Privacy and cookies

Last updated 29 September 2026

This page explains what personal data Attention8 collects, why, who we share it with, and what you can do about it. It covers our website at attention8.com, the dashboard at dashboard.attention8.com, and the competitions hub at play.attention8.com.

Who is responsible

Attention8 is the data controller for the personal data described here. You can reach us about anything on this page, including any request to see, correct or delete your data, at info@attention8.com.

Cookies

We do not set analytics cookies unless you accept them. Until you choose, no analytics script is loaded at all - not loaded and restricted, simply not loaded. If you decline, we also delete any analytics cookies already on your device.

What we collect

If you just visit the website

Nothing that identifies you, unless you accept analytics cookies. If you do, Google Analytics records which pages you viewed, roughly where in the world you are, and what kind of device and browser you used.

If you have a dashboard account

• Your email address and display name, used to sign you in and to contact you about the service.
• Which brands and campaigns you have access to.
• Notifications we have sent you, and whether you have read them.

Sign-in itself is handled by Clerk. We never see or store your Google password.

If you are a creator working with a brand on Attention8

• Your name and display name, and the social accounts you have linked.
• Payment details you give us so a brand can pay you, stored so invoices can be raised.
• Invoices raised for your work, and the posts they relate to.

Public social media data

For accounts a brand has linked to a campaign, we collect publicly visible information about their posts - the post itself, its caption, its thumbnail, and public counts such as views, likes, comments and shares - along with the public profile handle, display name, picture and follower count. We collect this from the platforms through Apify. We do not collect private messages, private accounts, or anything that is not publicly visible.

If you enter a competition

• Your email address, and your answers to the competition questions.
• If you ask to be told when a competition opens, your email address for that reminder.

If you connect Google Analytics

A brand admin can connect a Google Analytics property to a brand, so the dashboard can show how much traffic the website received alongside how many views the campaign's videos got. This is optional. Nothing is read until someone chooses to connect, and only a brand admin can do it.

When you connect, Google asks you to approve read-only access to your Analytics data. We receive a token that lets us read reports. We never see your Google password, and we cannot change anything in your Analytics account.

What we read

• The Analytics properties and website streams your Google account can see, so you can pick the right one.
• The number of sessions - visits - per day for the stream you picked, for the last 90 days, refreshed once a day.
• The property's name, timezone and website address, so the dashboard can label the connection.

We receive daily totals and nothing else. We do not read individual visitors, their identifiers, their locations, or anything about who they are.

What we do with it

Attention8's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. In plain terms:

• We use it only to show website traffic in the dashboard, for the brand it was connected to.
• We do not sell it, and we never use it for advertising.
• We do not pass it to anyone else, except where we must to run the feature, to protect against security threats, or to comply with the law.
• Nobody at Attention8 reads it, unless you have asked us to help with a problem, we must for security or the law, or the figures have been aggregated and made anonymous.

How we protect it

• We ask Google for read-only access to Analytics and nothing more. We cannot change your Analytics account, its settings, or its users.
• The token Google gives us is encrypted with AES-256-GCM before it is stored. The encryption key is kept apart from the database, so a copy of the database alone cannot be used to reach your Analytics account.
• Each stored token is bound to the brand it was connected for. It cannot be decrypted or used for any other brand.
• The short-lived access tokens we use to request reports are held in memory for a single request and never written to storage.
• Only admins of the brand's workspace can connect, change or disconnect a property. The imported traffic figures are shown only to people who already have access to that brand's dashboard.
• Everything travels over encrypted HTTPS connections, between your browser and the dashboard and between the dashboard and Google.

Turning it off

A brand admin can disconnect at any time from the brand's dashboard. Disconnecting deletes the stored token and the daily traffic figures we imported. You can also remove Attention8's access completely from your Google account permissions page.

Why we are allowed to use it

• Consent - analytics cookies, competition reminder emails, and connecting a Google Analytics property. You can withdraw consent at any time.
• Performing a contract - running your account, your campaigns, and your invoices.
• Legitimate interests - keeping the service secure and working, and measuring public campaign performance for the brands who commissioned it.
• Legal obligation - keeping invoicing and tax records for as long as the law requires.

Who we share it with

We do not sell personal data. We use these providers to run the service:

Some of these providers are based outside the European Economic Area, or store data there. Where that happens, the transfer relies on the European Commission's standard contractual clauses or an equivalent safeguard.

How we protect your data

• Encryption in transit - the website and the dashboard are served only over HTTPS. Plain connections are redirected, and the dashboard tells browsers never to connect to it without encryption.
• Encryption of credentials - we never see or store your password; sign-in is handled by Clerk. Tokens from connected services, such as Google Analytics, are encrypted before they are stored, with a key held separately from the database.
• Access control - every request is checked against your workspace and role, so you only see the brands, creators and invoices you have been given access to. Payout details are shown only to the people who need them to pay a creator.
• Least privilege - when we connect to another service on your behalf we ask for the narrowest access that makes the feature work, and read-only access wherever that is enough.
• Limited staff access - only Attention8's operators can reach the production systems, and their accounts are protected with two-step verification.
• Deletion - disconnecting a service deletes its stored credentials and the data we imported from it. You can ask us to delete your account data at any time.
• If something goes wrong - if a security incident affects your personal data, we will tell you and the relevant authority as the law requires.

How long we keep it

• Account data - while your account is open, and for a short period afterwards.
• Invoicing records - for as long as accounting and tax law requires.
• Campaign and post data - while the brand's campaign is active, so performance can be tracked over time.
• Competition entries - until the competition has been judged and prizes awarded.
• Website traffic from a connected Google Analytics property - the most recent 90 days, replaced each time it syncs, and deleted as soon as the brand disconnects.
• Analytics - as configured in Google Analytics, and never longer than 14 months.

Your rights

If you are in the UK or the EEA, you can ask us to:

• show you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it, where we do not have to keep it;
• stop or limit how we use it, or object to us using it;
• send it to you, or to someone else, in a portable format.

Email info@attention8.com and we will respond within one month. If you are not happy with our response, you can complain to your national data protection authority. In Lithuania that is the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija).

Changes to this page

If we change how we handle personal data we will update this page and change the date at the top.