Attribution.io is both a data Processor and a data Controller. As a Processor we collect and analyze web traffic to provide marketing analytics on behalf of our clients, the Controllers. We are very strict when processing the data of our clients: we never mix data across client accounts, never merge in 3rd party data and never sell your data to anyone for any reason.
As a data Controller, we handle data about our clients, prospects, employees and vendors.
During the course of business operations, Attribution.io collects very few data points about our clients customers (listed below). You may be surprised at how few there are; this is very intentionally limited to ensure that we do not collect any data that is not strictly necessary for the operations of the platform.
During the course of business Attribution.io collects several data points about our clients, used to create and operate your account (listed below). We do not buy data about our clients from 3rd parties for sales, marketing or ongoing management of accounts.
We have data integrations with the following companies (below). During the course of normal business operations we may receive or send data about our clients. For example, if you sign-up for our Shopify App, we will populate many fields using data provided by Shopify. Stripe provides secure credit card processing and as such receives some minimal information required to tie your payment information to your account.
We have defined data retention periods for each type of data we collect. Data retention may be affected by custom settings in your account. There may be additional audit or operational logs used for debugging that retains data longer. Client's Customer Data: Anonymous data retained for 60 days, known user data retained for 1 year after last seen. Client data: Retained while account is in use and for 2 years after account is cancelled or closed.
We collect the above web activity data and assemble a timeline for each customer. We then track traffic sources via referrer and URL values to assign attribution credit for the events reported. We do not conduct profiling and make no predictions about the expected behavior of users.
We are committed to assisting our Controllers in honoring any Data Subject Requests to exercise their rights to access, erasure and portability. Please email firstname.lastname@example.org for assistance fulfilling your customers data subject requests or to submit a request for yourself.