Privacy Policy
Last updated: September 25, 2026
This policy describes the data Attriloop currently handles. It is not a promise that every optional feature or data category is always used.
1. Who does what
Attriloop is responsible for account, website, security, and support data. For data sent through a customer’s app, SDK, links, or integrations, the customer normally decides why the data is used and Attriloop processes it on the customer’s instructions.
2. Data
Depending on the features used, Attriloop may handle:
- account data, such as name, email, organization, role, session, and support information;
- link and request data, such as link, campaign, click, destination, timestamp, IP address, user agent, platform, language, and coarse location;
- app and attribution data, such as app ID, Attriloop ID, device and operating-system information, install referrer, event, revenue, and attribution fields; and
- identifiers or matching fields supplied by a customer only when that customer enables and configures a supported use.
Attriloop does not collect IDFA or GAID by default. On iOS, Attriloop does not use fingerprint matching. On Android, limited coarse signals may be retained briefly to explain why a deterministic match was unavailable, but they do not assign individual attribution.
3. Purposes and bases
Attriloop uses data to provide and administer the service, route links, produce attribution and reports, process payments, secure accounts, prevent abuse, communicate with users, and comply with law.
For data Attriloop controls, the legal basis may be contract, legitimate interests, legal obligation, or consent, depending on the context. Customers are responsible for the legal basis and notices for end-user data they send.
4. Recipients and transfers
Attriloop uses service providers listed on the Subprocessors section. Data may also be sent to an integration selected by the customer or disclosed where required by law.
Providers may process data in different countries. Where transfer rules apply, the transfer is handled using the mechanism required by applicable law.
5. Retention
Data is kept while needed for the service, the account, security, dispute handling, or legal obligations. The period depends on the data and configuration. Data may remain temporarily in backups and logs until their normal replacement or expiry.
6. Your choices
Account users may ask about access, correction, deletion, restriction, objection, portability, or withdrawal of consent where applicable. End users of a customer’s app should contact that customer first because the customer controls that data.
You may also complain to the data-protection authority that applies to you. Rights and exceptions depend on applicable law.
7. Security and changes
Current security information is available on the Security section. No internet service is completely secure. Attriloop may update this policy when the service or legal requirements change; the date above identifies the current version.
Subprocessors
This section lists providers Attriloop may use to operate the service. An optional provider is used only when the related feature or deployment configuration is enabled.
Customer-selected destinations
If a customer enables an integration, Attriloop may send configured data to that destination on the customer’s instructions. A current example is RevenueCat. That provider may act under its own terms for some processing.
Locations and changes
Provider locations and service regions depend on the customer, feature, and deployment configuration. Their own infrastructure and legal terms may also change.
Attriloop may update this list when a provider or use changes. The date above identifies the current public list.
Security overview
This is a short description of current practices, not a certification, audit report, warranty, or promise that incidents cannot happen.
Current approach
- HTTPS is used for public web and API traffic in configured production environments.
- Account roles and scoped API keys limit access to customer functions and data.
- Sensitive integration credentials are stored in encrypted form where supported by the service configuration.
- Rate limits, signed webhook checks, input validation, tenant-scoped queries, and audit records are used in relevant parts of the service.
- Infrastructure is operated using the providers listed on the Subprocessors section.
Customer responsibilities
Customers should protect account and API credentials, grant only necessary access, keep SDKs and integrations current, send only needed data, and report suspected exposure. Server-side and data-operations keys must not be embedded in public apps.
Scope
Security controls vary by feature, environment, and provider configuration. Attriloop does not claim a security certification or compliance attestation unless it is expressly identified in a separate current document.