Privacy policy

Attruly sits in two different positions depending on whose data is involved, and the rules differ:

• You, our customer. When you create an account, we are the controller of your account data — your name, email, organisation and billing details. Sections 2 to 5 cover this.
• Visitors to your website. When Attruly records events from a site you operate, you are the controller and we are your processor. You decide what is collected and why; we process it on your instructions. Sections 6 to 10 cover this.

• Contract. We cannot provide an account without an email address and a password.
• Legitimate interests. Securing the service, preventing abuse, and understanding which of our own marketing channels work. We have balanced these against your interests and consider the processing proportionate.
• Legal obligation. Retaining invoices and tax records.
• Consent. Product announcement emails, which you can decline at signup and unsubscribe from at any time. Transactional emails — verification, password reset, quota warnings, billing failures — are not marketing and continue regardless.

You can access, correct, export, restrict or delete your account data. Most of it is editable directly in settings; deletion of the whole organisation is a button in the danger zone.

For anything not available in the product, email privacy@attruly.com. We respond within 30 days. If you are in the EU or UK and are not satisfied with our response, you may complain to your local supervisory authority.

The signed-in application sets only the cookies the product needs to work. There is no advertising network anywhere on this domain, and we do not sell or share what we collect.

The public marketing pages — everything outside the signed-in application — also load Google Analytics, so we can see which pages bring people to a signup. It is deliberately not loaded once you are signed in: those URLs contain your organisation, project and profile identifiers, and we are not sending those to Google.

When a website operator installs Attruly, the following is recorded about each visit. The operator chooses what else to send through custom events and traits.

What is never recorded: no cross-site tracking, no device fingerprinting, no advertising identifiers, no third-party cookies, and no data sharing between the projects of different customers. A visitor id from one Attruly customer's site is meaningless on another's.

A visitor's IP address reaches our servers because it is part of every HTTP request. We use it to resolve an approximate country and to apply the site operator's own exclusion list, and then we discard it — the IP is not written to the visit record. Country is stored; the address itself is not.

Where we act as your processor, we commit to the following, and these terms form part of the agreement between us:

• We process visitor data only on your documented instructions, which are the settings you configure and the events you send.
• Everyone with access is under a duty of confidentiality.
• We apply the security measures described in section 9.
• We use only the sub-processors listed in section 10, and will tell you before adding another.
• We assist you with data subject requests, with security incidents, and with impact assessments, to the extent our position makes that possible.
• On termination we delete your data as described in section 11.
• We make available the information needed to demonstrate compliance, and allow audits on reasonable notice.

Enterprise customers who need a signed data processing agreement on their own paper should contact legal@attruly.com.

• All traffic is encrypted in transit with TLS 1.3. Data at rest is encrypted at the disk level.
• Passwords are hashed with a memory-hard function. Session tokens are random, httpOnly, sameSite and, in production, secure.
• API keys are stored as SHA-256 digests. The plaintext is shown once at creation and is not recoverable afterwards.
• Every query in the product is scoped to an organisation at the database level, and access is proved before a project is read rather than checked afterwards.
• Backups are encrypted and tested by restore.
• Access to production is limited to named individuals, requires multi-factor authentication, and is logged.
• We will notify you without undue delay, and within 72 hours, of a breach affecting your data.

Transfers outside the EEA and UK rely on the Standard Contractual Clauses, or on an adequacy decision where one applies.

• Raw events and visits are kept for the retention window of the plan the organisation is on, between 30 days and 24 months. A nightly job prunes anything older.
• Aggregated daily statistics are kept for the life of the project. They contain no identifier of any individual.
• Deleting an organisation removes its events, profiles, projects and keys within 30 days.
• Backups age out within 90 days, after which deleted data is unrecoverable.
• Invoices and tax records are kept for as long as tax law requires, regardless of account deletion.

We will email the account owner at least 30 days before a change that materially affects how we handle personal data. Other changes take effect when published, and the effective date at the top of this page always reflects the current version. See also our terms of service.

Privacy questions, data subject requests and anything else covered here: privacy@attruly.com. Security reports: security@attruly.com.