Privacy Policy

1. Who we are

Atribu (“we,” “us,” or “our”) operates a multi-tenant analytics platform that merges advertising spend with real business outcomes for performance agencies and brands. This Privacy Policy explains how we collect, use, store, and share information when you use our website, application, and related services (collectively, the “Service”).

2. Information we collect

Account information

When you create an account we collect your name, email address, and password. If you are invited to a workspace we also record the workspace and profile memberships associated with your account.

Workspace and profile data

To deliver the Service we process data you connect through third-party integrations, including but not limited to:

• Advertising platforms (e.g., Meta Ads) — campaign structure, spend, and delivery metrics.
• CRM and pipeline tools (e.g., GoHighLevel) — contacts, opportunity stages, and attribution fields.
• E-commerce platforms (e.g., Shopify) — orders, revenue, and customer history.
• Payment processors (e.g., Stripe) — payment event data related to cash collected.

All integration data is stored in a profile-scoped, isolated manner. Data from one profile is never mixed with or accessible from another profile.

Usage data

We automatically collect information about how you interact with the Service, including pages visited, features used, browser type, operating system, IP address, and referring URLs.

Cookies and similar technologies

We use strictly necessary cookies to maintain your authenticated session. We may also use analytics cookies to improve the Service. You can manage cookie preferences through your browser settings.

3. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process and display analytics dashboards, reports, and attribution data within your profile scope.
• Authenticate your identity and enforce role-based access control at the workspace and profile level.
• Send transactional communications (e.g., invitations, security alerts, product updates).
• Improve and develop new features for the Service.
• Detect, prevent, and address security issues and fraud.
• Comply with legal obligations.

4. Data isolation and security

Atribu is built with an agency-first, multi-tenant architecture. Each workspace acts as a tenant boundary, and each profile within a workspace is fully isolated. We enforce isolation through application-level authorization checks and database-level policies (including PostgreSQL Row-Level Security where applicable).

We maintain audit logs for key security and trust events such as connection creation, attribution model changes, and report exports.

We use industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews.

5. Sharing and disclosure

We do not sell your personal information. We may share information in the following circumstances:

• Service providers — third-party vendors who assist us in operating the Service (e.g., hosting, analytics, email delivery), bound by confidentiality agreements.
• Within your workspace — workspace members with appropriate roles may access profile data they are authorized to view.
• Legal requirements — when required by law, regulation, legal process, or enforceable governmental request.
• Business transfers — in connection with a merger, acquisition, or sale of assets, in which case we will notify you.

6. Data retention

We retain your account information for as long as your account is active. Workspace and profile data is retained while the workspace remains active. Archived profiles may be retained for a reasonable period to allow reactivation. You may request deletion of your account and associated data at any time by contacting us.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data, as well as the right to restrict or object to certain processing. To exercise these rights, contact us at the address below.

8. International transfers

Your information may be processed and stored in countries outside your country of residence. Where we transfer data internationally, we ensure appropriate safeguards are in place in accordance with applicable data protection laws.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

10. Contact us

If you have questions about this Privacy Policy or our data practices, please contact us at [email protected].