Privacy Policy

1. Who we are

Attrevo is a marketing attribution platform operated by Techly Marketing Limited, a company registered in Nigeria with its registered office in Lagos, Nigeria.

For the purposes of the Nigeria Data Protection Regulation 2019 (NDPR) and the Nigeria Data Protection Act 2023, Techly Marketing Limited is the data controller for personal data relating to our own account holders — the people who sign up for and use Attrevo.

Where you use Attrevo to process data about your own website visitors and customers, you are the data controller and we act as your data processor. Those responsibilities are set out in our NDPR Compliance page.

Techly Marketing Limited maintains its data controller registration with the National Information Technology Development Agency (NITDA) and files the annual data protection audit required of data controllers processing personal data of Nigerian data subjects.

2. Data we collect

Account data

• Name and email address, provided when you create an account.
• Company name, website, industry, and advertising spend range, provided during onboarding.
• Authentication identifiers issued by our authentication provider.

Usage data

• Pages viewed within the Attrevo application, features used, and timestamps.
• Technical data including IP address, browser type, device type, and operating system.
• Diagnostic and error logs generated by the application.

Tracking data

• Marketing touchpoints collected by the Attrevo tracking snippet installed on your own website — campaign source, medium, campaign name, referrer, and landing page.
• Lead identifiers you submit or that are captured through your forms, which may include email addresses and phone numbers.
• Revenue events imported from connected payment platforms, including transaction amount, currency, and timestamp.

Payment data

• Subscription plan, billing status, invoice history, and transaction references.
• We do not collect or store full card numbers, CVV codes, or bank credentials. Card payments are processed entirely by our payment provider, and we receive only a tokenised reference and the outcome of each transaction.

3. Legal basis for processing

Under Section 2.2 of the NDPR, we rely on the following lawful bases:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. How we use data

• To create, authenticate, and administer your account.
• To calculate attribution across the supported models and produce the reports, dashboards, and diagnostics that make up the service.
• To match revenue events to marketing touchpoints, including matching by phone number where you have supplied that data.
• To process subscription payments and issue invoices.
• To send service messages, and — where you have opted in — WhatsApp reports and product updates.
• To monitor service health, investigate incidents, and prevent fraud or abuse.

We do not sell personal data. We do not share your attribution data with other customers, and we do not use one customer's data to benefit another.

5. Data retention

Tracking and attribution data is retained for a default period of 12 months from collection, after which it is automatically deleted by our scheduled retention process. Account holders on paid plans may configure a shorter retention period in their settings.

• Account records: retained for the life of the account and for 90 days after closure, to allow reactivation.
• Invoices and financial records: retained for six years, as required by Nigerian tax law.
• Diagnostic logs: retained for 30 days.

6. Your rights as a data subject

Under the NDPR you have the following rights over personal data we hold about you:

• Access — obtain confirmation of whether we process your data and receive a copy of it.
• Correction — have inaccurate or incomplete data rectified.
• Deletion — request erasure of your personal data where there is no overriding legal basis for us to retain it.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection and restriction — object to processing based on legitimate interest, or ask us to restrict processing while a dispute is resolved.
• Withdrawal of consent — withdraw any consent you have given, at any time.

To exercise any of these rights, email olusola.a@attrevo.com. We respond to verified requests within 30 days. If you are not satisfied with our response, you may lodge a complaint with NITDA.

7. Security

• All data is encrypted in transit using TLS.
• Data at rest is encrypted, and credentials for connected platforms are stored encrypted rather than in plain text.
• Access to production data is restricted to authorised personnel and is logged.
• Every record is scoped to a single tenant, and queries are filtered by tenant on every request.

8. International transfers

Attrevo is hosted in the AWS Africa (Cape Town) region. Some sub-processors — including our authentication, email, and AI providers — may process data outside Nigeria. Where that happens we rely on contractual safeguards requiring a standard of protection comparable to the NDPR.

9. Children

Attrevo is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy as the service evolves or the law changes. Material changes will be notified by email or in-app notice before they take effect. The "last updated" date above always reflects the current version.

11. Contact

Techly Marketing Limited
Lagos, Nigeria
Data protection contact: olusola.a@attrevo.com