[PLACEHOLDER — company legal name], a Delaware C-Corporation ("Attriva," "we," "our," or "us"), operates the Attriva mobile application and website at attriva.ai. Our registered address is: [PLACEHOLDER — confirm after incorporation]. Contact us at: privacy@attriva.ai
This policy applies to parents and guardians who create and hold Attriva accounts, children whose information is added to an account by a parent or guardian, and visitors to attriva.ai. Accounts are held by adults only. Children do not create their own accounts. Children aged 13 and over may, at a parent's discretion, be given a limited read-only view of their own profile.
We do not collect your precise location. We do not track your movement. We do not read information from other apps on your device.
We use information only to operate your account, generate personalised roadmaps and insights for your family, create your child's annual portrait and achievement page, send transactional emails, respond to support requests, improve the product using anonymised aggregate patterns, and comply with legal obligations.
Attriva also uses OpenAI's Whisper API to transcribe voice memos. Audio is sent to Whisper for transcription only.
Voice recordings are transcribed using OpenAI Whisper. After transcription, the original audio is retained as a private archive artifact in a separate encrypted storage bucket. Accessible only to the parent account holder. Parents may request export or deletion by contacting hello@attriva.ai. On account deletion, all audio recordings are permanently deleted within 30 days.
COPPA applies because Attriva knowingly collects personal information from children under 13. Accounts are held by adults. A child's information is entered into Attriva by their parent or guardian, not by the child.
By creating an account and completing payment via Stripe, the parent confirms they are 18 or older, have legal authority to provide their child's information, and consent to the collection and use of their child's information as described in this policy. [PLACEHOLDER — confirm COPPA consent mechanism with specialist counsel]
Voice recording requires lawful parental authority over the child. Voice recording is optional — parents can use all core features using text only.
At any time, parents may view, edit, delete, and export all information stored about their child. Contact privacy@attriva.ai for deletion requests. Fulfilled within 30 days.
We do not sell your data. We share limited information only with service providers bound by written data processing agreements:
| Provider | Data received | Purpose |
|---|---|---|
| Anthropic | Moment text, child profile data | AI signal extraction, portrait generation, weekly moves, advisor, roadmap |
| OpenAI (Whisper) | Voice audio recordings | Transcription of voice memos |
| Supabase | All family data and files | Primary database and file storage — encrypted at rest and in transit |
| Stripe | Name, email, payment data | Subscription billing — we never see your card number |
| Resend | Parent email address | Transactional email delivery only |
| PostHog | Anonymised usage events | Product analytics — no PII, no moment content |
| Sentry | Anonymised error logs | Error tracking — no personal data |
| Vercel | Web traffic logs | Web app hosting |
| Hetzner | Server logs | VPS hosting |
What you own: Your submitted content — raw moments, photos, audio recordings, activity records, and child profile information. Full export available at any time in JSON format.
What Attriva built: Attriva-generated analytical outputs are Attriva's proprietary intellectual property. You receive a personal, non-commercial licence to view these outputs during an active subscription. This licence terminates on cancellation.
The portrait transfer: When a child reaches 18, Attriva offers to transfer the portrait to a personal account in the child's name. Submitted content transfers with the portrait.
If we discover a data breach affecting your personal information, we will notify you by email within 72 hours. [PLACEHOLDER — confirm timeline with counsel]
You can view, export, correct, and delete all data from within the app at any time. On account deletion: your account is limited to account settings for 30 days, during which you can download your data or reactivate, then all data is permanently deleted. To request immediate deletion, contact privacy@attriva.ai.
California (CCPA): We do not sell personal information. Contact privacy@attriva.ai for any CCPA request. [PLACEHOLDER — confirm applicability with counsel]
European residents (GDPR): Contact privacy@attriva.ai to exercise any GDPR right. [PLACEHOLDER — confirm applicability with counsel]
Data kept while your account is active. On cancellation: account access is limited to Settings for 30 days (download your data or reactivate anytime during this window), then permanent deletion. Legal records retained for 7 years as required by law.
The Attriva app does not use advertising cookies. attriva.ai uses essential session cookies and anonymised PostHog analytics. No advertising trackers, no social media pixels, no fingerprinting.
We will email you at least 14 days before material changes take effect and ask for fresh consent if any change affects how we use children's data.
Email: privacy@attriva.ai
Response within 5 business days for general questions; 30 days for data requests.
Mailing address: [PLACEHOLDER — confirm after incorporation]