Row-Level Security throughout and database grants locked to an explicit allowlist.
• Call recordings stored in a private bucket, accessible only through 300-second signed URLs.
• Webhook signature verification (Twilio HMAC-SHA1, Stripe HMAC-SHA256).
• Secrets held in vault/environment scopes; refresh-token rotation with reuse detection; short-lived JWTs.
• An idempotent, durable event pipeline with crawler and bot filtering at ingest.
• Data is encrypted at rest (AES-256) and in transit (TLS). Databases are backed up regularly, and we commit to notifying affected customers of any personal-data breach within 72 hours of becoming aware of it.

14. Your rights (GDPR / UK GDPR)

If you are in the EEA or the UK, you have the right to access, rectify, erase, and port your personal data, to restrict or object to its processing, to withdraw consent at any time, and to lodge a complaint with your supervisory authority.

• Account users: contact us directly at support@attributely.io to exercise any of these rights.
• Meta data: to stop us processing data from Meta, disconnect the integration in the app or remove Attributely from your Facebook account — see our Data Deletion Instructions.
• Telegram data: removing the group in the app makes the bot leave the group and deletes everything we store about it, including the people records and invite links (see section 10 and our Data Deletion Instructions). Alerts already delivered stay in Telegram until group members or admins delete them. If you are in a customer's Telegram group but don't use Attributely, the customer who runs the group is the controller — please direct your request to them, or email us and we will pass it on.
• Website visitors and phone callers: the website owner or business you interacted with is the controller — please direct your request to them. We assist controllers in fulfilling requests, including a documented erasure workflow for callers. You can also email us and we will pass your request on to them (see our Data Deletion Instructions).

15. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, to opt out of its sale or sharing, and to not be discriminated against for exercising these rights.

Attributely does not sell or share personal information as those terms are defined in the CCPA/CPRA, and we have not done so in the preceding 12 months. For data collected on our customers' websites and tracked phone numbers, Attributely acts as a "service provider": we process that information only to provide the service to the customer and direct rights requests about it to the customer. The categories of personal information we collect and our retention periods are described in sections 3–5, 9, 10, and 12 above.

To exercise your California rights, contact support@attributely.io.

16. Children

Attributely is a business-to-business service. Account holders must be at least 18 years old (or the age of legal majority in their jurisdiction). We do not knowingly collect personal data from children.

17. Changes to this policy

We may update this policy as the service evolves. We will post the new version on this page and update the "Last updated" date; for material changes affecting account users, we will notify you by email.

18. Contact us

Privacy questions and requests: support@attributely.io
Postal address: str. Republicii 33, MD-3909 Cahul, Republic of Moldova