Atriqo — Privacy Policy

Last updated: 11 October 2026

1. Who we are

This Privacy Policy is issued by:

Iñigo Larrea Arina, trading as “Atriqo” (a trade name; Atriqo is not a separate legal entity), sole trader/self-employed professional under Spanish law.

• NIF: 72813588G
• Address: Calle Monasterio de la Oliva 31, entreplanta, 31011 Pamplona (Navarra), Spain
• Email: hello@atriqo.com
• Legal notice: Aviso Legal

Atriqo has not appointed a Data Protection Officer (DPO). Privacy and data-protection enquiries may be sent to hello@atriqo.com or to the postal address above.

2. Scope and our different roles

Atriqo provides a web-analytics service to businesses and professionals. Our role depends on whose data is being processed and why.

2.1 Visitors to a Customer’s website

If you visit a website operated by an Atriqo Customer and that website uses Atriqo analytics, the Customer normally determines the purposes and essential means of that analytics processing and acts as controller. Atriqo processes the analytics data on the Customer’s behalf as processor, under our Data Processing Agreement (DPA).

If the Customer itself acts as processor for another controller, Atriqo acts as subprocessor as described in the DPA.

For this processing, the Customer’s own privacy notice is the primary source of information about why the website uses analytics and the lawful basis relied on. Atriqo does not choose or guarantee the Customer’s lawful basis.

2.2 Visitors to atriqo.com and Atriqo account users

When you visit atriqo.com, create or use an Atriqo account, contact us, request a scanner result, or purchase the Service, Atriqo may act as controller for the personal data needed for those purposes. The sections below describe those controller activities.

3. Analytics data processed for Atriqo Customers

When a Customer website has installed the Atriqo tracker, Atriqo may process the following on that Customer’s behalf:

Country-level geolocation uses a locally installed MaxMind database. Visitor IP addresses are not sent to MaxMind for these lookups.

The Atriqo tracker does not use cookies to identify visitors, does not track visitors across unrelated Customer sites and does not use device-fingerprinting techniques to re-identify visitors after the daily identifier changes.

Cookie-free does not necessarily mean outside ePrivacy rules. The tracker receives or derives information such as User-Agent/browser/device information, language and screen information, and applicable law may treat collection of terminal information as storage/access to terminal equipment even where no cookie is set. Whether prior terminal-device consent is required, or an audience-measurement or other exemption applies, depends on the Customer’s configuration and applicable law.

Atriqo applies technical scrubbing intended to reduce accidental personal data in URLs and diagnostics, but no automated classifier can guarantee that Customers will never send additional personal data. Customers remain responsible for the content they configure and transmit.

4. Analytics on Atriqo’s own website

Atriqo uses its own cookieless analytics on atriqo.com to understand aggregate website usage, diagnose the performance of our public website and improve how information about the Service is presented.

For this activity, Atriqo is the controller. The technical data processed is substantially the same privacy-minimised data described in Section 3: a daily-changing pseudonymous identifier, page/event metadata and country-level location; the raw IP address is used transiently and discarded after the privacy identifier and country are derived.

For GDPR purposes, Atriqo relies on its legitimate interest under Article 6(1)(f) GDPR in measuring and improving its own business website using a minimised analytics design. You may object to this processing as described in Section 12. That GDPR legal basis does not replace any separate ePrivacy/terminal-access requirement. We are migrating this measurement to a mode that retains only aggregated statistics.

Atriqo’s own website analytics are configured for a maximum retention of 24 months, unless a shorter period is used. This retention period alone does not establish that an ePrivacy audience-measurement exemption applies.

5. Account, contracting and support data

If you register for or use Atriqo, we may process:

• Email address and account identity data, used for account creation, passwordless login, service notices and support.
• Account and site configuration, such as registered domains, display names, time zone, plan, quota and settings.
• Authentication and security data, such as hashed session identifiers, one-time login challenges, rate-limit information and technical audit records.
• Billing and subscription information, including plan, billing status, invoice-related information and payment-provider references. Atriqo does not store full payment-card numbers.
• Support and business communications, including information you send to hello@atriqo.com.
• Scanner/lead information, where you voluntarily provide contact information to receive a requested scanner result or separately opt in to marketing communications.
• Scanner usage records, created each time the public scanner is used: the domain scanned, the scan result and status, timestamps, and whether a PDF, a verified mailbox or marketing consent was requested or given. If you request the PDF, we also keep a keyed hash (HMAC) of your email address, not the address itself. Atriqo does not store your IP address in these records. The domain scanned may relate to an identifiable person (for example, a sole trader's own domain); Atriqo cannot generally tell.
• Upgrade-origin label. If you start a checkout after following one of certain in-product prompts (currently, the data-import prompts), a single fixed label naming that prompt is attached to your checkout session at Stripe. It is linked to your account through that checkout session and contains no visitor data and no free text. Atriqo uses it only to count, in aggregate, completed checkouts that carry the label, and removes it from the checkout record within 12 months.

We normally receive this information directly from you, from the organisation you represent, from your use of the Service, or from service providers such as Stripe where needed to administer payment and subscriptions.

6. Purposes and legal bases when Atriqo is controller

Where Atriqo relies on legitimate interests, the processing is limited to what Atriqo considers necessary and proportionate for the stated purpose. You have the right to object under Article 21 GDPR, subject to the conditions of that Article.

7. Customer lawful bases for analytics are not determined by Atriqo

For analytics processed on a Customer’s behalf, the Customer determines the applicable GDPR lawful basis. Depending on the Customer’s circumstances, this may be legitimate interests or another lawful basis available under applicable law.

The fact that Atriqo does not set visitor-identification cookies does not by itself determine the Customer’s GDPR lawful basis or eliminate separate ePrivacy/terminal-access duties. In particular, audience-measurement exemptions are conditional and can depend on purpose, data fields, retention, aggregation, reuse and the Customer’s configuration. Atriqo does not represent that every plan or configuration qualifies for such an exemption. Customers remain responsible for their own assessment, privacy notice and any consent requirements that apply to their use case.

8. Data minimisation and accidental personal data

Atriqo’s analytics is designed to minimise personal data. In particular:

• raw visitor IP addresses are discarded after transient processing;
• URL query-string handling is restricted and unnecessary values are removed under the Service’s scrubbing rules;
• technical filtering is used to reduce common personal-data patterns in fields where such filtering is supported; and
• Sentry diagnostics are filtered before transmission to remove cookies, authorisation headers and URL query strings and to redact tokens embedded in paths.

These controls reduce risk but do not guarantee that Customers cannot send personal data in custom event properties, paths, referrers or other fields. Customers must avoid sending personal data that is unnecessary or that they are not authorised to process.

9. Retention

9.1 Customer analytics data

Analytics events processed for Customers are retained according to the selected plan unless the Customer configures a shorter period:

When a paid subscription lapses but the account remains open, it may move to the free plan and the applicable retention horizon changes accordingly. Termination, return, deletion and residual backup copies are governed by the DPA.

Customers can export analytics events in CSV on all plans and JSON on Growth and higher plans. The standard export excludes certain service-internal pseudonymous and technical identifiers. Where the DPA requires return of remaining Customer Personal Data on termination, the DPA governs that supplementary process.

9.2 Account and authentication data

• login codes/challenges expire after approximately 15 minutes and are intended to be single-use;
• Atriqo uses a session token to maintain authenticated access to the dashboard. By default, the session cookie is a browser-session cookie. If the user expressly selects “Keep me signed in for 30 days”, the cookie becomes persistent for 30 days from login, without automatic extension through use;
• incomplete signup attempts with no continuing account relationship are deleted after approximately 30 days;
• account configuration is kept while the account is active and afterwards only for as long as necessary for account closure, legal obligations, dispute handling, security and the establishment, exercise or defence of legal claims;
• billing, tax and accounting records are retained for the periods required by applicable law; and
• product/security audit-trail records may be retained for up to 7 years for security, accountability and dispute-management purposes;
• the upgrade-origin label (Section 5) is removed from the Stripe checkout record within 12 months of the checkout; only aggregate counts are kept after that;
• internal new-account notices (Section 6) are kept in Atriqo’s corporate mailbox until the welcome is sent and, in any case, for a maximum of 90 days from receipt; the mailbox provider’s backup copies (Proton, Section 10), which Atriqo does not control, may retain them for up to 30 days longer;
• the record of acceptance of the Terms and the DPA (accepted version, date, language and email) is kept for the duration of the relationship and up to six years after it ends, the retention period for business records, which covers the limitation period for contractual claims, to evidence the contract and establish or defend legal claims, including after the account is deleted.

9.3 Diagnostics and support

Ordinary Sentry error events are currently subject to the retention configured for Atriqo’s plan, generally 30 days for ordinary free-plan events; events ingested under a trial may have a longer provider-assigned period, up to 90 days. Residual provider backups may follow a separate deletion cycle. Atriqo applies the deletion obligations described in the DPA where diagnostics contain Customer Personal Data.

Support communications are retained for as long as reasonably necessary to handle the request and business relationship and, where needed, to establish, exercise or defend legal claims.

9.4 Scanner usage records

Scanner usage records stop being served after 30 days by default and are removed from the live system by an automatic daily purge, so a record may remain there for up to about one more day. This period is configurable by Atriqo and a different value may apply in future; the current value will be reflected in this page. Backup copies of the database may still contain a record after that deletion, until those copies rotate out: the seven most recent daily copies on the server itself (protected by the server's access controls, not separately encrypted) are kept, which normally covers about a week, and the four most recent weekly encrypted off-site copies, which normally covers about four weeks, with up to 28 further days of version history at one off-site provider. Copies are rotated by count, so if backups stop running for a while, the last copies are kept longer until new ones replace them. Backups are only used to restore the service after a failure and in controlled tests that the restore works. The right to object under Article 21 is available (Section 12). Most of these records do not identify the requester; where you requested the PDF and agreed to marketing, the record is also linked to your contact at our email-contacts provider (Section 10) and can be found that way. If you create an Atriqo account from a scanner report, your account keeps the identifier of that scan (the report it came from) for as long as the account exists, so the scanner record, while it is still kept, can also be linked to your account. For a record that cannot be linked to you, Atriqo may need additional information from you to locate it (Article 11 GDPR).

10. Service providers and recipients

Atriqo uses a limited number of service providers. Their role depends on the relevant processing:

• Hetzner Online GmbH — hosting and storage in Falkenstein, Germany.
• OVH HISPANO S.L.U. / OVHcloud — encrypted backup storage in Paris, France (EU-WEST-PAR).
• Functional Software, Inc. (Sentry) — error diagnostics for the dashboard and analytics collection service, using Sentry’s EU region; filtered diagnostic data may still contain incidental personal data.
• Scaleway SAS (Paris, France) — delivery of transactional emails: login codes and links, requested scanner reports, the confirmation of acceptance of the Terms and the DPA, internal Service operations notices (such as the notice to Atriqo of each new account, Section 6) and, for Customers who subscribe, analytics report emails.
• Proton AG (Switzerland) — Atriqo’s corporate email (mailboxes on the atriqo.com domain, including hello@atriqo.com): it receives and stores the messages sent to Atriqo, including those you write to us and the internal new-account notices described in Section 6.
• Brevo / Sendinblue SAS (France) — storage of the contact details of people who opt in to communications in the scanner. Atriqo does not use Brevo to send email.
• Stripe Payments Europe, Limited — payment and subscription processing. Stripe may process some information under its own legal obligations and privacy terms as well as provide payment-related services to Atriqo.
• Cloudflare, Inc. — authoritative DNS only. Atriqo does not use Cloudflare’s HTTP reverse proxy or CDN for analytics traffic under the current configuration.

MaxMind is not used as a remote processor for visitor geolocation: Atriqo downloads and queries the relevant database locally and does not send visitor IP addresses to MaxMind for the lookup.

Atriqo may also disclose information where required by law, to establish or defend legal claims, or in connection with a permitted transfer of the business subject to applicable data-protection requirements.

11. International transfers

Atriqo’s primary analytics infrastructure and operational backup storage described above are located in the European Union. Some providers, notably Sentry and Cloudflare, are established in or may involve processing chains that include the United States or other countries outside the EEA even where EU-region storage is used.

Where Chapter V GDPR applies to a transfer, Atriqo uses an applicable lawful transfer mechanism. Depending on the recipient and transfer, this may include an applicable adequacy decision such as the EU–US Data Privacy Framework while it validly covers the recipient and data, or appropriate safeguards under Article 46 GDPR such as the European Commission’s Standard Contractual Clauses together with any required assessment and supplementary measures.

Proton AG, the provider of Atriqo’s corporate email, is established in Switzerland. The European Commission has decided that Switzerland ensures an adequate level of protection (Commission Decision 2000/518/EC of 26 July 2000, which remains in force under Article 45(9) GDPR and whose continued validity the Commission confirmed in its report of 15 January 2024), so the transfer relies on Article 45 GDPR.

You may request further information about safeguards relevant to Atriqo’s own controller processing by contacting hello@atriqo.com. Transfers involving Customer Personal Data processed on behalf of Customers are described in more detail in the DPA.

12. Your rights when Atriqo is controller

Subject to the conditions and limits in the GDPR, you may have the right to:

• access your personal data;
• rectify inaccurate personal data;
• request erasure;
• request restriction of processing;
• receive personal data in a portable format where Article 20 GDPR applies;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent, without affecting processing already lawfully carried out; and
• lodge a complaint with a competent supervisory authority.

Atriqo does not make decisions about account users based solely on automated processing that produce legal effects or similarly significant effects within Article 22 GDPR.

To exercise rights concerning processing for which Atriqo is controller, contact:

Email: hello@atriqo.com
Postal address: Calle Monasterio de la Oliva 31, entreplanta, 31011 Pamplona (Navarra), Spain

We may request information reasonably necessary to verify identity and the scope of the request. We will respond within the periods required by the GDPR.

You may complain to the Agencia Española de Protección de Datos (AEPD) or another supervisory authority competent under Article 77 GDPR, including in the Member State of your habitual residence, place of work or the place of the alleged infringement.

13. Requests concerning a Customer’s website analytics

If your request concerns analytics collected through a Customer’s website, that Customer is normally the controller and should be your primary contact.

If you send such a request to Atriqo, we will not independently decide the outcome on the Customer’s behalf. We will route or assist with the request as appropriate under the DPA, taking account of the pseudonymous nature of the data and the information available to identify the relevant records.

14. Children

Atriqo accounts are offered only to business/professional users who are at least 18 years old. We do not knowingly permit minors to create Atriqo Customer accounts.

Atriqo’s analytics technology may technically receive pseudonymous analytics events when a minor visits a Customer website or atriqo.com. For Customer websites, the Customer remains responsible for determining whether its audience includes children and for meeting any additional legal requirements that apply to that processing.

15. Security

Atriqo applies technical and organisational measures proportionate to the processing and risk. Current measures include, among other things:

• HTTPS/TLS for analytics endpoints and the Customer dashboard;
• restricted administrative and database access;
• key-based SSH administration over a private network rather than a publicly exposed administration port;
• HMAC-based pseudonymisation with a daily-changing salt for visitor analytics;
• encrypted backup archives before transfer to external backup repositories;
• two operational external backup repositories in the EU under the current architecture;
• documented recovery procedures and a completed full restoration test; and
• diagnostic filtering before data is sent to Sentry.

Security measures evolve over time. The DPA contains the more detailed contractual description applicable to Customer Personal Data.

16. Cookies and similar technologies

The Atriqo tracker does not set cookies and does not write information to localStorage, sessionStorage or IndexedDB. It only reads the atriqo_opt_out key from localStorage to determine whether the user has chosen to opt out of analytics. If that key exists, the tracker stops collection and sends no analytics events. This read is used exclusively to honour the user's opt-out choice and is not used to identify the user, measure their activity or build profiles. It can nevertheless receive or derive terminal information, so the absence of cookies is not a statement that ePrivacy consent is never required. The Atriqo dashboard uses authentication/access cookies described in the Cookie Policy; by default they last only for the browser session.

17. Email tracking

Atriqo sends its transactional emails through Scaleway. Atriqo does not enable or use open or click tracking in these emails: they contain no tracking pixel, and their links point directly to Atriqo.

18. Changes to this Policy

Atriqo may update this Privacy Policy to reflect changes in the Service, providers, legal requirements or processing practices. The current version and its “Last updated” date will be published on this page.

Where a change materially affects how Atriqo processes account-holder or other personal data as controller, Atriqo may provide additional notice by email or through the Service where appropriate. Changes to contractual processor obligations are governed by the DPA rather than by unilateral amendment of this Privacy Policy.

19. Contact

Privacy questions and requests: hello@atriqo.com.

Postal address: Calle Monasterio de la Oliva 31, entreplanta, 31011 Pamplona (Navarra), Spain.