Privacy

Introduction

This Privacy Policy describes how Attribution, Inc. and its affiliates (“Attribution,” “we,” “us,” or “our”) collect, use, disclose, and otherwise process Personal Data in connection with our website, applications, products, services, and related interactions (collectively, the “Services”).

This Privacy Policy applies when you visit our website, communicate with us, use the Services, or otherwise interact with us. It also describes certain rights and choices you may have regarding your Personal Data (defined below).

Attribution may process Personal Data on behalf of its customers in connection with providing the Services, including where a customer or its authorized users submit, transmit, or make available Personal Data through the Services or connected integrations. Attribution does not directly solicit or determine the Personal Data included in customers’ marketing analytics data. To the extent a customer includes Personal Data in such data, Attribution processes it on behalf of the applicable customer and in accordance with the customer’s instructions. In those cases, Attribution acts as a processor, service provider, contractor, or sub-processor, as applicable, and the customer remains the controller, business, or data owner responsible for such Personal Data and for responding to data subject or consumer requests. Attribution may refer any such request it receives to the applicable customer for handling and response. When acting in this capacity, Attribution does not sell Personal Data received from customers or share it for cross-context behavioral advertising, and uses it only to provide, secure, support, and operate the Services, comply with customer instructions, or as otherwise permitted by applicable law.

This Privacy Policy supplements any separate agreement between Attribution and a customer governing the Services. If a separate written agreement expressly addresses the handling of certain Customer data or Personal Data, that agreement will control to the extent of any conflict.

Data We Collect About You and How We Collect It

This Policy applies to data we collect:

• Personal Data;
• By which you may be personally identified, such as name, postal address, email address, telephone number any other identifier by which you may be contacted online or offline;
• That is about you but individually does not identify you, such as aggregated data (including general traffic, site usage, length-of stay, etc.);
• About your internet connection, the equipment you use to access our website and/or platform, and usage details.
• Provided by you directly to us:
  • When you create an account or use our interactive tools and the Service;
  • When you voluntarily provide information in connection with the Service or through responses to surveys or questionnaires;
  • When you send an email or otherwise contact us.
• When you use the website and/or platform or Services, and such information is collected automatically:
  • Through Cookies (see below);
  • If you use a location-enabled browser, we may receive information about your location;
  • If you download and install certain applications and software we make available, we may receive and collect information transmitted from your computing device for the purpose of providing you the relevant Services, such as information regarding when you are logged on and available or receive updates or alert notices.

Personal Data

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our website and/or platform or Services. For purposes of this section, “Personal Data” means any information that identifies or relates to a particular individual and also includes information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws, rules or regulations. This Policy does not cover the practices of companies we don’t own or control or people we don’t manage.

Categories of Personal Data We Collect

This chart details the categories of Personal Data that we may collect and may have collected over the past 12 months:

Third Party Integrations, APIs

Notwithstanding the foregoing, to the extent we collect Personal Data through third-party APIs, integrations, analytics tools, or similar technologies, our use and transfer of such Personal Data will be in accordance with applicable law and, where applicable, the relevant third-party provider’s terms, policies, and data processing requirements.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our website and/or platform, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our website and/or platform, including traffic data, location data, logs, and other communication data and the resources that you access and use on the website and/or platform.
• Information about your computer and internet connection, including your IP address, operating system, and browser type.

The information we collect automatically only include statistical data and does not include Personal Data, but we may maintain it or associate it with personal data we collect in other ways or receive from third parties. It helps us to improve our website and/or platform and to deliver a better and more personalized service, including by enabling us to:

• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our website and/or platform according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our website and/or platform.

The technologies we use for this automatic data collection may include:

• Web Beacons. Pages of our website and/or platform may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Attribution, for example, to count users who have visited those pages and for other related website statistics.
• Analytics Tools. We use analytics tools, including Google Analytics and Segment, to help us understand website traffic, usage patterns, referral sources, and interactions with our website and Services.
• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. We and our third-party analytics providers may use cookies, pixels, tags, software development kits, local storage, and similar technologies to automatically collect information about your interactions with our website and Services. These technologies may collect information such as your IP address, device identifiers, browser type, operating system, referring URLs, pages viewed, links clicked, time spent on pages, and other information about how you access and use the website and Services. We use these technologies to operate the website and Services, understand visitor activity, measure performance, improve user experience, and analyze the effectiveness of our marketing efforts. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our website and/or platform. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our website and/or platform. For information about managing your privacy and security settings for cookies, see Choices About How We Use and Disclose Your Personal Data. We use the following cookies on our website and/or platform:

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data:

• To provide, operate, maintain, and support the website, Services and/or platform.
• To present our website, Services and/or platform and its contents to you.
• To provide you with information, products, or services that you request from us.
• To constantly improve our website.
• To identify you as our contractual partner.
• To invoice our fees.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• To notify you about changes to our website and/or platform or any products or services we offer or provide though it.
• To allow you to participate in interactive features on our website and/or platform.
• To fulfill any other purpose for which you provide it.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

Automated Technologies

We do not develop large language models, conduct artificial intelligence training programs, or currently use Attribution developed artificial intelligence tools in the Platform, nor does the Platform currently use artificial intelligence or machine learning technologies as part of its core functionality. We and our third party service providers may, however, use third-party business, productivity, communications, security, support, and operational tools that include automated or artificial intelligence-enabled features, such as features made available through Google Workspace, Zoom, Fathom, or similar vendors. These tools are used in connection with our ordinary business operations. We do not use Personal Data to train generalized artificial intelligence models and we do not permit any service providers to use Personal Data to train generalized artificial intelligence models.

Aggregated Data

Any Customer Data used for development, research, or analytics is first aggregated, pseudonymized, or de-identified so that it cannot reasonably be used to identify any individual (“Aggregated Data”).

Disclosure of Your Information

We may disclose Aggregated Data, and information that does not identify any individual, without restriction.

We may disclose Personal Data that we collect or you provide as described in this privacy policy:

• To Service Providers, such as AWS and Heroku, Customer.io, and Pipedrive CRM. These parties help us provide, operate, secure, support, maintain, and improve the Services or perform business functions on our behalf. They may include:
  • Hosting, infrastructure, technology, and communications providers;
  • Security, fraud prevention, and monitoring providers;
  • Support and customer service vendors;
  • CRM, customer communications, and business operations vendors; and
  • Other vendors that process information on our behalf in connection with the website, platform, or Services.
• To Analytics Partners, such as Google Analytics, Twilio Segment, Customer.io, Pipedrive CRM, and Mixpanel. These parties help us understand activity on our website and, where applicable, use of our platform or Services. For example, we may use Google Analytics and Segment cookies to understand website traffic, referral sources, user interactions, and related usage trends. We may combine website-collected data with business account information we maintain about customers and prospective customers, but we do not use Analytics Partners to receive or analyze customer-provided subscription feed data unless expressly authorized by the applicable customer. For clarity, we do not share customer-provided advertising, conversion, transaction, customer event, integration, reporting, or attribution data with Analytics Partners. Customer-provided subscription feed data is processed to provide the Services, hosted with our service providers, including AWS and Heroku, and shared only as directed or authorized by the applicable customer.
• To Parties You Authorize, Access, or Authenticate, such as Meta, Google, LinkedIn, X, Reddit, Outbrain, Twilio Segment, RudderStack, Shopify, HubSpot, Salesforce, and Stripe. These parties include your organization and third-party platforms, integrations, or services that you or your organization choose to connect to, access through, or authorize in connection with the Services. Where customer-provided data is made available to such parties, it is done at the direction or authorization of the applicable customer.
• To our subsidiaries and affiliates.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Attribution assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Attribution about our website and/or platform users is among the assets transferred.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.

We may also disclose your Personal Data:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our Terms of Use (located at https://www.attributionapp.com/terms/) including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Attribution, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

We do not sell your Personal Data.

Choices About How We Use and Disclose Your Personal Data

You may control cookies and similar technologies through your browser settings and, where available, our cookie preferences tools.

If you receive marketing emails from us, you may unsubscribe at any time by using the unsubscribe link in the message or by contacting us at the email address listed below. Please note that you may still receive transactional or service-related communications.

Depending on your jurisdiction, you may also have additional rights and choices described in the applicable jurisdiction-specific sections below.

Children Under the Age of 16

Our website and/or platform is not intended for children under 16 years of age. No one under age 16 may provide any personal information to or on the website and/or platform. We do not knowingly collect personal information from children under 16. If you are under 16, do not use or provide any information on this website and/or platform or through any of its features, register on the website and/or platform, make any purchases through the website and/or platform, use any of the interactive or public comment features of this website and/or platform, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a child under 16 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 16, please contact us at privacy@attributionapp.com.

How to Contact Us

Please direct any questions or comments about this Policy or privacy practices to privacy@attributionapp.com. You may also write to us via postal mail at:

Attribution Inc.
145 Corte Madera Town Cntr. #445
Corte Madera, CA 94925
ATTN: Attribution Privacy

Enforcement; Recourse: We urge you to contact us to find a solution for any concern you may have about our data practices; however, applicable law may permit you to lodge a complaint with your competent data protection authority (i.e., the authority of your place of habitual residence, place of work, or place of alleged infringement).

State Resident Rights

State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information.

If you are a resident of Colorado, Connecticut, Virginia, and Utah, you have the right to:

• Confirm whether we process their personal information;
• Access and delete certain personal information;
• Data portability; and
• Opt-out of personal data processing for targeted advertising and sales.

Colorado, Connecticut, and Virginia also provide their state residents with rights to:

• Correct inaccuracies in their personal information, taking into account the information’s nature processing purpose; and
• Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise any of these rights please contact us at privacy@attributionapp.com with the subject line “[Your State] Privacy Rights Request” and providing us with your name and the email address associated with your account.

California Resident Rights

This “California Resident Rights” section applies only to individuals residing in California. California residents have certain rights with respect to their personal data, including:

• The right to access, including the right to know the categories and specific pieces of personal data we collect;
• The right to deletion of your personal data, subject to certain limitations under applicable law;
• The right to request disclosure of data collected;
• The right to disclosure of data disclosed for valuable consideration;
• The right to opt out of sales of personal data;
• The right not to be discriminated against for exercising certain rights under California law; and
• Under California’s “Shine the Light” law, California residents who provide personal data in obtaining products or services for personal, family, or household use are entitled to request and obtain from us once a calendar year data about the customer data we shared, if any, with other businesses for their own direct marketing use. If applicable, this data would include the categories of customer data and the names and addresses of those businesses with which we shared customer data for the immediately prior calendar year (e.g., requests made in 2020 will receive data regarding 2019 sharing activities). Please be aware that not all sharing activities are covered by the Shine the Light law and only covered data will be included in our response.

To exercise any of these rights please mail us at our postal address provided above, or contact us at privacy@attributionapp.com with the subject line “California Privacy Rights Request” and providing us with your name and the email address associated with your account. Please be as specific as possible in relation to the personal data you wish to access. Once we receive your request, we will review it, determine whether we can verify your identity, and process the request accordingly. If we need additional data to verify your identity, we will let you know. We will respond to your request within sixty (60) days of receipt, or notify you if we require additional time. If you would prefer, you may designate an authorized agent to make a request on your behalf.

Nevada Resident Rights

If you are a resident of Nevada, you have the right to opt-out of the sale of certain personal data to third parties. You can exercise this right by mailing us at our postal address provided above or contacting us at privacy@attributionapp.com with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account.

European Union, United Kingdom, and Swiss Data Subject Rights

If you are a resident of the European Union (“EU”), United Kingdom (“UK”), Lichtenstein, Norway or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (the “GDPR”) with respect to your personal Data, as outlined below.

Personal Data: References to “personal data” in this Privacy Policy are equivalent to “personal data” governed by European data protection legislation.

Processor: Attribution is the “processor” of your personal data covered by this privacy policy for purposes of European data protection legislation.

Controller: Customer is the “controller” of your personal data covered by this privacy policy for purposes of European data protection legislation.

Legal bases for processing: We use your personal data only as permitted by law. Our legal bases for processing the personal data described in this Privacy Policy are described in the table below.

Processing Purpose: Details regarding each processing purpose listed below are provided in the section above titled “How we use your personal data”.

Legal basis to operate the Service: Processing is necessary to perform the contract governing our provision of the Service or to take steps that you request prior to signing up for the Service. If we have not entered into a contract with you, we process your personal data based on our legitimate interest in providing the Service you access and request:

• To administer events and contests;
• For research and development;
• To send you marketing communications;
• To manage our recruiting and process employment applications;
• For compliance, fraud prevention and safety; and
• To create anonymous data.

These activities constitute our legitimate interests. We do not use your personal data for these activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

To comply with law: Processing is necessary to comply with our legal obligations.

With your consent: Processing is based on your consent. Where we rely on your consent you have the right to withdraw it any time in the manner indicated when you consent or in the Service.

Use for new purposes: We may use your personal data for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal data for an unrelated purpose, we will notify you and explain the applicable legal basis.

Sensitive personal data: We ask that you not provide us with any sensitive personal data (e.g., data related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the Service, or otherwise to us. If you provide us with any sensitive personal data to us when you use the Service, you must consent to our processing and use of such sensitive personal data in accordance with this Privacy Policy. If you do not consent to our processing and use of such sensitive personal data, you must not submit such sensitive personal data through our Service.

Retention: We retain Personal Data for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. When we no longer require the personal data we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible. If we anonymize your personal data (so that it can no longer be associated with you), we may use this data indefinitely without further notice to you.

Certain rights: You have certain rights regarding your Personal Data. If you are located within or outside of the European Union, you may ask us to take the following actions in relation to your personal data that we hold:

• Access: Provide you with data about our processing of your personal data and give you access to your personal data.
• Correct: Update or correct inaccuracies in your personal data.
• Delete: Delete your personal data.
• Transfer: Transfer a machine-readable copy of your personal data to you or a third party of your choice.
• Restrict: Restrict the processing of your personal data.
• Object: Object to our reliance on our legitimate interests as the basis of our processing of your personal data that impacts your rights.

To exercise any of these rights please mail us at our postal address provided above, or contact us at privacy@attributionapp.com with the subject line “EU Privacy Rights Request” and providing us with your name and the email address associated with your account. We may request specific data from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal data or our response to your requests regarding your personal data, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.

If there are any conflicts between this section and any other provision of this Privacy Policy, the policy or portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following applies to you, please contact us at privacy@attributionapp.com.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service. We may, and if required by law will, also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via e-mail (if you have an account where we have your contact data) or another manner through the Service.

Any modifications to this Privacy Policy will be effective upon our posting the new terms and/or upon implementation of the new changes on the Service (or as otherwise indicated at the time of posting). In all cases, your continued use of the Service after the posting of any modified Privacy Policy indicates your acceptance of the terms of the modified Privacy Policy.

[End]