Privacy policy
The short version
- This website sets no cookies and loads nothing from third parties. There is no consent banner because nothing here needs one.
- The Attribia platform stores tracked-link clicks, leads and conversions on behalf of each client. It never stores IP addresses in those records, and identifiers are hashed wherever hashing is possible.
- Everything runs in Google Cloud's Belgium region, except two named AI vendors in the United States that only ever see a client's own public pages and business profile.
- When an engagement ends, its data is deleted within 30 days.
- One address for questions, rights requests and complaints. It is at the end of this page. We answer within a few days and always within the legal deadlines.
Who we are
Attribia is operated by Wojciech Olech, based in Poland. Attribia is a marketing attribution platform for advertisers: tracked campaign links, an events API for leads and conversions, and a dashboard that shows what each channel produced. It is run as a small number of hands-on engagements, not as a self-serve product.
For everything in this policy, the operator is the data controller, except where this policy says that an advertiser is. Write to the address at the end of this page.
Who this policy covers
Four kinds of people can be affected by what Attribia does, and each gets its own section below.
- Visitors to this website, attribia.com. See This website.
- People who write to us. See When you contact us.
- Clients and their team members who use the Attribia platform. See Your account and organisation.
- People whose data an advertiser sends us, or who click an advertiser’s tracked link. For them, the advertiser is the data controller and Attribia processes the data on the advertiser’s instructions. See Data we process for our clients and If you clicked a tracked link.
This website
attribia.com is a static website. It sets no cookies, uses no analytics, loads no fonts, scripts or images from any third party, and runs no advertising pixel. That is why there is no cookie banner: nothing on this site needs consent.
The site is served by Firebase Hosting, a Google service. Like every web server, Google’s servers record the address of each request (your IP address, the page requested, the time, your browser’s identification string) to detect abuse and keep the service running. Google keeps those logs for a few months, as described in Firebase’s privacy documentation. We see only aggregate usage figures and do not use these logs to identify anyone.
The “Log in” link takes you to the Attribia platform, which is a separate application covered by the platform sections below.
When you contact us
The only way to contact us from this site is email. When you write, we receive what you send: your address, your name if you include it, and the content of your message. We use it to answer you and, if you become a client, as part of the engagement record.
The mailbox is hosted by Google (Gmail), so Google processes the messages as our provider under Google’s privacy policy. We keep correspondence for as long as the conversation and any engagement lasts, and delete it within twelve months after that unless we are required to keep it longer. The legal basis is our legitimate interest in answering people who write to us, and, once an engagement exists, the contract with you.
Your account and organisation
The Attribia platform is the logged-in application at which clients see their attribution data. Access is set up by us for each client; there is no public signup we market.
What an account holds. Your name, your work email address, your password (stored only as a hash, never in clear text), and your role in your organisation (owner, admin or member). Your organisation’s record holds its name, the business profile you gave us at onboarding (industry, business model, what you sell, target customers, markets, brands, your main conversion, typical order value, monthly ad budget, currency, competitors, notes), and the addresses of the web pages you asked us to check. All of the business profile is optional.
How you stay logged in. When you log in, the platform issues a session token and your browser keeps it in its local storage until you log out. The token is stored on our side only as a hash, so a copy of our database cannot be used to log in as you. This storage is strictly necessary to provide the service you asked for, so it needs no consent.
API keys. Your organisation can hold one active key for sending events to the platform. We show the key once and store only its hash.
Server logs. Requests to the platform are logged by our hosting provider, Google Cloud, with the requesting IP address, for security and troubleshooting, and kept for 30 days.
Why we process this. To provide the platform to your organisation under our contract with it. Invoicing details are kept for as long as tax and accounting law requires.
How long. For as long as your organisation uses Attribia, then deleted within 30 days of the engagement ending, unless you ask us to delete something sooner or the law requires us to keep it.
Data we process for our clients
This is the core of what Attribia does, and here the roles are reversed: the advertiser (our client) is the data controller and Attribia is the processor. We process this data only on the client’s instructions, under the data processing terms in our terms of service. If you are one of the advertiser’s customers and want to exercise your rights, contact the advertiser; we will help them answer you.
| Record | What it holds | What it never holds |
|---|---|---|
| Click (someone clicked a tracked link) | The campaign parameters in the link (UTM values), the click identifiers Meta and Google add to the link (fbclid, gclid and their variants), the browser’s identification string, the page that referred the click, our own first-party visitor and click identifiers, and a short list of advertising cookies if your browser sent them to the link’s domain | Your IP address. The rest of your cookies. Your name or contact details. |
| Lead and Conversion (the advertiser tells us something happened) | An event identifier, the time, for conversions the value and currency and a type, the same visitor and click identifiers as above, and contact identifiers hashed by the advertiser before they reach us | Your email address or phone number in clear text. Our API is specified to receive contact identifiers already hashed, and we never hash raw details ourselves; an advertiser sending them in clear text breaks our terms. |
The purpose is attribution: joining clicks to the leads and conversions they led to, so the advertiser can see what each channel produced. This joining uses only the identifiers above.
These records are stored in a database hosted on Google Cloud in Belgium, separated per client. They are kept for as long as the advertiser’s engagement with us lasts and deleted within 30 days after it ends, or earlier on the advertiser’s instruction.
If you clicked a tracked link
If an advertiser uses Attribia, the link in their ad may point at Attribia’s link domain first. Here is exactly what happens.
- Your browser requests the link. We record a Click as described above. Like every request to our servers, this request is also logged by our hosting provider with your IP address for 30 days for security; the Click record itself never contains it.
- We send your browser on to the advertiser’s page, adding the campaign parameters and identifiers to the address so the advertiser’s own tools can see them.
- For most links, the response sets one cookie on Attribia’s link domain, called
atb_vid. It contains a random identifier and nothing else, lasts up to 400 days, and lets us recognise that later clicks came from the same browser. It is not shared with anyone and is not readable by the advertiser’s site. For Google Ads links, which Google’s browser tooling fires in the background, no cookie is set.
Whether and how the advertiser’s own tracking runs on their site is governed by the advertiser’s cookie banner and privacy policy, not by this one. To remove our cookie, clear cookies for the link domain in your browser. To ask about your data, contact the advertiser whose ad you clicked; we will help them respond.
AI features
Attribia offers two AI-assisted checks that clients run on their own public web pages.
- Page check. We fetch the page the client named, detect which tracking tools it carries, and write a short plain-English report. The page is rendered by Firecrawl, a browser-rendering service in the United States. The report text is written by OpenAI’s models, in the United States: OpenAI receives the page address, what we detected on it, and the client’s business profile. We send OpenAI no data about the client’s customers, and we use OpenAI’s API on terms that exclude the data from training its models, without storing the conversation, as described in OpenAI’s enterprise privacy commitments.
- Consent check. A browser run by Firecrawl visits the client’s page from a chosen country, records which cookies the page set before, on accepting and on declining consent, and we write up whether the page’s consent banner behaves. The cookies recorded are the ones set in that test browser, not anyone’s real session.
A business summary for the client’s organisation is also generated by OpenAI from the business profile, the content of the client’s own pages and public information about their business. It is stored for the client and shown to them; it is not shared.
Who else touches the data
We run Attribia with a small number of providers. Each acts as our processor (or the advertiser’s sub-processor for client data) and is bound by its data processing terms.
| Provider | What it does for us | Where |
|---|---|---|
| Google Cloud (Cloud Run, Secret Manager, Cloud Logging) | Runs the platform’s services and holds its secrets and server logs | Belgium (europe-west1). Cloud privacy notice, data processing addendum |
| MongoDB Atlas | The platform’s database | Hosted on Google Cloud in Belgium. Privacy policy, data processing agreement |
| Firebase Hosting (Google) | Serves this website and the platform’s web application | Google’s global network. Firebase privacy documentation |
| OpenAI | Writes the AI report text and the business summary | United States. Enterprise privacy |
| Firecrawl | Renders the client’s own pages for the page and consent checks | United States. Privacy policy |
| Google (Gmail) | Our contact mailbox | Privacy policy |
Ad platforms. Attribia does not currently send any data to Meta or Google Ads, and does not pull spend data from them automatically. When a live connection or conversion feedback is switched on, this policy will be updated first and clients will be told by email before it applies to them.
We do not sell personal data and we do not share it with anyone else, except if the law requires us to.
Transfers outside the EU
The platform and its database run in the EU. Two providers process data in the United States: OpenAI and Firecrawl, both only for the AI features above. OpenAI processes it under its data processing addendum, which includes the EU standard contractual clauses. Firecrawl receives only the addresses and content of the client’s own public pages. Google may process server logs and email outside the EU under its data processing terms and the EU-US Data Privacy Framework.
Security
Passwords, session tokens and API keys are stored only as hashes. All traffic uses TLS. Each client’s data is kept apart from every other client’s by a tenant identifier that every query is scoped to. Access to production is limited to the operator. Server logs are kept 30 days. If a breach ever affects your data, we will tell you without undue delay and, where we are the processor, tell the advertiser within 48 hours of becoming aware.
Your rights
Under the GDPR you can ask us to:
- tell you whether we hold personal data about you and give you a copy (access);
- correct it (rectification);
- delete it (erasure);
- restrict how we use it, or object to our use of it where we rely on legitimate interest;
- give you the data you provided in a machine-readable form (portability);
- withdraw any consent you gave, at any time, without affecting what was done before.
Write to the address at the end of this page. We answer within a month, sooner where we can. Where Attribia acts as a processor for an advertiser, we will pass your request to the advertiser and help them answer it.
You also have the right to complain to a supervisory authority. Ours is the Polish authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You can also complain to the authority in the EU country where you live or work.
We make no decisions about you by automated means that have a legal or similarly significant effect.
Children
Attribia is a service for businesses. This website and the platform are not directed at anyone under 16, and we do not knowingly collect personal data from children.
Changes to this policy
The effective date and version at the top of this page tell you which version you are reading. When we change something material, we will update both, and we will email our clients before the change applies to them. Earlier versions are available on request.
How to reach us
For anything in this document, including questions, requests about your data and complaints, write towojtek@attribia.com. Wojciech Olech reads every message personally and replies within a few days.