Privacy Policy

AttribIQ is an EU-hosted revenue analytics service operated by DNScale OÜ (registry code: 16776331), located at Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia ("we", "us", "our").

We are committed to protecting your privacy and handling personal data in accordance with the General Data Protection Regulation (GDPR), applicable Estonian law, and other applicable EU data protection laws. This Privacy Policy explains how we collect, use, store, and protect information when you use AttribIQ.

We collect account, billing, technical, and service data needed to provide AttribIQ:

• Name, email address, company information, account credentials, authentication tokens, and team membership details.
• Billing, subscription, invoice, VAT, and payment status information.
• Website and product analytics events, including pageviews, sessions, referrers, UTM parameters, goals, funnels, device/browser data, country-level location data, custom event names, and customer-provided event properties.
• Revenue attribution data received from Stripe webhooks or the generic Payment API, including payment event type, amount, currency, customer ID hashes, subscription/order identifiers, and metadata configured by the customer.
• IP addresses and network information for security, abuse prevention, rate limiting, and transient country-level location enrichment. Raw IP addresses are not stored in analytics event rows by default.
• API usage logs, audit events, error reports, performance metrics, and support communications.
• Optional first-party visitor or session identifiers when a customer enables first-party accuracy mode.

We process personal data under the following GDPR legal bases:

• Contract: processing necessary to provide AttribIQ accounts, dashboards, APIs, billing, and support.
• Legitimate interest: processing necessary for security, abuse prevention, service reliability, product improvement, and fraud prevention.
• Consent: processing based on explicit consent, such as optional marketing communications or customer-enabled tracking modes where consent is required.
• Legal obligation: processing required to comply with tax, accounting, corporate, and legal requirements.

For analytics and revenue data that customers send to AttribIQ about their own end users, the customer is normally the data controller and AttribIQ acts as a data processor.

• Provide and operate cookieless analytics, optional first-party accuracy mode, revenue attribution, dashboards, APIs, reports, funnels, goals, and exports.
• Ingest, normalize, and attribute payment and subscription events from Stripe and compatible payment systems.
• Process billing, subscriptions, invoices, tax records, and account administration.
• Send service-related communications, security notices, account updates, and support responses.
• Monitor performance, debug errors, prevent abuse, enforce limits, and protect the service.
• Improve AttribIQ and develop new reporting, attribution, and workflow features.
• Comply with legal obligations and respond to lawful requests.

We do not sell personal data. We share information only when needed to operate the service or when legally required:

• Service providers that help us operate infrastructure, storage, databases, payments, billing, email, monitoring, support, and security.
• Legal, regulatory, court, or government authorities when disclosure is required by law.
• Relevant parties in connection with a merger, acquisition, financing, reorganization, or sale of assets.
• Third parties when you direct us to share information or give explicit consent.

We retain personal data only for as long as necessary for the purposes described in this policy:

• Account, billing, and invoice information is retained for the duration of the account and up to 7 years afterward for tax and legal compliance.
• Analytics and revenue event data is retained according to the customer plan, project settings, and deletion controls.
• Security logs, API logs, audit events, and operational metrics are generally retained for up to 24 months unless a longer period is needed for security, abuse investigation, or legal compliance.
• Backups are deleted or overwritten according to normal backup rotation schedules.

As a data subject under the GDPR, you may have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate personal data.
• Right to erasure: request deletion of your personal data.
• Right to restrict processing: request limitation of processing of your personal data.
• Right to data portability: receive your personal data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: withdraw previously given consent at any time.

To exercise these rights, contact us at privacy@attribiq.com. We will respond within the timeframe required by applicable law.

Our primary infrastructure is hosted within the European Union. When data transfers outside the EU/EEA are necessary, we use appropriate safeguards, including European Commission Standard Contractual Clauses, adequacy decisions, and provider assessments where applicable.

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit, access controls, hashed API keys, webhook verification, monitoring, backups, and least-privilege operational access.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact DNScale OÜ at privacy@attribiq.com.

DNScale OÜ, Harju maakond, Tallinn, Lasnamäe linnaosa, Sepapaja tn 6, 15551, Estonia.