Privacy Policy

Attracted operates the website at attracted.space and the Attracted platform. For questions about this Policy or to exercise your rights, contact us at privacy@attracted.space.

For users in the European Economic Area (EEA) and United Kingdom, our EU/UK representative and Data Protection Officer (DPO) can be contacted at the same address.

This Policy applies globally and is supplemented by region-specific disclosures for residents of the EEA, United Kingdom and Switzerland (under the GDPR / UK GDPR / Swiss FADP), the United States (including the California Consumer Privacy Act / CPRA, and analogous laws in Virginia, Colorado, Connecticut, Utah, Texas and other states), and Australia (under the Privacy Act 1988 (Cth) and the Australian Privacy Principles).

We collect the following categories of personal information:

• Identifiers and account data: name, email, phone, employer, job title, login credentials.
• Customer content: data you upload to or generate within the Services, including data about your end customers (processed on your behalf).
• Commercial information: billing address, subscription, payment status (payment card details are handled directly by our PCI-DSS compliant payment processors).
• Device and usage data: IP address, device identifiers, browser type, language, referring URLs, pages viewed, clickstream and timestamps.
• Cookies and similar technologies: see our Cookie Notice in Section 9.
• Communications: demo requests, support tickets, survey responses.
• Marketing data: preferences, engagement with our emails, ad interactions and inferences drawn from the above.

We do not knowingly collect "sensitive" categories of personal information (such as biometric, health or precise geolocation data) and ask that you do not submit such data through the Services.

We process personal information to:

• provide, secure and improve the Services;
• create and administer accounts, process payments and provide support;
• communicate about updates, security alerts and administrative messages;
• send marketing communications where permitted (you can opt out at any time);
• measure, analyse and improve our website, marketing and product performance;
• detect, prevent and respond to fraud, abuse and security incidents;
• comply with legal obligations and enforce our Terms.

Automated decision-making: we do not use the Services to make decisions producing legal or similarly significant effects on individuals without human review.

• Contract: to provide the Services you request.
• Legitimate interests: to operate, secure and improve our business, balanced against your rights.
• Consent: for non-essential cookies and certain marketing — withdrawable at any time.
• Legal obligation: to comply with applicable law.

We share personal information with:

• Sub-processors and service providers — cloud hosting, analytics, payment, email, customer support and security vendors, all under written contracts including a DPA. A current list is available on request.
• Customers: when you interact with a brand using Attracted, that brand is the controller of your personal data.
• Professional advisers (legal, accounting, insurance) under confidentiality.
• Authorities where required by law or to protect rights, property or safety.
• Corporate transactions (merger, acquisition, financing) — subject to confidentiality and continued protection.

We do not "sell" personal information for money. We may "share" personal information for cross-context behavioural advertising as defined under the CCPA/CPRA; you can opt out at any time — see Section 11.

Attracted is a global business and may transfer personal information to countries other than your own, including the United States, the European Union and Australia. Where we transfer personal data out of the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum and, where relevant, the EU-US / UK / Swiss-US Data Privacy Framework, together with supplementary technical and organisational measures.

We retain personal information only for as long as necessary for the purposes described in this Policy, to comply with our legal, tax and accounting obligations, to resolve disputes and enforce agreements. Customer content is retained per the customer's subscription and the DPA. Backups are deleted on a rolling schedule.

We use strictly necessary, functional, analytics and (where you consent) marketing cookies and similar technologies. EEA, UK and Swiss visitors see a consent banner and may adjust preferences at any time. You can also use browser controls and Global Privacy Control (GPC) signals, which we honour as a valid opt-out of "sale" / "sharing" under US state laws.

We maintain administrative, technical and physical safeguards aligned with industry standards (including encryption in transit and at rest, access controls, logging and regular testing). No system is perfectly secure; if you believe your account has been compromised, contact security@attracted.space.

Depending on your region, you may have rights to: access, correct, delete, port, restrict or object to processing of your personal information; withdraw consent; opt out of marketing, profiling, "sales" or "sharing"; and lodge a complaint with a supervisory authority.

• EEA / UK / Switzerland (GDPR / UK GDPR / FADP): rights of access, rectification, erasure, restriction, portability, objection, and to lodge a complaint with your local supervisory authority (e.g. ICO, CNIL, FDPIC).
• United States (California, Virginia, Colorado, Connecticut, Utah, Texas and others): rights to know, access, delete, correct, opt out of sale/sharing and targeted advertising, limit use of sensitive data, and non-discrimination. Authorised agents may submit requests on your behalf with verifiable authority.
• Australia (Privacy Act 1988 / APPs): rights to access and correct your personal information and to complain to the Office of the Australian Information Commissioner (OAIC).
• Other jurisdictions: rights as provided by applicable local law (e.g. LGPD in Brazil, PIPEDA in Canada, POPIA in South Africa).

To exercise any right, email privacy@attracted.space. We will verify your request and respond within the timeframes required by applicable law (typically 30–45 days). Where we act as a processor, we will forward your request to the relevant customer.

The Services are not directed to children under 16 (or the higher age set by local law). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this Policy from time to time. Material changes will be highlighted on this page and, where appropriate, notified by email or in-product. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

Attracted — Privacy Team
Email: privacy@attracted.space
For California, Virginia, Colorado, Connecticut, Utah and Texas residents, you may also designate an authorised agent to submit requests on your behalf.