Atribuya
Request demo

Privacy Policy

Last updated: July 30, 2026.

This Privacy Policy describes how personal data is processed within Atribuya, a multi-tenant SaaS platform that enables businesses with a sales team to attribute Google Business Profile reviews to their sales representatives. It applies to authorised users of the Service, to end customers registered by sales reps, and to review authors whose public data is synchronised from Google.

1. Data controller and data processor

Atribuya holds two distinct roles depending on the type of data:

  • Data controller with respect to data relating to persons who subscribe to the Service and to account administrators (identifying, billing and authentication data required to provide the Service).
  • Data processor (Art. 28 GDPR) with respect to data that each client organisation introduces into its instance: sales reps, end customers, Google listings, reviews and activity logs. In this case, the Client (the contracting organisation) acts as the data controller for that data.

The controller's identifying details are in section 11.

2. Data we process

2.1 Client and administrator data

  • Company name or individual name, tax ID, billing address.
  • Name, email, phone and role of the administrator or contact person.
  • Aggregated service usage data at the organisation level (number of connected listings, active sales reps, sync frequency, etc.).

2.2 Authorised user data (sales reps and managers)

  • Name, email, phone (optional), assigned role and linked Google listing (in the case of sales reps).
  • Technical data derived from authentication: unique user identifier, date of last access, active sessions.
  • Profile photo when voluntarily uploaded by the user.

2.3 End customer data registered by sales reps

  • Full name of the end customer and, optionally, email and phone number, as entered by the sales rep to generate the personalised link.
  • Records of personalised link opens (share_links): date and time, referral channel (WhatsApp, email, SMS, QR, direct) and browser user-agent.

2.4 Data synchronised from Google Business Profile

  • Reviews published on connected Google listings: author name as shown by Google, star rating, review text, date and internal review reference.
  • Administrative information about the connected listing: Google account identifier, listing identifier and email of the account that authorised the connection.
  • Google OAuth access tokens: stored in an isolated table with access restricted to server-side processes; never exposed to the user's browser.

3. Purpose and legal basis

Processing is carried out for the following purposes, under the legal bases indicated:

  • Service provision (authentication, automatic review attribution, dashboards, Google synchronisation): performance of the contract (Art. 6(1)(b) GDPR) with the Client.
  • Billing, support and legal compliance: compliance with legal obligations (Art. 6(1)(c)) and the controller's legitimate interests (Art. 6(1)(f)).
  • Service improvement through aggregated and anonymised metrics: the controller's legitimate interests (Art. 6(1)(f)).
  • End customer data registered by sales reps: the Client acts as controller and must establish an appropriate legal basis (typically legitimate interests in the context of the commercial relationship, or the end customer's consent). Atribuya only processes that data on the Client's instructions.

4. Sub-processors

To provide the Service, the Provider uses the following vendors as processors or sub-processors:

  • Supabase (Singapore, with EU data centres): PostgreSQL database hosting and authentication service.
  • Vercel (USA, with EU edge nodes): application hosting and cron job execution.
  • Google LLC: provider of the Google Places and Google Business Profile APIs to which the Client connects their listings.
  • SMTP provider (currently transactional email managed by Supabase Auth; in the future Brevo or equivalent, both with EU servers): sending magic links and notifications.
  • GitHub (USA, owned by Microsoft): used solely to run the hourly workflow that triggers the public sync endpoint; it does not receive personal data from the Client.

Vendors established outside the European Economic Area offer appropriate safeguards: Standard Contractual Clauses issued by the European Commission, EU-US Data Privacy Framework certifications or other mechanisms provided for in Chapter V of the GDPR.

The Client may request from the Provider an up-to-date list of sub-processors and sign a specific Data Processing Agreement (DPA) when subscribing to the Service.

5. Retention periods

  • Client and administrator data: for the duration of the agreement and for the applicable statutory retention periods after termination (typically six years for commercial and tax obligations).
  • Authorised user data: while they belong to an active organisation. Upon deletion of a user, identifying data is erased; associated activity logs are retained in anonymised form.
  • End customer data and share_links: for as long as needed for review attribution (approximately 12 months), unless manually deleted earlier by the sales rep or administrator.
  • Synchronised reviews: for as long as they exist on Google. If the end customer deletes their review, the system reflects this on the next sync via the removed_at field.
  • OAuth tokens: until the Client revokes the connection from the listing panel or from their Google account.
  • Audit log: five years from the date of each entry, unless a longer legal retention obligation applies.

6. Data subject rights

Any person whose data appears in Atribuya may exercise the rights recognised by the GDPR: access, rectification, erasure, objection, restriction of processing and portability. To do so, send a written request to alejandro@atribuya.com identifying yourself and describing the right you wish to exercise.

If the data belongs to an end customer registered by a sales rep of a contracting organisation, the request is forwarded to that organisation (the actual data controller) and handled jointly.

If you consider that the processing of your data does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority of your country of residence within the EU.

7. Security

The Service implements technical and organisational measures to protect personal data: multi-tenant isolation through PostgreSQL Row Level Security, encryption in transit (HTTPS/TLS) and at rest, OAuth token rotation, audit logging of critical actions and role-based separation of responsibilities within each organisation.

8. Cookies and similar technologies

Technical cookies. In the authenticated area of the Service, Atribuya uses strictly necessary technical cookies to maintain the user's session and to ensure the platform works correctly. These cookies do not require consent.

Third-party analytics cookies. On the public marketing pages of atribuya.com, Atribuya uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, to understand how the site is used and to improve it. Google Analytics sets cookies and may transfer data to Google LLC (USA), covered by Standard Contractual Clauses and the EU-US Data Privacy Framework.

These analytics cookies are only loaded if you give your prior consent via the banner shown on first visit. Until you click "Accept", no Google script runs and no analytics cookie is set. You may decline without affecting your browsing experience, manage each category separately, and change or withdraw your choice at any time from the "Cookies" link in the page footer, as easily as you gave it. Your choice is stored in a first-party cookie with a timestamp and version, which lets us honour it and demonstrate your consent; if we update this policy, we will ask you again.

No advertising or commercial profiling cookies are used. You can find the full detail (specific cookies, purpose and duration) in our Cookie Policy, and more information on Google's data processing at policies.google.com/privacy.

9. Google Business Profile data and limited use

Reviews published on Google Business Profile are content voluntarily published by their authors on a public platform. Atribuya synchronises them for the purpose of identifying the sales rep who originated the visit and presenting the Client with an aggregated dashboard. Review authors retain all their rights over that content with respect to Google and may also exercise the rights listed in section 6 against the Atribuya controller.

9.1 Data obtained through Google APIs

When an organisation administrator connects their listing through the Google authorisation flow (OAuth, business.manage scope), Atribuya accesses only: the reviews of the connected listings (author name as displayed by Google, star rating, text, date and the business reply if any), identifying information about the account and the listing (name, identifiers) and the email address of the account that authorised the connection. Atribuya does not access any other content of the Google account.

9.2 Limited Use

Atribuya's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • Data is used exclusively to provide the user-facing features of the Service: attributing reviews to sales reps, dashboards, alerts and exports for the organisation itself.
  • Data is not sold, is not used for advertising and is not transferred to third parties, except to the sub-processors required to operate the Service (section 4), for security reasons or where required by law.
  • No humans read this data unless the Client consents, it is needed for security purposes, it is required by law, or it has been aggregated and anonymised for internal use.
  • Data is not used to train artificial intelligence or machine learning models.

9.3 Revoking access

The organisation can disconnect a listing from within the Service at any time (access tokens are deleted) or revoke the permission granted to Atribuya from their Google account settings at myaccount.google.com/permissions. After revocation, Atribuya immediately stops synchronising data from that listing.

10. Changes to this policy

This policy may be updated to reflect changes in the product, in applicable law or in sub-processors. The date of the last update appears at the top of this document. Material changes will be notified to the administrators of contracting organisations by email with reasonable prior notice.

11. Controller contact details

Alejandro Castillo Cantón
Tax ID: 55418862V
Address: Calle Leopoldo Querol 53, 3, 12560 Benicàssim, Castellón, Spain
Phone: +34 644 295 159
Privacy contact email: alejandro@atribuya.com