Legal
The short version: Attributr collects data to power link attribution and campaign reporting. We do not sell your data. We do not share it with third parties for advertising. We store it securely and you can request deletion at any time.
Attributr is operated by Attributr Pty Ltd, a company registered in Australia (ABN to be confirmed). Our registered address is available on request. We are the data controller for personal data collected through our website and platform.
References to "Attributr", "we", "us", or "our" in this policy mean Attributr Pty Ltd. References to "you" or "your" mean you as a user of our platform or visitor to our website.
When someone clicks one of your Attributr links or scans one of your QR codes, we collect:
We do not store raw IP addresses. IP geolocation is performed in memory at the time of the click, and only the derived country/region is retained. The originating IP address is discarded immediately after processing.
If you install our tracking snippet or use a platform integration (e.g. Shopify, WooCommerce, HubSpot, Salesforce), we may receive conversion signals including:
Conversion data is tied to the anonymised session identifier described above — not to a named individual unless you explicitly pass personally identifiable data through our API (which you should only do in accordance with your own privacy obligations to your customers).
| Method | Data collected |
|---|---|
| Account registration form | Name, email, company |
| Link redirect infrastructure | Click metadata, device, country |
| Tracking snippet (optional) | Conversion events from your website |
| Platform integrations (optional) | Order/lead data from third-party platforms |
| Cookies and local storage | Session state, preferences |
| Stripe (payment processor) | Billing confirmation — we receive only a token, not card data |
We process personal data on the following legal bases under the Australian Privacy Act 1988 and, where applicable, the EU/UK General Data Protection Regulation (GDPR):
We do not sell, rent, or trade your data. We share data only with:
Third-party services we use to operate Attributr:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting and data storage | Australia (ap-southeast-2) |
| Stripe | Payment processing | USA (PCI-DSS compliant) |
| Postmark / SendGrid | Transactional email | USA |
| Sentry | Error monitoring | USA |
| Cloudflare | CDN, DDoS protection, link redirect | Global edge network |
When you enable integrations (Shopify, HubSpot, Salesforce, etc.), data flows between Attributr and that platform at your instruction and in accordance with your agreements with those platforms.
We may disclose data to law enforcement or regulatory authorities where required by law, or to protect the rights and safety of Attributr, our users, or the public.
| Data type | Retention period |
|---|---|
| Account and profile data | For the life of the account + 30 days after deletion request |
| Link and QR code data | For the life of the account + 30 days after deletion request |
| Click and scan event data | 25 months (rolling) — older data is aggregated and raw events deleted |
| Conversion event data | 25 months (rolling) |
| Billing records | 7 years (required by Australian tax law) |
| Security and audit logs | 12 months |
We take security seriously. Our measures include:
In the event of a data breach that affects your personal data, we will notify you and any relevant authorities as required by the Australian Privacy Act Notifiable Data Breaches scheme and applicable GDPR requirements.
Attributr uses the following types of cookies:
| Type | Purpose | Duration |
|---|---|---|
| Strictly necessary | Session authentication, CSRF protection | Session |
| Functional | User preferences, language, workspace selection | 12 months |
| Analytics | Aggregated platform usage (internal only, not shared with ad networks) | 24 months |
We do not use advertising or retargeting cookies. You can manage cookie preferences via the cookie consent banner on first visit, or through your browser settings.
Attributr tracking snippet: When installed on your website, our snippet uses a first-party cookie or local storage token to maintain a session identifier for journey attribution. This identifier is hashed and anonymised — it is not used to identify individuals.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, email us at privacy@attributr.co. We will respond within 30 days. We may need to verify your identity before processing the request.
If you are located in the EU or UK and believe we have processed your data unlawfully, you have the right to lodge a complaint with your local supervisory authority.
Attributr is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@attributr.co and we will delete it promptly.
Our primary data storage is in Australia (AWS ap-southeast-2). Some sub-processors (listed in section 6.1) are located in the United States. Where personal data is transferred outside Australia, we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required by GDPR.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in the Attributr app at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of Attributr after the effective date constitutes acceptance of the updated policy.
For any privacy-related questions, requests, or concerns:
We aim to respond to all privacy enquiries within 5 business days.