Privacy Policy

1. Who we are

Attributely is a B2B marketing-attribution service for lead-generation and ecommerce websites, operated by SOLAR CODE SRL, registered at str. Republicii 33, MD-3909 Cahul, Republic of Moldova, company registration number 1024603002594 ("Attributely", "we", "us"). Our customers — business owners and marketing agencies — embed a small first-party JavaScript snippet on their websites. Attributely then attributes visits, form submissions (leads), ecommerce purchases, and inbound phone calls back to the marketing source that earned them.

This policy explains what personal data we handle, why, and what rights you have. It applies to the Attributely application at attributely.io (marketing site) and app.attributely.io (app) and to the data our tracking and call-tracking infrastructure processes on behalf of our customers.

This policy is effective as of June 12, 2026.

2. Our role: controller vs. processor

Attributely handles personal data about three different groups of people, and our legal role is different for each. Understanding this split tells you who to contact about your data:

If you are a visitor or a caller, the website owner or business you interacted with decides why and how your data is processed; we act only on their instructions under a data processing agreement. Please direct privacy requests to them first — we assist them in fulfilling those requests (see Your rights).

3. Data we collect from account users (we are the controller)

Identity and authentication

When you create an account we collect your email address and password (handled by Supabase Auth — we never see your plaintext password), or your Google identity if you choose Google OAuth sign-in, plus the first and last name on your profile.

Billing

Billing is handled by Stripe. We store your Stripe customer ID and subscription ID and link to Stripe-hosted invoices. Attributely never stores card numbers; Stripe is the merchant processor.

Usage and configuration

We store your workspace and website configuration and usage counters (leads, purchases, call minutes, pageviews) to operate the service, enforce plan quotas, and calculate billing.

Transactional email

We send transactional email via Resend: authentication emails (through Resend SMTP via Supabase Auth) and app emails such as workspace invites, trial reminders, usage warnings, and payment-failed notices (through the Resend API). We do not currently send a marketing newsletter. If we ever introduce marketing emails, they will be opt-in only, with consent captured separately and an unsubscribe link in every message.

Sessions

Your sign-in session uses a JWT access token that expires after 1 hour with silent auto-refresh. Sessions expire after 7 days of inactivity and have an absolute cap of 30 days. Refresh tokens are single-use with reuse detection. Session state persists in your browser's localStorage (see our Cookie Policy).

4. Data we process about website visitors (we are a processor)

Our tracking script (track.js) runs in one of two modes, chosen per site by the website owner. We never set third-party cookies in either mode, and the script does not run for known crawlers.

Standard mode (default)

Standard mode is designed to be GDPR-friendly first-party analytics. It collects:

• A first-party cookie, la_vid (anonymous visitor ID, 90 days), plus tab-scoped sessionStorage keys for session/pageview IDs and cached configuration.
• A lightweight server-side fingerprint hash computed from user agent, language, timezone, screen size, color depth, device pixel ratio, and platform — used only for exact-match visitor recovery in the same browser after a cookie wipe.
• Page URLs, referrers, UTM parameters, ad click IDs (such as Google Ads gclid), and visible time per page.
• Your IP address, stored on visit and event rows. Its purpose is to let site owners export repeat ad-fraud IPs into ad-platform exclusion lists; raw IPs are only ever exposed to the site owner, never publicly. A salted, derived IP hash is also computed for rate limiting and joins. Raw IPs are retained no longer than the plan's retention window.
• Coarse geolocation (country / region / city) derived from request headers at the network edge — not from GPS.
• On form submission (a "conversion"): the email and/or phone number and name you submitted, the form URL, and brief network/DOM signals captured for roughly 3 seconds after submit, used server-side for AI verification that a real submission happened. Leads are merged across visits by email/phone.
• Clicks on tel: links (the phone number clicked and a timestamp) for call attribution.
• Bot and crawler filtering: known crawlers are dropped at ingest; suspected bots are scored from fingerprint signals and hidden from analytics.

Advanced mode (opt-in per site — requires visitor consent)

If the website owner enables Advanced mode, the following is collected in addition to Standard mode:

• Device fingerprinting: canvas hash, WebGL renderer/vendor/scene hash, AudioContext oscillator hash, hardware concurrency, device memory, and maximum touch points.
• Persistent ID redundancy: the visitor ID is mirrored to localStorage and IndexedDB and restored if the cookie is cleared.
• Fuzzy server-side identity matching across browsers on the same device, with multiple guards, /24 IP-prefix tiebreakers, and time windows.

Advanced mode uses device fingerprinting and persistent storage, which under GDPR/ePrivacy typically requires explicit visitor consent. The website owner, as the controller, is responsible for capturing that consent on their site.

Ecommerce purchase capture (ecommerce-mode sites)

On ecommerce sites, we capture purchase events from the GA4/GTM dataLayer or an explicit Attributely.trackPurchase() call: order ID, value, currency, items, promo codes, and the payment-method label only. Buyer contact details may be resolved from explicitly passed email/phone/name, values typed into the merchant's own checkout form fields (a session-scoped "buyer stash" that bridges multi-step checkouts), GA4 enhanced-conversions user_data.email, or a previously known identity for the visitor.

A curated PII allow-list filters order data before it leaves the browser: order identity, money, items, customer email/phone/name/notes, coarse address (country, region, city, postal code), and promo codes. Street address is off by default and only collected if the merchant opts in via an embed attribute. A hard scrub removes any card-like fields and PAN-shaped values — payment-card data never reaches Attributely's servers.

5. Data we process about phone callers (we are a processor)

Customers can rent tracked phone numbers (provisioned via Twilio) that forward to their real business line. Inbound calls only — there is no outbound dialer. For each inbound call we process:

• The caller's phone number, the dialed tracked number, call status, duration, and timestamps.
• Call recordings (mp3), stored in private storage and accessible only via short-lived signed URLs.
• Transcripts (dual-channel, speaker-labeled, produced by AssemblyAI) and a short AI-generated summary (OpenAI, gpt-4o-mini).

Every tracked number plays a recording disclaimer before the call is bridged (default: "This call may be recorded for quality and attribution purposes", with a controller-identifying variant for the UK, Germany, France, the Netherlands, and Ireland). The disclaimer always plays, even when recording is disabled. Twilio receives the recording first; a background worker copies it into Attributely's storage and deletes the Twilio copy. Recordings and transcripts are purged automatically at the end of the customer's plan retention window; call metadata is retained for reporting.

The business you called is the data controller for call recordings. A documented right-to-erasure workflow exists for callers (identified by phone number + website): erasure removes the audio and transcript and nulls all personal-data columns.

6. Purposes and legal bases

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract — providing the Attributely service to our customers (account management, attribution, billing, support).
• Legitimate interest — Standard-mode first-party analytics, fraud and abuse prevention (including bot filtering and ad-fraud IP exports), and rate limiting.
• Consent — Advanced-mode device fingerprinting and persistent storage, where applicable. This consent is captured by the website owner on their own site.
• Legal obligation — retaining tax and billing records.

We never sell personal data, and we never use the data we process on behalf of customers for advertising. The only outbound data flow to an ad platform is the optional Google Ads offline conversion import, which sends conversion events keyed on gclid to the customer's own connected Google Ads account.

7. Subprocessors and third parties

We use the following service providers to operate Attributely:

8. Google User Data and the Google Ads API

When you connect a Google Ads account, Attributely requests two scopes:

• https://www.googleapis.com/auth/adwords — to list the accounts you can connect, to create and manage the conversion actions Attributely writes to your account, and to read campaign reporting metrics (spend, impressions, clicks) so we can show you a return-on-ad-spend report alongside your attributed conversions. We use this reporting access read-only; we do not modify your campaigns, ad groups, keywords, budgets, or account settings.
• https://www.googleapis.com/auth/datamanager — to upload the offline click conversions you've attributed (click ID and conversion value only) back to your Google Ads account.

We store an encrypted OAuth refresh token (AES-256) to perform these operations on your behalf. We transfer only click IDs and conversion values to your own Google Ads account; we do not send any personally identifiable information to Google. Data obtained through Google APIs is used solely to provide the conversion-import and ROAS-reporting features you enabled. We do not use it for advertising, we do not sell it, and we do not transfer it to third parties or use it to train AI/ML models.

You can disconnect at any time in the app, or revoke access at https://myaccount.google.com/permissions, which immediately stops all uploads. Stored tokens are deleted on disconnection and within 30 days of account closure.

Attributely's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. International data transfers

Our primary infrastructure is hosted in the European Union: our database, authentication, and file storage (Supabase) run in the eu-north-1 region (Stockholm, Sweden), and our application and API hosting (Vercel) runs in Ireland. Some of our subprocessors — Stripe, Twilio, AssemblyAI, OpenAI, Resend, and Google — are based in the United States and may process personal data there. Where that happens, we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

Where personal data is transferred outside the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, as detailed above.

10. Data retention

Analytics data and call recordings are retained according to the customer's plan:

• Recordings and transcripts past the retention window are purged by a nightly job: audio is deleted and transcript columns are nulled. Call metadata rows (numbers, status, duration, attribution) remain for historical reporting.
• Raw event queue rows retain payload, IP hash, geolocation, and user agent for audit and debugging. Queue rows are retained for 30 days.
• Raw IPs are retained no longer than the plan's retention window.
• On account deletion: All customer data is deleted within 30 days of account closure, and from backups within 90 days.

11. Security

Measures we use to protect personal data include:

• Multi-tenancy isolation: every row is scoped to a site or workspace, with Postgres Row-Level Security throughout and database grants locked to an explicit allowlist.
• Call recordings stored in a private bucket, accessible only through 300-second signed URLs.
• Webhook signature verification (Twilio HMAC-SHA1, Stripe HMAC-SHA256).
• Secrets held in vault/environment scopes; refresh-token rotation with reuse detection; short-lived JWTs.
• An idempotent, durable event pipeline with crawler and bot filtering at ingest.
• Data is encrypted at rest (AES-256) and in transit (TLS). Databases are backed up regularly, and we commit to notifying affected customers of any personal-data breach within 72 hours of becoming aware of it.

12. Your rights (GDPR / UK GDPR)

If you are in the EEA or the UK, you have the right to access, rectify, erase, and port your personal data, to restrict or object to its processing, to withdraw consent at any time, and to lodge a complaint with your supervisory authority.

• Account users: contact us directly at support@attributely.io to exercise any of these rights.
• Website visitors and phone callers: the website owner or business you interacted with is the controller — please direct your request to them. We assist controllers in fulfilling requests, including a documented erasure workflow for callers.

13. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, to opt out of its sale or sharing, and to not be discriminated against for exercising these rights.

Attributely does not sell or share personal information as those terms are defined in the CCPA/CPRA, and we have not done so in the preceding 12 months. For data collected on our customers' websites and tracked phone numbers, Attributely acts as a "service provider": we process that information only to provide the service to the customer and direct rights requests about it to the customer. The categories of personal information we collect and our retention periods are described in sections 3–5 and 9 above.

To exercise your California rights, contact support@attributely.io.

14. Children

Attributely is a business-to-business service. Account holders must be at least 18 years old (or the age of legal majority in their jurisdiction). We do not knowingly collect personal data from children.

15. Changes to this policy

We may update this policy as the service evolves. We will post the new version on this page and update the "Last updated" date; for material changes affecting account users, we will notify you by email.

16. Contact us

Privacy questions and requests: support@attributely.io
Postal address: str. Republicii 33, MD-3909 Cahul, Republic of Moldova