{ "id": "privacy-2026-11-01.1", "kind": "privacy", "publishedOn": "2026-11-01", "business": { "name": "SEO RANK SERP LLC", "product": "Attriboo", "address": "8 The Green, Dover, Delaware 19901, United States", "updated": "October 31, 2026", "support": "/support" }, "document": { "slug": "privacy", "title": "Privacy Policy", "summary": "What Attriboo collects, why it is used, who handles it, and how to exercise your choices.", "sections": [ { "title": "Regional limits on our own website analytics", "paragraphs": [ "Optional analytics on attriboo.com is off for visitors whose request location is in the EU, EEA or UK, and when the location is unknown. The hosting provider supplies an approximate country for this decision; we do not save the country-check response as an analytics event. Previously saved permission does not override this limit. IP-based location can be inaccurate, including when a visitor uses a VPN.", "Everyone can still browse the public website, sign in, pay and send support or privacy requests. Hosting, security, account, payment and requested-service processing continues as described in this policy. This limit concerns our own marketing measurement; it does not change customer installations, imported payment records or historical records, and it is not a claim that all EU/UK legal duties have been removed." ] }, { "title": "Our role and this policy", "paragraphs": [ "SEO RANK SERP LLC, 8 The Green, Dover, Delaware 19901, United States, operates Attriboo. We act as a controller for our own website, accounts, billing administration, communications, security, and support.", "When a business uses Attriboo to measure its own website or match its own customer payments, that business generally controls the visitor and customer data. We process that data on its instructions under the Data Processing Addendum. Contact that business first about its tracking or your records; we can help route a request when appropriate." ], "links": [ { "label": "Privacy request form", "href": "/support?topic=privacy" }, { "label": "Data Processing Addendum", "href": "/legal/dpa" } ] }, { "title": "Information you provide", "bullets": [ "Account and team information, such as names, sign-in addresses, workspace membership, and account settings.", "Website addresses and configuration, integration permissions and credentials, and information needed to run the connections you authorize.", "Billing identifiers, subscription and payment status, invoice details, and transaction references received from Polar or an authorized payment integration. The payment provider handles payment credentials; our application is not designed to receive complete card numbers or security codes.", "Support and privacy requests, including the reply address and message you submit through the form.", "Customer event, payment, campaign, and other records that an authorized business submits to the service." ] }, { "title": "Website activity and analytics data", "paragraphs": [ "On Attriboo's own website, optional measurement uses Attriboo's script, not Google Analytics. Optional analytics is disabled unless you choose to allow it. Our own-site installation disables the script's automatic capture of email fields in submitted forms.", "The measurement data can include a random browser identifier, page paths, timestamps, referring source, campaign labels, device and browser categories, and approximate country or city derived from hosting request information. Hosting providers also receive network information such as IP addresses to deliver and secure requests. We do not describe a persistent identifier as anonymous merely because it is not a name.", "On customers' websites, the standard Attriboo script can associate activity with an email address from a submitted form, identify calls, payment metadata, or a post-purchase answer when the customer enables or uses those features. Payment records may include buyer contact details, amounts, currency, order identifiers, refunds, and recurring-payment information. Customers must disclose and lawfully configure that processing. This website's cookie controls do not set preferences on a customer's separate website.", "We do not use Google Analytics on this website. A Google site-verification meta tag verifies ownership for search tools; the tag itself is not a Google Analytics script." ], "links": [ { "label": "Cookie Policy and controls", "href": "/legal/cookies" } ] }, { "title": "Where information comes from", "paragraphs": [ "We receive information from you and your browser, the organization that gives you workspace access, and the payment, advertising or other accounts that an authorized user connects. Hosting providers supply technical request information used for delivery, security and approximate location. We derive reports and attribution results from the records received.", "For visitor and buyer records controlled by a customer, that customer supplies or authorizes the information and must explain its own collection and use. A customer payment integration can provide information even when the browser tracker has not identified a visitor." ] }, { "title": "Agreement and choice evidence", "paragraphs": [ "We record authenticated agreement acceptances with the verified account/email, a signer’s name for business agreements, legal customer details where provided, document version and digest, acceptance wording and server timestamp. Transfer-review requests can contain the customer's address, role and requested jurisdictions. A necessary, signed browser cookie holds a signup terms choice for up to 30 minutes while account verification finishes. It contains an email hash for email sign-in, document reference and random receipt reference, not a plain email or analytics identifier. A choice alone is not an authenticated acceptance. These records support contractual administration, accountability, rights assistance and legal claims; access is limited to the relevant account/workspace owners and authorized staff. They are reviewed at least annually and retained while needed for the relationship and applicable legal obligations or claims, rather than being silently backdated or treated as analytics consent.", "A separate necessary consent-choice receipt records the analytics decision, notice version and digest, server time and a reference to the preceding receipt when available. Its random cookie is used only to retrieve and manage this browser's choice evidence, not for analytics or account/payment matching. Receipt records contain no IP address, browser user-agent, page path, email or analytics visitor ID. Choice cookies expire after 180 days; receipt evidence is removed after one year by the privacy job. Infrastructure still processes requests. Download the current receipt through Cookie settings or contact privacy support about its reference." ], "links": [ { "label": "Cookie settings and choice evidence", "href": "/legal/cookies" } ] }, { "title": "Cookieless daily visitor estimates", "paragraphs": [ "A customer can keep cookieless collection limited to daily pageview totals or explicitly enable daily visitor estimates and publish the matching script option. Estimates use a temporary server-side signature computed from the request IP address, browser user-agent, website ID and a random daily secret. This does not set an analytics cookie or use browser storage. Raw IP and user-agent values are not stored as analytics fields by this feature; infrastructure still processes network requests.", "These signatures estimate distinct requests within one UTC day. Shared networks can merge visitors and changed IP/browser information can split them. They do not establish anonymity, identify returning people across days or match traffic to payments. Prior-day signatures and keys are removed by the hourly privacy job, with bounded batches for signatures; failed or backlogged cleanup requires attention. Aggregate daily totals and protected backups have separate retention handling." ], "links": [ { "label": "Set up daily cookieless visitor estimates", "href": "/docs/cookieless-visitors" } ] }, { "title": "Information needed to use the service", "paragraphs": [ "A sign-in email address is needed to send your code and provide account access. A website address and relevant configuration are needed to set up that website's reports. If you do not provide the information needed for a requested feature, we cannot provide that feature. A support request needs a reply address and enough information to understand the request; do not include passwords or unnecessary customer records.", "You can browse the public website, read help and use the support form after rejecting optional analytics. Connecting a payment or advertising account is optional, but reports that depend on that connection will not contain its records until an authorized connection is made." ] }, { "title": "Why we use information", "table": { "headers": [ "Purpose", "Information involved" ], "rows": [ [ "Provide accounts and reports", "Account details, events, authorized payment and campaign records" ], [ "Take payment for Attriboo", "Polar billing and subscription references" ], [ "Send service messages", "Recipient address and message or delivery information through Resend" ], [ "Answer requests", "Form details and correspondence" ], [ "Protect the service", "Access, technical, abuse, and security information" ], [ "Measure our own website with permission", "Optional Attriboo visit data" ], [ "Meet legal duties", "Records necessary for accounting, disputes, and lawful requests" ] ] }, "paragraphs": [ "We do not use customer analytics records to train a general-purpose AI model. If you connect an external AI assistant, its authorized requests and handling of results are governed by your permissions and that provider's terms. We do not claim to read people's private AI conversations." ] }, { "title": "Legal bases where required", "paragraphs": [ "Where European or UK data protection law applies to our controller activities, we rely on contract or steps you request before a contract for providing an account and purchased service; legal obligations for required records; legitimate interests for proportionate security, fraud prevention, support, and administration; and consent for optional tracking or marketing where required. You may object to legitimate-interest processing, and you may withdraw consent without affecting earlier lawful processing.", "For customer-controlled analytics data, the customer determines the lawful basis and any required notices and consents. We act on its documented instructions. A privacy policy does not replace a required consent choice." ] }, { "title": "Object to legitimate-interest processing", "paragraphs": [ "You can object to processing based on our legitimate interests through the privacy request form. Identify the processing you are concerned about so we can review its scope. We will assess your objection under the law that applies and explain the result, including any lawful reason for continuing.", "To withdraw optional analytics permission, use Cookie settings. You do not need to submit an objection or explain a reason to reject optional analytics." ], "links": [ { "label": "Submit an objection about personal data processing", "href": "/support?topic=privacy" } ] }, { "title": "Who receives information", "paragraphs": [ "We use service providers for hosting, databases and authentication, payment processing, and email delivery. The list below explains their functions. We share only what is appropriate for those functions. Polar and connected payment providers may act as their own controllers for payment, fraud prevention, and legal activities as described in their policies.", "Authorized people in your workspace can access records according to their permissions. We may disclose information when lawfully required, to protect rights and security, to professional advisers under confidentiality, or as part of a genuine business transfer with appropriate safeguards and notice where required. We do not sell personal information or share it for cross-context behavioral advertising." ], "links": [ { "label": "Subprocessors and Service Providers", "href": "/legal/subprocessors" }, { "label": "Polar Privacy Policy", "href": "https://polar.sh/legal/privacy" }, { "label": "Stripe Privacy Policy", "href": "https://stripe.com/privacy" }, { "label": "Resend Privacy Policy", "href": "https://resend.com/legal/privacy-policy" } ] }, { "title": "International processing", "paragraphs": [ "We are a United States business. Our primary Supabase database is configured in US East (Northern Virginia), us-east-1, as checked on October 31, 2026. Information may also be processed in other places where our hosting, delivery, authentication, email and infrastructure providers operate. Privacy rules can differ between countries. Where law requires a transfer safeguard, the relevant processing must be covered by an applicable adequacy decision, valid standard contractual clauses and required supplements, or another lawful mechanism. Contact support to request the safeguards relevant to your service configuration; this policy does not claim that publication alone establishes them." ] }, { "title": "How long information is kept", "paragraphs": [ "We keep account and customer records while needed to provide the service and for the purposes described here, subject to your configuration, instructions, and applicable law. Website admins can preview and confirm an analytics retention period in Privacy & data. Automatic cleanup is off until enabled, and a new period has a seven-day review interval before cleanup begins. A reporting window is not a promise that older stored data has automatically been erased.", "We keep billing, dispute, security, and support information only for the legitimate purpose and any legal retention duty that applies. When data is no longer needed, it should be deleted or de-identified. Backup copies can persist until their normal replacement cycle and must remain protected. Use Privacy & data for verified subject exports and erasure, or use the privacy form for assistance and account-specific retention details. We keep protected keyed fingerprints of erased identifiers to prevent known data being reimported. Privacy-request contents are stored encrypted. Separate abuse-control logs can include the sender address and technical metadata and are kept for 30 days. Completed privacy-request payloads are removed by the scheduled privacy job; minimal completion receipts and privacy audit records are kept for one year.", "The Cookie Policy identifies browser-storage lifetimes, including the distinction between an expiring cookie and local storage that remains until removed." ] }, { "title": "Your privacy choices and rights", "bullets": [ "Reject optional analytics or change your choice using Cookie settings. Global Privacy Control and Do Not Track signals disable optional analytics in our own-site consent controls.", "Depending on applicable law, request access, a copy, correction, deletion, restriction, or portability of your information; object to certain uses; withdraw consent; or appeal a denied request.", "If you are an authorized agent, explain your authority in the request. We may ask for proportionate verification, but do not send identity documents, account passwords, or payment credentials in the initial message.", "We do not discriminate for exercising applicable privacy rights. We respond within the period required by the law that applies and explain permitted extensions or refusals.", "You may complain to your competent privacy regulator. In the UK, you can contact the Information Commissioner's Office. In the EEA, you can contact the relevant national data protection authority, including where you live, work or believe an infringement occurred. A support request does not prevent a complaint. If you believe a request was wrongly denied, submit an appeal through the same form and identify the earlier reference." ], "links": [ { "label": "Submit a privacy request or appeal", "href": "/support?topic=privacy" }, { "label": "Contact the UK Information Commissioner's Office", "href": "https://ico.org.uk/make-a-complaint/" }, { "label": "Find an EEA data protection authority", "href": "https://www.edpb.europa.eu/about-edpb/our-members_en" } ] }, { "title": "US state privacy disclosures", "paragraphs": [ "Where an applicable US state privacy law covers our processing, the categories described above include identifiers, contact and account information, commercial/payment references, internet or electronic activity, approximate location, support content, and report-derived information. The sources are you, your browser, your organization, authorized integrations, and our service providers. Purposes and recipient categories are described above.", "We do not sell personal information or share it for targeted cross-context advertising, and we do not use this service to make legally significant automated decisions about people. We do not ask customers to send sensitive personal information for these reports. Applicable access, correction, deletion, opt-out, and appeal requests can be made through the privacy form." ] }, { "title": "Children and security", "paragraphs": [ "Attriboo is a business service for adults and is not directed to children. We do not knowingly solicit children's information for our own accounts or marketing. Do not use the service to track children contrary to law. If you believe such data was submitted, contact support for investigation.", "We use access controls and technical and organizational safeguards appropriate to the service, including controls supplied by our hosting and database providers. No online service can guarantee absolute security. Report suspected exposure through the Security topic on the support form; do not post credentials or exploit details publicly." ] }, { "title": "Changes and contact", "paragraphs": [ "We update this policy when practices change and give additional notice where required for a material change. Contact SEO RANK SERP LLC at the postal address above or through the support form." ], "links": [ { "label": "Contact us about privacy", "href": "/support?topic=privacy" } ] } ] } }