Privacy Notice

This Privacy Notice explains how ATTEX AB processes data when you participate in our mobile panel used to measure media exposure and attention behaviour on mobile devices.

Data Controller ATTEX AB

ATTEX AB is the controller of the data the app collects.

Contact: info@attexdata.ai

Postal address: ATTEX AB Kvarnvägen 53 182 39 Danderyd Sweden

We process data in order to:

• —measure media exposure and attention behaviour across mobile devices and environments;
• —use AI models to find ads and understand the context they appear in (see “AI and machine learning”);
• —operate and improve ATTEX AB’s panel-based measurement product;
• —administer your membership and rewards, such as gift cards and bonuses for new members, and send you emails about your participation, for example when measurement has stopped or a reward is on its way;
• —if you applied to the Swedish panel and gave us your mobile number, contact you to invite you to a survey about how installing the app went;
• —check that accounts and rewards are genuine, for example so that duplicate or test accounts do not receive rewards;
• —validate performance across devices, operating systems, cohorts, and markets;
• —measure advertising for our customers, advertisers and media agencies, and give them the ad-level records and reports described under “Who Do We Share Data With?”;
• —generate aggregated insights, analytics, benchmarking, and reporting outputs;
• —support research and product development; and
• —publish aggregated findings that never identify an individual, each figure based on at least 10 panel members.

We do not sell or share the raw screen data the app collects.

The ATTEX Panel app uses Android’s accessibility service, which you turn on yourself after the app has asked for your consent. With it, the app reads the text and layout of what appears on your screen in the apps and browsers you use, and the taps and scrolls you make, so that we can measure which ads you see. Messaging apps such as WhatsApp, Messenger, Signal and the phone’s SMS app, and sensitive apps such as banking, health and dating apps, are on a blocklist and are not read. Messages shown in other apps, for example direct messages in social media apps, can still be read when they appear on your screen. The blocklist is not complete and does not cover websites, so sensitive information can still be collected.

Depending on how you use those supported apps and browsers, we may collect:

• —device model and operating system version;
• —technical device metadata;
• —timestamps and session-related identifiers;
• —app package names;
• —browser URLs;
• —search queries;
• —visible interface text captured from app or browser contexts, including text you type, for example in searches and AI chat apps;
• —taps, long presses and scrolls, and which part of the screen they were on;
• —gaze / attention measurements from the front camera, which is used now and then while you use your phone with measurement switched on — camera images are processed on the phone only and are never stored or transmitted; what is kept is the point on the screen you looked at, when, and how reliable the measurement was;
• —device identifiers: the Firebase installation ID and the token used to send you notifications;
• —the approximate location your IP address indicates (country, region, city and time zone) and your network operator, recorded each time the app uploads data; we use this to detect fraudulent sign-ups. The IP address itself is not stored with your data; it is kept only in our server logs, for up to 30 days;
• —diagnostics: crash reports (Firebase Crashlytics), app usage events (Firebase Analytics), the state of the measuring service, battery and network (AWS), and usage statistics from Google’s on-device face-tracking libraries (ML Kit and MediaPipe), which contain no images;
• —your mobile number, if you applied to the Swedish panel and chose to give it;
• —what you tell us when you apply: your email address, first name, date of birth, gender and region;
• —information about your participation: the campaign or link you applied through, the days on which we received measurement data from the app, and the rewards you have earned and been sent; and
• —a panel ID linked to your participation record.

We do not collect screenshots or screen recordings.

Because the measurement technology reads app and browser context on your screen, some visible on-screen content may be collected as part of the measurement process.

This may sometimes include:

• —usernames;
• —social media posts or comments;
• —search terms;
• —URLs;
• —text visible in supported apps or browser pages; and
• —content relating to third parties.

We do not intentionally collect sensitive or third-party data, but such information may appear incidentally depending on what is visible on your screen. Such information about people who are not panel members is processed on the basis of our legitimate interest in measuring advertising; if you think your information appears on a panel member’s screen, you can object or ask about it at info@attexdata.ai.

Our legal basis for this processing is your consent. Where sensitive information may appear incidentally in collected content, we rely on your explicit consent where required.

To administer your membership and rewards, including emails about your participation, we rely on our agreement with you under the panel terms.

To check that accounts and rewards are genuine, we rely on our legitimate interest in giving rewards only to real members.

Giving your mobile number is optional. We use it only to invite you to the survey about the installation, and we rely on your consent. We keep the number for as long as you are a member of the panel. You can withdraw your consent at any time by emailing info@attexdata.ai, and we then delete the number.

Participation is voluntary, and you can pause or withdraw at any time.

We keep raw and intermediate panel data for a maximum of 12 months for operational, quality assurance, validation, and analysis purposes.

Within this 12-month period, we ensure that raw and intermediate datasets are either:

• —deleted; or
• —transformed into anonymised derived data that no longer contains personal data and cannot be linked back to you or other individuals by any reasonably likely means.

Where data has been transformed into genuinely anonymised derived data, it may be retained for a longer period for purposes such as benchmarking, analytics, reporting, research, product development, and commercial insight generation.

We use service providers to support our operations, including hosting, communications, chat support, operational systems, consent management, panel administration, and technical services.

Relevant systems and providers may include:

• —AWS;
• —AI service providers;
• —Salesforce;
• —Firebase;
• —Customer.io;
• —GoGift (delivery of gift cards);
• —Crisp (chat support on attexpanel.com);
• —Alchemer;
• —panel providers; and
• —relevant technical SDK providers.

Our customers are advertisers, media agencies and their partners. They receive two kinds of data:

• —ad-level records: one record per ad shown, with the app or website it appeared in, the ad’s own text and image link, how long it was on screen, whether it was looked at and for how long, together with a code that stands in for your name and your age, gender and region. The records never contain your name, email address, phone number or anything else that was on your screen; and
• —aggregated reports and statistics, in which each figure covers at least 5 panel members.

We study ads, not people: no report describes one person. The public only ever sees aggregated findings.

We use AI models to read the screen text the app collects, to find the ads and understand the context they appear in, for example the topic of the page or conversation around an ad and whether the ad matches it. The models are run by AI service providers on our behalf, under a data processing agreement, and may not use the text to train their own models. Sensitive topics, such as health, religion or politics, are never categorised, and the results are used only in aggregated statistics.

Customers may use the ad-level records and reports described above, including to train their own models of advertising performance. They never receive the raw screen data the app collects.

We use EU-based hosting infrastructure, including AWS services in Ireland and Stockholm.

Some service providers, including AI and email providers, may process data outside the EU/EEA, for example in the United States. We then rely on the EU–US Data Privacy Framework or the EU standard contractual clauses; you can ask us for a copy at info@attexdata.ai.

You can:

• —choose whether to participate;
• —pause measurement; and
• —withdraw your consent and leave the panel at any time, without affecting processing before you withdrew.

You can ask us to delete your data by emailing info@attexdata.ai from the address you joined with. We delete the data linked to your panel ID within 30 days. Ad-level records already delivered to customers before your request cannot be recalled, but they never contain your name or contact details.

Under GDPR, you may also have rights of access, rectification, erasure, restriction, objection, and the right to lodge a complaint with a supervisory authority.

We use technical and organisational safeguards designed to protect data, including encrypted transmission, protected storage environments, restricted access to raw data, and restricted access to systems that contain identity-linkage information.

We may update this Privacy Notice if our processing changes. If we make material changes, we will inform participants as required.

ATTEX AB Contact: info@attexdata.ai

If you write to us in the chat on attexpanel.com, we process your messages, the name or email address you give us, and technical details about your browser and the page you wrote from, so that we can answer you. The chat is provided by Crisp, which keeps the conversation on servers in the EU on our behalf. Nothing is loaded from Crisp, and nothing is sent to it, until you open the chat yourself. We keep chat conversations for a maximum of 12 months.

Please do not send sensitive information in the chat, for example about health, faith or political views, and never send passwords. To recognise you as a panelist we only need the email address you joined with.

Postal address: ATTEX AB Kvarnvägen 53 182 39 Danderyd Sweden