Understand how your data is handled
Review the controls and documents relevant to your website before installing tracking or connecting payment records.
Tracking choices
The standard tracker uses a persistent first-party browser identifier. New installation code waits for an explicit analytics-permission callback by default. Automatic form-email capture is off unless enabled. You can instead choose cookieless daily pageview totals, which use no browser storage or visitor identifiers and cannot link visits to individual payments. Your website remains responsible for its notices, lawful basis and required choices.
Set up and test consent · Review the collected data · Understand browser storage and measurement modes
Access and credentials
Accounts use authenticated workspace access. Website permissions and database access rules limit which reports people can read and manage. Integration credentials are handled on the server, with supported integration secrets stored in Supabase Vault. API keys and authorized AI connections can expose report data; give access only to people and tools you trust.
Review website and team permissions · Understand AI-assistant access
Retention, exports and erasure
Website admins can preview matched visitor records, download a complete paginated export and confirm erasure in Settings → Privacy & data. Erasure affects reports and imported payments in Attriboo. Protected fingerprints of known identifiers prevent erased records being restored by later imports or webhook retries.
Automatic analytics cleanup is off until an admin selects and confirms a retention period. A new period has a seven-day review interval before cleanup starts. Provider records, backups, downloaded files and privacy-operation records have separate handling. Completed privacy-request payloads are removed by the scheduled privacy job; minimal completion receipts and privacy audit entries are retained for one year.
Follow the privacy checklist and request process · Request assistance
Providers, locations and transfers
Attriboo is operated by SEO RANK SERP LLC, a United States business. Core services include Vercel, Supabase, Polar for Attriboo subscription billing and Resend for service email. Other services depend on the integrations you authorize.
The primary Supabase database is configured in US East (Northern Virginia), us-east-1, as checked on October 31, 2026. This does not locate every hosting, delivery, log or backup record. International-transfer safeguards must be checked for the actual service configuration. Ask for the relevant documents before relying on a regional or contractual requirement. This page does not promise EU-only hosting or establish executed transfer clauses.
Review providers and their functions · Read the Data Processing Addendum
Security reviews and incident reports
Send security concerns through the security support topic. For a vendor review, request the access, infrastructure, backup, incident-response and transfer evidence relevant to your account. Attriboo does not claim SOC 2, ISO 27001, an independent security audit or a recovery guarantee here.
Report a security concern · Read the Privacy Policy · Read the service terms