Privacy Policy

1. Who we are

Attribix ("we", "us", "our") is a tracking and attribution platform used by e-commerce businesses to better understand the performance of their marketing. We act as a data processor for our customers and as a data controller for visitors to our own website.

2. What data we collect

We collect two main types of data when you use Attribix:

• Account data – such as your name, email address, company name and billing details when you create or manage an Attribix account.
• Usage and analytics data – such as page views, events, conversions and campaign parameters sent from your store or ad platforms to Attribix. This data is used to provide attribution and reporting features to you.

3. How we use your data

We use personal data for the following purposes:

• To provide, maintain and improve the Attribix service.
• To secure the platform, prevent abuse and troubleshoot issues.
• To send important account-related information and respond to your requests.
• To generate anonymous, aggregated statistics that help us improve product performance.

3a. Google Ads and advertising platform data

Attribix integrates with advertising platforms including Google Ads, Meta (Facebook/Instagram), and others to provide attribution and performance reporting. In connection with these integrations:

• We access Google Ads data (including campaign performance, conversion data, and cost metrics) solely to provide attribution reporting to you as our customer. We do not use this data for any other purpose, including advertising to end users or profiling.
• Google Ads data accessed via the Google Ads API is used only to display reporting within your Attribix dashboard and is not shared with any third party.
• Our use of Google Ads API data complies with Google API Services User Data Policy, including the Limited Use requirements.
• We use Google Analytics (GA4) on our website to understand visitor behaviour. Google Analytics may use cookies to collect anonymised usage data. You can opt out via Google's opt-out browser add-on.

3b. Data protection and security mechanisms

We take the security of personal data and sensitive information seriously. The following mechanisms are in place to protect data we collect and process:

• Encryption in transit – All data transmitted between your browser, your store, and Attribix servers is encrypted using TLS (HTTPS). API communications with Google, Meta, and other ad platforms are made exclusively over encrypted connections.
• Encryption at rest – Sensitive data including OAuth tokens, API credentials, and personal data stored in our databases is encrypted at rest.
• OAuth token handling – When you connect a Google account (e.g., Google Ads), we store only the OAuth access and refresh tokens required to retrieve your ad performance data on your behalf. These tokens are stored in encrypted form, are scoped to the minimum permissions required, and are never shared with third parties.
• Access controls – Access to data is restricted to authorised personnel who need it to operate and support the service. We enforce role-based access controls and audit internal access to sensitive systems.
• Data minimisation – We request only the OAuth scopes and data necessary to provide the attribution and reporting features you have requested. We do not access, store, or use data beyond what is needed for these purposes.
• Token revocation – You may revoke Attribix's access to your Google account at any time via your Google Account permissions. Upon revocation or account deletion, associated tokens are removed from our systems.

4. Legal basis for processing (EEA/UK)

Where GDPR applies, we process personal data based on one or more of the following legal bases: performance of a contract, legitimate interests, and your consent (for example, where a customer chooses to use cookies that require consent).

5. Data retention

We retain customer data for as long as your Attribix account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes and enforce our agreements. Customers may request deletion of account data at any time.

6. Your rights

Depending on your location, you may have rights to:

• Access a copy of personal data we hold about you.
• Request correction or deletion of your personal data.
• Object to or restrict certain types of processing, or request data portability.

To exercise any of these rights, please contact us at hello@attribix.app.

7. International transfers

Attribix may process data using infrastructure located in the EU, EEA and other countries. Where data is transferred outside of your jurisdiction, we use appropriate safeguards such as standard contractual clauses where required by law.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we do so, we will update the "Last updated" date above. If changes are material, we will provide additional notice where appropriate.

9. Contact

If you have any questions about this Privacy Policy or how we handle personal data, you can reach us at hello@attribix.app.