Privacy Policy

1. Who we are

Attro (“we”, “us”) is an affiliate and referral tracking platform operated by We Are Empire PTY LTD, a company headquartered in Australia. This policy explains what data we collect when you use Attro at get-attro.com (including affiliate portals and custom domains served by Attro), why we collect it, and the choices you have. For any privacy question or request, contact [email protected].

2. Data we collect

Account and organization data

• Name, email address, and authentication credentials (passwords are hashed; we never store them in plain text).
• Organization, project, and branding details you configure.
• Billing details for your Attro subscription, processed by Stripe. We do not store card numbers.

Affiliate tracking data

• Click events on tracking links: IP address, user agent, referrer, approximate (country-level) location, device characteristics, and timestamps.
• Conversion events: order or subscription identifiers, amounts, currency, and their association to a tracking link.
• Affiliate profile data: name, email, and payout details (such as a PayPal email address) provided by affiliates.

Data from connected platforms

• Stripe: if you install the Attro Stripe app, we receive read-only billing events from your Stripe account — checkout sessions, invoices, subscriptions, charges and refunds, customer identifiers, and product metadata. We use this data solely to attribute revenue to referrals and to calculate commissions. The Attro app cannot move money or modify anything in your Stripe account.
• RevenueCat: if you connect RevenueCat, we receive in-app purchase events (transaction identifiers, product identifiers, amounts, and app user identifiers) for the same purpose.

3. How we use data

• To provide the service: attribute clicks and purchases to affiliates, calculate commissions, and process payouts.
• To detect and prevent fraud and abuse of affiliate programs.
• To send transactional email (account, program, and payout notifications).
• To provide support and improve the product.
• To comply with legal obligations.

We do not sell personal data, and we do not use tracking data for advertising.

4. Cookies

Attro uses first-party cookies only: a session cookie to keep you signed in, and an attribution cookie set when a visitor follows a tracking link so a later purchase can be credited to the referring affiliate (30 days by default; configurable per program). We do not set third-party advertising cookies.

5. Service providers

We share data only with the processors required to run Attro:

• Supabase — database and authentication
• Hetzner — application hosting (EU data centers)
• Cloudflare — DNS, TLS, and content delivery
• Stripe — subscription billing and connected-account billing data
• RevenueCat — in-app purchase events (when connected)
• Resend — transactional email delivery
• PayPal and Wise — affiliate payouts (when enabled)

6. Data retention

We retain data for as long as your account is active. Tracking and conversion records are kept for the life of the associated program so commission history remains auditable. When an account is deleted, associated personal data is removed or irreversibly anonymized within 30 days, except where retention is required by law.

7. Security

All traffic is encrypted in transit with TLS. Third-party credentials (such as webhook secrets and API keys you connect) are encrypted at rest with AES-256. Access to production systems is restricted and audited.

8. Your rights

Depending on your location (including under the GDPR and the Australian Privacy Principles), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Email [email protected] and we will respond within 30 days. If you are an affiliate or end customer of a business that uses Attro, we may refer your request to that business, which controls its program’s data.

9. International transfers

Attro is hosted in the European Union. Where data is transferred across borders to the service providers listed above, we rely on their standard contractual safeguards.

10. Children

Attro is a business tool and is not directed at children under 16. We do not knowingly collect their data.

11. Changes

We will post any changes to this policy on this page and update the date above. For material changes we will notify account owners by email.