Privacy Policy

Attracted operates the website at attracted.space and the Attracted platform. For questions about this Policy or to exercise your rights, contact us at privacy@attracted.com.au.

This Policy applies globally and is supplemented by region-specific disclosures for residents of the EEA, United Kingdom and Switzerland (under the GDPR / UK GDPR / Swiss FADP), the United States (including the CCPA/CPRA and analogous state laws), and Australia (Privacy Act 1988 (Cth) and the Australian Privacy Principles).

We collect the following categories of personal information:

• Identifiers and account data: name, email, phone, employer, job title, login credentials.
• Customer content: data you upload to or generate within the Services, including data about your end customers (processed on your behalf).
• Commercial information: billing address, subscription, payment status (payment card details are handled directly by our PCI-DSS compliant payment processors).
• Device and usage data: IP address, device identifiers, browser type, language, referring URLs, pages viewed, clickstream and timestamps.
• Cookies and similar technologies: see our Cookie Notice below.
• Communications: demo requests, support tickets, survey responses.
• Marketing data: preferences, engagement with our emails, ad interactions and inferences drawn from the above.

• Provide the Services: create and administer accounts, deliver and support devices, display in-store media and process transactions.
• Operate and improve: troubleshoot, measure performance, develop new features and conduct product analytics.
• Communicate: send service, security and administrative messages, and respond to enquiries and demo requests.
• Marketing: send relevant communications and measure campaigns, subject to your choices and applicable law.
• Trust and safety: detect, investigate and prevent fraud, abuse, and security incidents.
• Legal: comply with legal obligations, enforce our terms, and establish, exercise or defend legal claims.

Our devices are deployed by our business customers in their venues. Depending on configuration, they may process interaction data such as taps, screen touches, contactless payment events and anonymous presence signals used to adapt content. Where a venue enables features that involve personal information, that venue is the controller and is responsible for providing notice and obtaining any required consent. Attracted does not use in-store data to build cross-venue advertising profiles of individuals.

Some features use machine learning to generate creative, recommend content or summarise activity. These systems are used to support human decision-making and are not used to make decisions producing legal or similarly significant effects about individuals. We do not use customer content to train publicly shared foundation models without your instruction, and our AI providers are engaged as sub-processors under contractual confidentiality and security obligations.

We rely on: contract (to provide the Services and support), legitimate interests (to operate, secure, analyse and improve our business, and for business-to-business marketing), consent (for non-essential cookies and certain electronic marketing) and legal obligation (tax, accounting, and responding to lawful requests). Where we rely on consent, you may withdraw it at any time without affecting prior processing.

We share personal information with: sub-processors and service providers (cloud hosting, payment processing, analytics, communications, support and AI infrastructure) under written contracts; business customers where they are the controller; professional advisers; authorities where required by law or to protect rights and safety; and an acquirer in a merger, financing or sale of assets, subject to continued protection.

We do not sell personal information for money. Some analytics and advertising cookies may constitute a "sale" or "sharing" for cross-context behavioural advertising under certain US state laws — you can opt out via our cookie preferences or a Global Privacy Control signal. A current list of sub-processors is available on request at privacy@attracted.com.au.

We may transfer personal information to countries other than your own, including the United States, the European Union and Australia. Where we transfer personal data out of the EEA, UK or Switzerland, we rely on Standard Contractual Clauses, the UK IDTA/Addendum and, where relevant, the EU-US / UK / Swiss-US Data Privacy Framework, together with transfer impact assessments and supplementary technical and organisational safeguards. Australian customers: we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.

We retain personal information only for as long as necessary for the purposes described in this Policy. Indicatively: account records for the life of the account and up to 7 years afterwards where required for tax and legal purposes; support and marketing records for up to 3 years after last interaction; and security logs for up to 12 months. Customer content is retained per the subscription and the DPA, and is available for export for 30 days after termination before deletion.

We use strictly necessary, functional, analytics and (where you consent) marketing cookies and similar technologies. EEA, UK and Swiss visitors are asked for consent before non-essential cookies are set and can adjust preferences at any time. We honour Global Privacy Control signals as a valid opt-out under applicable US state laws. Most browsers also allow you to block or delete cookies, though this may affect site functionality.

We maintain administrative, technical and physical safeguards aligned with industry standards, including encryption in transit and at rest, least-privilege access controls, multi-factor authentication for administrative access, logging and monitoring, vendor due diligence, and periodic testing and review. No system is completely secure; we operate an incident response process and will notify affected parties and regulators where required by law. If you believe your account has been compromised or wish to report a vulnerability, contact security@attracted.com.au.

Depending on your region, you may have rights to access, correct, delete, port, restrict or object to processing; withdraw consent; opt out of marketing, profiling, targeted advertising, or the "sale" or "sharing" of personal information; and to be free from discrimination for exercising a right. To exercise any right, email privacy@attracted.com.au. We will verify your request, respond within the timeframe required by law, and you may use an authorised agent where permitted. Where we act as a processor, we will refer your request to the relevant business customer.

You may also lodge a complaint with your supervisory authority — in the EEA your local Data Protection Authority, in the UK the Information Commissioner's Office, and in Australia the Office of the Australian Information Commissioner. We ask that you contact us first so we can try to resolve the matter.

The Services are intended for business use and are not directed to children under 16 (or the higher age set by local law). We do not knowingly collect personal information from children; if you believe we have, contact us and we will delete it.

We may update this Policy from time to time. The "last updated" date reflects the most recent revision. Material changes will be highlighted on this page and, where appropriate, notified by email or in-product before taking effect.

Attracted — Privacy Team
Email: privacy@attracted.com.au
Security: security@attracted.com.au
Legal: legal@attracted.com.au