Privacy Policy

This Policy explains what we do with personal data. It is a notice, not a contract: where we rely on your consent for a specific purpose, we ask for that consent separately and you can withdraw it at any time.

1. Introduction

Attribyte App Inc. ("Attribyte", "we", "us" or "our") respects your privacy. This Privacy Policy explains how we collect, use and share information when you use our platform (the "Platform") or our website, or when you interact with a brand that uses the Platform. Capitalized terms not defined here have the meaning given in our Brand Terms of Service and Creator Terms of Service. Contact details are in Section 17.

2. Eligibility

The Platform is intended only for users who are 18 or older.

3. Our Role

Attribyte's role under data protection law depends on the context.

3.1 Controller

We are the controller for user account information, creator profile and media card data, billing and payout records, fraud-prevention data, communications, and information about how individuals interact with the Platform itself.

3.2 Joint Controller for Storefront Attribution

When a shopper clicks a tracking link and visits a Brand's storefront that has installed the Attribyte web pixel, attribution data is generated that both we and the Brand use: the Brand to run and evaluate its creator program, and we to calculate Earnings and fees, prevent fraud and maintain platform integrity. For that data we and the Brand are joint controllers under Article 26 GDPR.

Our Data Processing Agreement contains the arrangement between us. In summary:

• the Brand is responsible for providing notice to shoppers on its storefront and for collecting any consent required for the attribution identifier;
• we are responsible for the security of the attribution data, for honoring shopper rights requests that reach us, and for limiting the data to what attribution requires; and
• shoppers may exercise their rights against either of us.

3.3 Processor

We are the processor where we handle personal data solely on a Brand's instructions and for the Brand's own purposes, for example order, product and customer identifiers passed through a commerce integration and shown back to the Brand in its own reporting. Our Data Processing Agreement governs that processing and forms part of our Brand Terms of Service.

4. Information We Collect

4.1 Information You Provide

• Identity and contact information (name, email address, phone number, address)
• Account credentials
• Business registration information (organization name, registration number, billing address) for Brands
• Demographic information you choose to share (year of birth, gender)
• Profile and media card information (display name, city, profile photo, information about your work)
• Tax and payment information required for payouts (tax identification numbers, payment account details). Full card details and identity documents are handled by our payment processor and not stored by us. Where our payment processor requires it, we collect your Norwegian national identity number (fødselsnummer or D-number). We store it encrypted and use and share it only with the payment processor or as the law requires
• Shipping details (name, shipping address and phone number) when you receive a product sample in a Program (Section 8.1)
• Communication content (messages, support requests, feedback)
• Submitted creative content (videos, images, captions) and Portfolio Content you upload to your media card
• Videos you upload for AI Insights (Section 4.6)

4.2 Information Collected Automatically

• Device and technical information (IP address, browser type, operating system, device identifiers)
• Usage data (pages visited, features used, click events, session duration)
• Push notification device token: if you allow notifications in our iOS app, we store a device token and send notifications through Apple Push Notification service
• Cookies and similar technologies (see Section 12 and our Cookie Policy)

4.3 Information from Connected Services

When you connect a third-party service (commerce platforms, advertising platforms, social media platforms, payment processors) we receive information through its official API within the permissions you grant. We do not access information beyond what the connected functionality requires. You may revoke any integration at any time. Where a Creator connects a social account to their media card, the information retrieved is published on that media card (Section 6).

Sign in with Google or Apple. If you sign in with Google or Apple, we receive your name, email address and an account identifier from that provider.

Connected social accounts. When a Creator connects an Instagram or TikTok account, we receive profile information (username, name, profile picture, account type), follower and following counts, post metrics (views, likes, comments, shares) and aggregated audience demographics (age, gender, country). Snapchat information is added manually by the Creator. Where a Creator joins a Program with an organic views rule, we use the views on the Creator's posts to calculate Earnings under that rule.

4.4 Attribution and Tracking Data

When shoppers click tracking links and visit storefronts connected to the Platform, we collect attribution data: the attribution identifier and tracking id, visitor id, device information, user agent, IP address and country, page URL and referrer, and interaction events (clicks, page views, order identifiers, order values and similar funnel events). The IP address is stored only as a one-way hash, never in plain text.

On sites that use our Universal Pixel, we also record lead events (for example sign-ups, bookings or form submissions) from visitors carrying Tracking Parameters. We do not store contact details from lead events in plain text.

Where an order carries no Tracking Parameters, we may also attribute it using supplementary signals: matching the one-way hash of the buyer's IP address against a recorded click on the Creator's tracking link for the same Brand shortly before the order, and UTM and ad identifiers in the commerce platform's customer journey data that map to ads using the Creator's content.

This data does not directly identify individuals by name, email or address, but it may constitute personal data under applicable law when combined with device identifiers or tracking ids. We do not store shopper names, postal addresses, phone numbers or payment details. Where an order includes an email address, we may store it only as a keyed one-way hash, used to match refunds and prevent fraud, never in plain text. Shopper personal data remains under the Brand's control on its commerce platform.

Where a Brand sends conversion events from its own systems, those may include a hashed identifier derived from an email address or phone number. We never store the plain value.

4.5 Content Similarity Detection

To enforce payment obligations and protect creators, we may use automated methods to compare content files against creative content submitted through the Platform to identify substantially similar material, including altered, re-encoded or screen-recorded copies, or copies published without Tracking Parameters or through an account that is not a Connected Ad Account. This is not used to identify a natural person.

4.6 AI Processing

As part of the Platform, we use automated tools, including AI models provided by third parties, to:

• transcribe submitted Creator Content, which is shown to the Brand when it reviews the submission;
• analyze and tag approved Creator Content (for example format, structure and on-screen elements) to provide analytics in the Platform; and
• give Creators feedback on videos they upload for that purpose before submitting (AI Insights). This feedback is informational only.

This processing is part of the service and cannot be turned off. The providers process content on our behalf under contract and are listed on our Sub-processor List. AI Insights uploads and the resulting insights are deleted 30 days after upload unless the video is submitted to a Brand.

5. How We Use Information

We use information to:

• operate, maintain and improve the Platform
• authenticate users and prevent fraud
• process payments and payouts
• provide attribution, analytics and reporting to users
• calculate Earnings and fees, and support billing and dispute resolution
• transcribe, analyze and tag Creator Content and provide AI Insights (Section 4.6)
• publish creator media cards (Section 6)
• evaluate preferences and suggest relevant opportunities on the Platform
• let Brands ship product samples to Creators (Section 8.1)
• communicate with you about your account and the Platform, including push notifications if you allow them
• provide customer support
• comply with legal obligations and enforce our terms

Some of this involves profiling within the meaning of applicable data protection law, based on information you provide and your activity on the Platform. We do not make decisions producing legal or similarly significant effects on you based solely on automated processing. Decisions that affect payment, for example withholding a payout on suspicion of fraud, involve human review.

6. Creator Media Cards (Public Information)

A creator media card is a public web page and is part of the Platform: it is enabled when you create a creator account. The information on it is published to the open internet, accessible to anyone with the link, and may be indexed, crawled, cached or copied by search engines and other third parties.

6.1 What Is Published

Published by default. Your display name, your city, your verified sales figure and any Portfolio Content you upload. Location is shown at city level only. We do not publish your full address, email, phone number or payment details. Any other information is published on your media card only if you turn it on.

Not published. No brand is identified on a media card, and no per-brand figure, commission rate, order data or shopper data is shown. Your verified sales figure is presented as your own aggregate performance.

Connected social accounts. Instagram and TikTok connections and Snapchat information are off by default. If you enable one, the profile information and metrics retrieved through it (or, for Snapchat, added by you) are published on your media card for as long as it is enabled. You can disconnect at any time; we then stop retrieving new data and remove the retrieved data from the card.

6.2 Legal Basis and Control

We publish the media card as part of providing the Platform, on the basis of our contract with you and our legitimate interest in letting brands find and evaluate creators. You control what it shows and can disable it at any time in your account settings. Data from connected social accounts is published on the basis of your consent, which you give by enabling the connection and withdraw by disconnecting it.

6.3 Limits on Removal

Disabling your media card makes the page inaccessible and removes it from future indexing. We cannot remove copies, caches, screenshots or search engine records that third parties made while the page was public. Consider this before adding information to your media card.

7. Legal Bases for Processing (EEA, UK, Switzerland)

Purpose	Legal basis
Providing your account and the Platform, including your media card	Performance of a contract; legitimate interests
Processing payments and payouts	Performance of a contract; legal obligation
Attribution, fee calculation and billing	Performance of a contract; legitimate interests
Storefront attribution data (joint controller)	Legitimate interests in measuring and paying for creator-driven sales; consent for the attribution identifier where applicable law requires it, which the Brand is responsible for collecting on its storefront
Fraud prevention, security and platform integrity	Legitimate interests
Content similarity detection	Legitimate interests in enforcing payment obligations and protecting creators
AI processing of Creator Content (transcription, tagging and analytics, AI Insights)	Performance of a contract; legitimate interests
Sharing shipping details with a Brand for a product sample	Performance of a contract
Publishing connected social account data on your media card	Consent
Analytics cookies	Consent
Measuring our own advertising	Legitimate interests
Marketing communications	Consent
Using a Brand's name or logo in our marketing	Legitimate interests, subject to the Brand's right to opt out
Using a Creator's name, handle or image in our marketing	Consent, requested separately
Tax records and regulatory reporting	Legal obligation

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You may object at any time (Section 13). You may withdraw consent at any time without affecting the lawfulness of prior processing.

8. How We Share Information

8.1 With Other Platform Users

Brands can see the Creators they work with and Creator activity relevant to their Programs. Creators can see Brand information and the attribution context relevant to them. A Brand receives attribution and conversion data for its own store. A Brand never receives a Creator's bank details.

Product samples. A Brand may offer product samples in a Program. When a sample is sent, we share the Creator's name, shipping address and phone number with the Brand, and pass them to its commerce store, so it can ship the sample. The Brand may use these details only to ship the sample.

Brands' own tools. Brands may access the Platform data they are entitled to through their own tools, including AI assistants connected through an API or MCP connection. Those tools and their providers are the Brand's responsibility.

8.2 Publicly

Media card information is published publicly as described in Section 6. Separately, unless a Brand opts out, we may use its name, logo and non-confidential Program information in our marketing and case studies. We use a Creator's name, handle or image in our marketing only with the Creator's separate permission. Performance metrics are used only in anonymized or aggregated form. To opt out or withdraw permission, email legal@attribyte.app.

8.3 With Service Providers

We share information with vendors who provide hosting, content delivery and network security, payment processing, identity verification, AI transcription and analysis, email, analytics, monitoring and support on our behalf. They are contractually obligated to protect your information and may use it only to provide the service. The current list of these providers, what each does and where each is established is published on our Sub-processor List.

8.4 With Connected Services

Where you authorize an integration, we exchange data with that service as needed to provide the connected functionality.

8.5 For Legal Reasons

We may disclose information if required by law, court order or governmental request, or where we believe disclosure is necessary to protect rights, property or safety, or to investigate or prevent fraud or illegal activity.

8.6 Business Transfers

If Attribyte is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction and will remain subject to this Policy.

8.7 No Sale

We do not sell personal information.

9. International Data Transfers

Attribyte is a United States company. Personal data is hosted on Amazon Web Services in Stockholm, Sweden, inside the European Economic Area. Our staff and some of our service providers access or process personal data from the United States and other countries.

For transfers from the EEA, UK or Switzerland we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework. You may request information about these safeguards at legal@attribyte.app.

10. Data Retention

We keep personal data only as long as needed for the purposes in this Policy, to comply with legal obligations, to resolve disputes and to enforce our agreements.

Information	Retained for
Account and profile information	While the account is active, then 90 days after closure, after which it is deleted or anonymized
Identity verification data	Held by our payment processor under its own retention rules. We store only the verification status and the processor's reference
Media card content and Portfolio Content	While the media card is enabled and the item is on it. Removed from public access immediately on disable or deletion; deleted from our systems within 30 days, subject to the third-party copy limits in Section 6
Data from connected social accounts	Removed from the media card on disconnect; deleted within 7 days
Submitted Creator Content	While the Brand that accepted it holds a license to it, including after the Creator closes their account. Non-accepted content is deleted 90 days after withdrawal, rejection or account closure
AI Insights uploads and insights	30 days after upload, unless the video is submitted to a Brand
Messages and Program-related communications	While either party's account is active, then 90 days
Raw store webhook payloads (orders, refunds)	30 days, then reduced to the parsed attribution record
Clicks and funnel events	90 days from the event, then deleted. Attribution records tied to an Earning are retained with the transaction record below; the hashed email address is removed after 90 days
Ad platform data imported through a connected advertising account	Until the connection is removed, which deletes the imported data within 30 days, or until deleted through the platform's own deletion process (Section 14.2)
Earnings, charges, payout statements, invoices and tax records	7 years from the end of the financial year, as required by tax and financial reporting law. Personal details not required for the record are removed when the account is closed
Support requests	24 months after closure of the request
Security, access and error logs	90 days
Terms acceptance records	For the life of the account plus the applicable limitation period
Aggregated or anonymized data	Indefinitely

When a Brand uninstalls our commerce integration, the store's redaction process starts and we delete the store's order, customer identifier and pixel data as described in Section 14.1. Billing and Earnings records for that Brand are kept as above.

11. Security

We implement administrative, technical and physical safeguards designed to protect personal information, described in Annex B of our Data Processing Agreement. No method of transmission or storage is fully secure. If you suspect unauthorized access or want to report a vulnerability, contact legal@attribyte.app.

12. Cookies and Tracking Technologies

We use cookies and similar technologies for essential Platform functionality, security, analytics and advertising measurement:

• Strictly necessary: authentication, session management and security
• Functional: remembering your preferences and settings
• Analytics: Google Analytics, which loads only after you accept analytics cookies
• Advertising measurement: the Snapchat Pixel on our public marketing pages, which measures the performance of our own advertising
• Attribution: identifiers on storefronts and sites that use our Shopify integration or Universal Pixel, identifying which creator link led to a purchase or lead. The Brand, as operator of the site, is responsible for collecting consent where applicable law requires it

Our Cookie Policy lists each technology, its purpose and expiry. You can manage preferences through the cookie banner or your browser settings.

13. Your Rights

13.1 Rights You May Have

Depending on your location, you may have the right to:

• Access: request a copy of the information we hold about you
• Correction: request correction of inaccurate information
• Deletion: request deletion, subject to legal retention requirements
• Portability: request a copy of your information in a portable format
• Objection and restriction: object to or restrict processing based on legitimate interests
• Withdraw consent: where processing is based on consent

EEA, UK and Swiss residents also have the right to lodge a complaint with their local data protection authority.

13.2 Shoppers

These rights also apply to shoppers whose attribution data we hold under Section 4.4, even though they do not have an Attribyte account. Shoppers may contact us directly or the Brand whose storefront they visited.

13.3 How to Exercise Your Rights

Where your account settings offer data export or account deletion, you can use them directly. For anything else, email legal@attribyte.app. We may verify your identity first and we respond within the timeframes required by law. Disconnecting an integration stops new data from it but is not a deletion request.

14. Third-Party Services

The Platform integrates with third-party services. This Policy does not apply to them. Review their privacy policies before connecting them.

14.1 Shopify Merchants

If you install the Attribyte app on your Shopify store:

• We access store data only to provide the Platform. The app installs a Web Pixel for attribution and subscribes to order, refund and app-lifecycle webhooks.
• We do not store buyer names, phone numbers, shipping addresses or payment details. Where an order includes an email address, we store it only as a keyed one-way hash (Section 4.4). We store order identifiers, order values, line-item product identifiers and the Shopify customer identifier needed to reverse an Earning on refund.
• We respond to Shopify's mandatory privacy webhooks. A customers/data_request is answered to you within 30 days; a customers/redact deletes the attribution rows keyed to that customer; a shop/redact deletes the store's data 48 hours after uninstall.
• Uninstalling the app starts that redaction process. It does not delete your Attribyte account, your Earnings and billing records, or your obligations under the Brand Terms of Service.
• The Data Processing Agreement and the Sub-processor List apply to store data we process for you.

14.2 Connected Advertising and Social Accounts

When you connect a Meta, TikTok or Snapchat advertising account (as a Brand) or a social profile (as a Creator), we receive data through that platform's official API within the permissions you grant, and we apply Tracking Parameters to advertisements published through that account. We do not use the connection for any purpose other than the functionality you enabled.

You can revoke a connection at any time in your account settings or in the platform's own app settings. Revoking stops new data from that connection and we delete the imported data within 30 days.

Meta. If you remove Attribyte in your Facebook or Instagram settings and send a data deletion request through Meta, we delete the data imported through your connection and show the result at attribyte.app/legal/deletion-status using the confirmation code Meta gives you.

Each platform processes data under its own privacy policy, which applies in addition to this one.

15. Children's Privacy

The Platform is not intended for anyone under 18. We do not knowingly collect information from anyone under 18. Tell us if you believe a child has provided us personal data and we will delete it.

16. Changes to This Privacy Policy

We may update this Policy from time to time. Material changes will be notified by email or by a prominent notice on the Platform. The date at the top reflects the latest version. Previous versions are available on request.

17. Contact Us

Attribyte App Inc.
28 Geary St STE 650, #599
San Francisco, CA 94108
United States

Privacy requests, legal notices and security reports: legal@attribyte.app
General support: support@attribyte.app