Attunr privacy policy

Draft. Written 2026-10-17 and revised the same day after the legal review in lawyer-review.md. Not in force and not published.

BUILD: marks a promise that is only true once a planned build step ships. Words in [square brackets] are placeholders.

It is written for Canada's federal privacy law (PIPEDA), Quebec's Law 25 (the Act respecting the protection of personal information in the private sector, as amended) and the basics of the EU's GDPR for visitors from the EU.

1. Who this covers

Attunr is a sales CRM made by [legal name of the corporation], doing business as Figured Media ("we", "us"). This policy covers two kinds of information.

Information we decide about. We are responsible for it:

• people who use Attunr: account owners, their teams, agency staff and client hub users;
• people who visit attunr.com, sign up for a trial or write to us.

Information our customers put into Attunr. For example, the leads, contacts, emails and call recordings of a business that uses Attunr. That business decides what goes in and why. We handle it only on its instructions, under our data processing agreement. If you are a lead or contact in someone's Attunr workspace, ask that business first. If you write to us, we pass your request to them within 5 business days.

This includes people who receive something from an Attunr customer: a pitch page, a booking page, a proposal or an unsubscribe page. Those pages are run for the customer, so the customer's own privacy notice applies. Pitch pages and proposals say on the page that the customer can see when they're opened.

2. The person in charge of privacy

Privacy officer, [legal name of the corporation]: hello@attunr.com, [mailing address].

Our owner is the person in charge of protecting personal information, as Quebec's law sets by default, and the person accountable for privacy under PIPEDA.

3. What we collect about people who use Attunr

The browser extension

Attunr's browser extension (for Chrome) adds businesses and people to your Attunr from the page you're on.

• Where it sends things. Only to your Attunr, at the address you connect. The extension has no server of its own and sends nothing to anyone else. It has no ads, no analytics and no tracking, and nothing is sold.
• A business's website. Only when you click its toolbar button or press Alt+Shift+R, and only the tab you're on. It reads the business name, website, emails, phones, street address and town, links to its social pages, names and job titles on the page, a short description and the page address. As the popup opens, it sends the website, business name, social links and page address to your Attunr to check whether the business is already there. You see everything in a form first, and the lead is only saved when you click Add.
• A LinkedIn profile. While it's connected, when you open a profile at linkedin.com/in/, it reads the name, headline, company, location and profile address, and asks your Attunr whether that person is already a lead. Adding them sends the same details.
• Google searches your Attunr asks for. When you open a lead, Attunr can ask the extension to run that lead's searches (words such as "snow removal navan") in your own browser. It opens each one in a background tab, reads the results page and closes the tab. Before it sends the page to your Attunr, it removes Google's account bar (your name and email) and footer (your rough location). It runs one at a time, 40 an hour at most, and after a Google captcha it sends nothing from that page and stops for 6 hours.
• Attunr's own pages. A small script on your Attunr's address connects the extension and passes on search requests. It reads nothing else there.
• Setting up. While it isn't connected, clicking its button asks the site in that tab whether it's an Attunr, with one request that carries no cookies and no data, so the address can be filled in for you.
• What it never reads. Form fields such as passwords, and the pages you browse when you haven't clicked it, apart from the LinkedIn profiles above.
• What stays in your browser. Your Attunr address and your extension token, in Chrome's extension storage (if Chrome sync is on, Chrome copies them to your other computers). Forms you started but didn't send: at most 20, and each time the popup opens it clears the ones older than 7 days, so an unused extension can keep one longer until it next opens. The town and trade of the last lead you added. The times of the last hour's Google searches, and when a pause after a Google captcha ends. Moving to another Attunr address deletes the token, the unsent forms and the last town and trade; the search times and the pause stay, and hold nothing about any lead.
• The token. Attunr makes it when its Settings page connects the extension, and keeps only a hash of it. Disconnect any browser in Settings, Capture & extension, and its token stops working at once.

What the extension sends to your Attunr becomes part of your workspace, so it's information our customers put into Attunr (section 1).

4. attunr.com and cookies

• Inside Attunr we use only the cookies needed to keep you signed in and to stop bots. Cloudflare Turnstile runs on the sign-in page. There are no ad or analytics trackers in the app.
• Pages Attunr hosts for customers (pitch pages, booking pages, proposals) carry no ad or analytics tags. Pitch pages and proposals record their own opens for the customer, and say so on the page.
• attunr.com. Today it is a waitlist page. When the new site launches, this section will list every cookie and tag on it.
• If attunr.com ever uses ad or analytics tags, they stay off for every visitor until the visitor says yes in a cookie banner. BUILD: the banner, if tags are added.

5. How we use it, and on what basis

• To provide Attunr. We need this to carry out our contract with you.
• To keep Attunr safe. For example, sign-in protection and abuse checks. This is in our legitimate interest and yours.
• To bill you and keep records the law requires. This is a legal duty.
• To tell you about your account. For example, changes, limits reached, failed payments and security notices. Part of the contract.
• To tell you about new features or offers. Only with your consent, or where Canada's anti-spam law (CASL) allows it for existing customers. Every such email has an unsubscribe link.
• To improve Attunr. We use counts of what's used, not the content of your workspace. Legitimate interest.

The bases above are the ones the GDPR asks for. Under PIPEDA and Law 25, we collect only what these purposes need and tell you about it here. Using it for them is part of providing Attunr, which you ask for when you sign up. Where the law needs your separate consent, for example for marketing email, we ask for it separately.

We don't sell personal information. We don't use it for ads.

6. Who we share it with

• The service providers in our subprocessor list, only as much as each needs to do its job.
• Cloudflare, which runs the bot check on the sign-in page, also uses the internet address and browser signals it collects there to improve its bot detection, under its own Turnstile privacy terms.
• Outside services you connect yourself (your mailbox, Telnyx, Google, Meta and others). You choose to send them data, and their terms apply.
• Authorities, when the law requires it.
• A buyer or successor, if Attunr or Figured Media is sold or merged. We tell you first.

7. AI and voice

• AI features send the text they need to Google's Gemini API, or to Anthropic when Gemini fails, to write a draft, a summary or a reply. Ask Attunr sends only the question and field names. Neither may train AI models on it. Each keeps it only for a short abuse check (Google 55 days, Anthropic 30 days). BUILD: today the text goes through fal.ai's any-llm service and OpenRouter; the move to Google and Anthropic directly ships before launch.
• Voice notes and call recordings are transcribed by Whisper on fal.ai.
• The live transcript on the call screen uses your browser's own speech service. In Chrome, that sends your microphone audio to Google under Google's terms. The call screen says so the first time you turn it on.
• Ranking leads. Attunr ranks a customer's leads by how much they engage (the "heat" score: replies, connected calls, meetings, and proposal and pitch-page opens) so a sales team knows whom to call first. For a named person that is profiling under Quebec's law and the GDPR. It isn't a decision made by automated means alone: people decide what to do. Pitch pages and proposals say on the page that opens are tracked, and for leads in Quebec they record nothing until the visitor agrees.

8. Where it is kept

• Attunr runs on Fly.io in Toronto, Canada, and so does its database (Fly Managed Postgres).
• Fly.io's own backups of the database and disks may be stored by its backup provider in the US. Until Fly.io confirms they stay in Canada, we treat them as stored in the US.
• Call recordings stay in the customer's own Telnyx account, which stores them in the US unless the customer picks another region Telnyx offers. Attunr plays them from there.
• BUILD: files (voice notes, screenshots, nightly account copies) move to object storage in Stage 3.2, in a Canadian region.
• Some service providers are outside Canada, mostly in the US. The subprocessor list says which. Information sent there is subject to those countries' laws, and their authorities may be able to get it.
• We have assessed each of these transfers, as Quebec's law asks before personal information leaves Quebec, and each provider is bound by a written agreement. Customers can ask us for a summary of the assessment.
• Information from the EU. Attunr is sold to businesses in Canada and the US. If the GDPR applies to information about you, its transfer to us in Canada relies on the EU's decision that Canada protects it adequately. Providers outside Canada that receive it give a GDPR safeguard: the EU-US Data Privacy Framework or the EU's standard contractual clauses.

9. How long we keep it

What happens to information inside a workspace is up to the customer and is set out in the data processing agreement.

BUILD: deleting server logs after 90 days and sign-in records after 12 months.

10. How we protect it

• Encrypted connections (HTTPS) everywhere.
• Passwords stored only as scrypt hashes. Passkeys supported. A bot check and rate limits on sign-in. Sessions end after 30 days, or 7 days without use.
• Mailbox passwords and keys stored encrypted (AES-256-GCM).
• Each customer's data is walled off from every other customer's in the database, so a query can only see its own account. BUILD: Stage 2, tested on every release.
• Our staff open a workspace only with the customer's permission, and every visit is logged. BUILD: guard 6.
• Releases run first on Figured Media's own Relay and reach Attunr only after a health check.

The data processing agreement, annex 2, has the full list.

11. How we look after information

• Who's responsible. Our privacy officer (section 2) approves these practices and handles complaints. Only staff who need it for their work can reach personal information, and each is bound to keep it confidential.
• Keeping and destroying. We keep each kind of information for the time in section 9, then delete it or make it anonymous. Backups age out on their own schedule.
• New features. Before we build or change a feature that handles personal information, we check its privacy effects and record what we decided.
• Incidents. We keep a register of every incident for at least 5 years and follow section 13.
• Complaints. Write to hello@attunr.com. We answer within 30 days. If you're not satisfied, see section 16.

12. Your rights

You can ask us to:

• show you the information we hold about you;
• correct it;
• delete it, when we no longer need it and the law doesn't require us to keep it;
• give it to you, or to someone you name, in a common format that a computer can read (Law 25 and GDPR);
• stop sharing it or remove links to it, when sharing it breaks the law or hurts your reputation (Law 25);
• stop using it for marketing, at any time;
• explain any decision made about you by automated means (Law 25 and GDPR).

You can also withdraw your consent. If you do, we may have to close your account.

EU visitors can also object to processing and ask us to limit it.

To ask, write to hello@attunr.com. We answer within 30 days. We may ask you to prove who you are first.

For information in a customer's workspace (you're a lead or a contact), see section 1.

13. If something goes wrong

• If a breach puts people at real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and tell the people affected as soon as we can (PIPEDA).
• For people in Quebec, when an incident presents a risk of serious injury, we promptly tell the Commission d'accès à l'information and the people affected (Law 25).
• We keep a record of every breach and incident, whether or not it had to be reported, for at least 5 years. That covers PIPEDA's 24 months and Law 25's 5 years.
• When the breach is in a customer's workspace, we tell the customer within 48 hours of becoming aware of it, so they can do the same. See the data processing agreement.
• Where the GDPR applies to us, we tell the EU authority within 72 hours when it requires.

14. Children

Attunr is for businesses. It isn't meant for anyone under 18, and we don't knowingly collect information about children.

15. Changes

We post changes here with a new date. For important changes we email account owners at least 30 days ahead.

16. Complaints

Please write to us first at hello@attunr.com. You can also complain to:

• the Office of the Privacy Commissioner of Canada (priv.gc.ca);
• in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca);
• in the EU, the data protection authority where you live.

We sell Attunr only to businesses in Canada and the US, so we haven't named a representative in the EU. If that changes, we'll name one here.