Privacy Policy

1. Overview
In short
This notice explains what personal data TopoTopic processes, why, on which legal basis, who receives it, how long it is kept, and the rights you have under the GDPR. The short boxes summarize; the full text governs.
This Privacy Policy explains how TopoTopic ("TopoTopic", "we", "us") processes personal data when you use our website and services at topotopic.com (the "Service"). It is written to meet the transparency requirements of Articles 12 to 14 of the EU General Data Protection Regulation (GDPR).
The controller of this processing is the TopoTopic operator identified in our Legal Notice / Imprint. TopoTopic is operated from Austria and is in the process of incorporating there; the Legal Notice is updated as registration details are finalized. We have not appointed a data protection officer; privacy requests go to the contact below.
TopoTopic is operated independently. Unless a written agreement or the Legal Notice says otherwise, people or organizations outside the TopoTopic operator that may be connected with developing, supporting, facilitating, hosting, funding, reviewing, advising on, or providing services to TopoTopic do not operate the Service solely because of that connection. A party's data-protection role depends on its actual processing and applicable law. Some providers also act as independent controllers for their own account, security, or legal purposes.
This policy applies to the Service, including workspaces, capture and import flows, Newsstand, Messages calls, live translation, and AI-assisted features. For contractual terms, see our Terms of Service.
Contact for all privacy matters: support@topotopic.com.

2. Data we process
We process personal data in these categories:
Account and profile data: email address, display name, handle, password hash (never the password itself), sign-in identifiers (for example a Google account identifier or passkey public key), profile fields you choose to fill in (such as title, bio, location, website, links, avatar, banner), timezone, and account settings.
Content you create or import: documents, uploads, URLs, recordings, transcripts, notes, messages, collections, context documents, share settings, and related metadata.
Voice and audio data: audio you record or upload, transcripts, in-session speaker labels, and, only if you separately opt in, a short voice reference clip used to recognize you as a speaker (see Section 7).
Derived and operational data: artifacts we generate to run the Service, such as summaries, keywords, embeddings, graph structures, ranking signals, learning progress, and indexing artifacts.
Usage data: feature usage events, page views, and coarse location (country and region) derived from network information. Our first-party analytics store does not keep your raw IP address.
Security and log data: server logs (with truncated IP addresses), session records including IP address and browser information, sign-in attempt records, and audit events used to keep accounts safe.
Connected-service data: linked Google account identifiers, Google Calendar connection state, authorization tokens for services you connect, imported source metadata, and authorization status.
Consent and acceptance records: which document versions you accepted, when, from which network address and browser, and the consent choices you made, kept as proof of compliance.
Billing data (when paid plans are enabled): subscription state, invoices, and limited billing metadata from our payment processor. Payment card numbers are handled by the processor, not stored by us.
Support communications: messages you send to our support address.
You are not legally required to provide personal data, but core data (such as an email address) is needed to create and secure an account; without it the Service cannot be provided.

3. Purposes and legal bases
In short
Almost everything we do with your data happens because you asked for a feature that needs it. Security runs on legitimate interest, optional analytics and voice recognition run on consent, and records are kept for legal obligations and legitimate interests.
We process personal data for the following purposes, each with its legal basis under Article 6 GDPR:
Purpose | Main data used | Legal basis |
Providing the Service you request: accounts, storage, sync, search and retrieval, transcription, analysis, collaboration, sharing you enable, and support | Account, content, voice and audio, derived, connected-service data | Contract, Art. 6(1)(b) |
AI-assisted features you invoke (summaries, answers, keyword extraction, translation, Newsstand articles, learning content) | Content, derived data | Contract, Art. 6(1)(b) |
Optional voice recognition (cross-session speaker matching) | Voice reference clip (special category, see Section 7) | Explicit consent, Art. 6(1)(a) with Art. 9(2)(a); revocable at any time |
Keeping the Service and accounts secure: abuse and fraud prevention, sign-in monitoring, session integrity, rate limiting, audit logging | Security and log data | Legitimate interests, Art. 6(1)(f): protecting the Service, our users, and their content |
Service emails: verification, security notices, account lifecycle | Account data | Contract, Art. 6(1)(b) |
Optional product analytics and advertising measurement | Usage data, analytics identifiers | Consent, Art. 6(1)(a); device storage and access only with consent under the Austrian TKG |
Error monitoring and reliability diagnostics | Error events with scrubbed identifiers | Legitimate interests, Art. 6(1)(f): keeping the Service working |
Keeping proof of legal acceptance and consent decisions | Consent and acceptance records | Legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f) |
Preserving provenance and audit records to investigate incidents and resolve disputes | Provenance records, audit events | Legitimate interests, Art. 6(1)(f): establishing and defending legal claims |
Compliance with legal obligations and lawful requests | The data covered by the obligation | Legal obligation, Art. 6(1)(c) |
Billing and entitlements (when paid plans are enabled) | Billing data | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests, you can object as described in Section 15. We do not sell personal information and we do not share personal information for cross-context behavioral advertising.

4. AI processing and transparency
In short
AI features send the material they need to contracted providers: OpenAI for language, voice, image understanding, and embeddings; AssemblyAI for speech-to-text; Anthropic as an alternate chat provider where enabled. We never train models on your content, and where a provider offers it our terms with them exclude general model training. AI output can be wrong.
The Service processes workspace content using third-party AI providers to generate the outputs you request. Depending on the feature path, this may involve sending portions of your content, audio, URLs, transcripts, public-safe topic or query text, or related metadata to:
OpenAI: language model features (answers, summaries, keyword extraction, learning content, question generation), voice assistant and live translation, transcription and speaker labeling for some paths, text-to-speech, embeddings, and image understanding and generation.
AssemblyAI: live and uploaded-file speech-to-text, speaker labeling, and transcript analysis for some session features (which receives transcript text, not only audio). Live transcription can use AssemblyAI's EU endpoints for EU visitors when regional routing information is available; uploaded-file transcription and some analysis paths currently use United States endpoints.
Anthropic: an alternate assistant chat provider that can serve chat responses where enabled; current product flows default to OpenAI.
We do not use Customer Content to train or fine-tune general artificial intelligence or machine learning models. When we send content to these providers, we contract with them, where available, to process Customer Content only for the outputs or imports you request and not for general model training. Provider names, purposes, regions, and transfer safeguards are listed at Subprocessors.
Provider retention. Our current OpenAI configuration does not guarantee zero data retention. OpenAI may keep API content in abuse-monitoring logs for up to 30 days, subject to its terms and legal or safety exceptions. OpenAI Responses API requests that use the provider default or set store to true can also retain response application state for at least 30 days. Newsstand Deep Research uses a stored background response so the Service can poll for and retrieve the requested result.
Conversational and voice surfaces in the Service are automated AI assistants. When the assistant helps you search, summarize, or draft actions, it may retrieve workspace context and call integrated providers only to complete the workflow you requested. Generated material can contain errors, and search, retrieval, and ranking involve machine-generated representations of your content (such as embeddings). Review AI output before relying on it; it is not professional advice.
For Newsstand, topic selection may use an AI provider to rank broad interest topics over redacted signals derived from your recent activity, such as concept labels and short excerpts with internal identifiers removed. The public-web research request itself is built from the selected broad interest topic and public-safe keyword refinements rather than private workspace content, private session notes, or internal workspace identifiers.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Ranking, recommendations, and learning-schedule features personalize what you see inside the product; they do not determine your legal position or access to essential services.

5. Voice and audio recording
When you use voice recording features:
Audio is captured on your device and transmitted to our servers, or, for some live voice-assistant and translation features, streamed directly from your browser to the provider.
Audio may be sent to providers such as AssemblyAI or OpenAI to generate live transcripts, uploaded-file transcripts, speaker-labeled outputs, summaries, translations, call-native transcript artifacts, or voice-assistant responses, depending on the feature path.
Recorded audio is stored with the session until the session or account is deleted, or until you delete the original recording in Studio; transcripts and analysis you keep are preserved.
Transcripts are stored in your workspace for search and retrieval.
Speaker attribution in this context is per-session labeling (for example "Speaker 1" and "Speaker 2"). By default, TopoTopic does not store voice reference data and does not identify speakers across sessions.
Voice assistant and call workflows may also search your workspace, translate active call audio using live translation, persist call transcript artifacts, or draft next actions. If an assistant flow prepares a Google Calendar event or a message draft, the action remains pending until you approve it in Messages.
Recording and transcription depend on feature requirements, including in-session speaker labeling and audio retention, which are core to how these features work. If your recordings include other people, you are responsible for obtaining their consent where required by law.

6. Imports from URLs, documents, and external sources
When you import URLs or external content:
We may retrieve public or user-authorized metadata, page text, captions, transcript text, thumbnails, or linked-media metadata from the source or associated APIs. The fetch is made from our servers, so the source sees a request for the URL you imported.
Imported content can be converted into workspace items, summaries, keywords, embeddings, and graph structures.
For YouTube imports, we retrieve publicly available metadata and captions using the YouTube Data API and caption providers, and do not download or store the video file itself through that flow.
Uploaded documents and images are parsed on our infrastructure and may be processed by the AI providers described in Section 4 for the features you request. Upload security checks include malware scanning where the file type and upload path require it; a required scan must pass before processing. These checks do not guarantee that every file is harmless.
You must have the right to import and process any content you submit. Our use of the YouTube API is subject to the YouTube Terms of Service and Google Privacy Policy. External source services, websites, and connected accounts process your request under their own terms. Do not import private, paid, confidential, or restricted content unless you have permission to process it in TopoTopic.

7. Optional voice recognition
In short
Voice recognition is off by default. If you switch it on, we keep a short clip of your voice to recognize you as a speaker in your own future sessions. You can revoke this at any time. Revocation stops matching immediately and starts deletion of the stored clip.
If you opt in to Voice Recognition (Settings, Privacy), a short audio reference clip (2 to 10 seconds) is stored to help automatically label you as a speaker in future sessions within your workspace. Because this data can uniquely identify you from characteristics of your voice, it is a special category of personal data under Article 9 GDPR, and we process it only with your explicit consent (Article 9(2)(a) GDPR).
The clip is used only for the speaker matching workflow you requested. During matching it is sent to OpenAI as part of the transcription request, together with the display names used to label matched speakers. It is not used to identify you anywhere outside your own workspace, and it is not used for advertising or training general models.
You can revoke consent at any time in Settings, Privacy. Revocation deactivates the profile immediately and starts deletion of the stored reference clip, subject to the backup and legal-retention limits described in Section 12. Revoking consent does not affect the lawfulness of processing before the revocation.

8. How we share information
We share personal data only in these situations:
Service providers (processors): vendors that process data on our behalf to run the Service, for example cloud hosting and storage, speech processing, AI providers, source and calendar integrations, email delivery, consent-gated analytics, error monitoring, and payments. Providers acting as our processors handle data under their data-processing terms; some also process data independently for their own account, security, or legal purposes. The current schedule is at Subprocessors.
Within your workspace and shared sessions: content you add to a shared workspace or collaborative session is visible to workspace members, administrators, or direct collaborators according to roles and settings.
Sharing you enable: if you make content public or create an unlisted share link, it is accessible according to that share scope. Some share links do not expire until revoked. Link-shared content can be forwarded by recipients, and accepted share links may allow the recipient to view or copy the shared material into their own workspace where the product permits.
Operator access: our administrative tooling allows audited, reason-coded operator access to account records and to limited, redacted content excerpts for support, abuse review, and incident investigation.
Legal and safety: to comply with law, respond to lawful requests, protect rights and safety, and prevent fraud or abuse.
Business transfers: if we are involved in a merger, acquisition, financing, incorporation of the operating entity, or sale of assets, personal data may be transferred as part of that transaction under appropriate safeguards.
We do not intentionally submit link-shared pages to search engines, and share pages are marked not to be indexed; we cannot control what third parties do with links you give them. Content you explicitly set to public is different: public pages are included in our sitemap and can be indexed by search engines.
User profiles are not published to the open internet. Signed-in users can reach a profile through a direct link, handle search, in-product interactions, or people discovery suggestions. The profile visibility setting controls whether your profile appears in people discovery and similar suggestion surfaces; members of workspaces you share can still view your profile.

9. Cookies and device storage
We use cookies and similar technologies for essential functionality (authentication, security, consent storage, and service operation), for preferences, and for analytics only when you choose to enable it. Optional analytics scripts stay off until you consent, and you can change your choice at any time in Settings, Privacy.
The complete list of cookies, browser storage, lifetimes, and controls is in our Cookie Policy.

10. Analytics, telemetry, and error monitoring
In short
Analytics is opt-in. If you enable it, we measure usage with our own pipeline (no raw IP stored), Google Analytics and PostHog, including measurement of which advertisements lead to sign-ups and use of the product. PostHog receives an internal account identifier and limited product context, not your email or profile name. Error monitoring runs separately with identifiers scrubbed.
First-party analytics. With your consent, we record product events (page views, feature usage, experiment assignment) keyed to a random analytics session identifier and, when you are signed in, an account reference. Event records can include the address and title of the page you were viewing. The first-party analytics store keeps coarse location (country and region) rather than raw IP addresses. Event records in the current analytics pipeline are deleted after 90 days. Some measurement records are retained longer for aggregate product measurement: session-level records, signup and funnel milestone records with their acquisition attribution, and a small suppression registry that enforces analytics exclusions. Retained measurement records are deleted or stripped of your account reference when your account is deleted.
Google Analytics 4 and Google Ads measurement. Loaded only after you enable analytics. This choice also enables Google advertising measurement storage and data use to attribute conversions. Google receives measurement identifiers, page and event information, and, when available, the advertisement click identifier, so sign-ups and first sessions can be associated with an ad click. Collection includes individual events and identifiers, even when reports show aggregate totals. Google advertising signals and ad personalization remain disabled in our configuration.
PostHog. Loaded only after you enable analytics. PostHog is hosted in the United States, and requests are routed through our own domain. If you are signed in and analytics is enabled, we identify the analytics profile with your internal TopoTopic account identifier and may include account class, plan tier, current product surface, release and environment context, and first-visit attribution such as campaign or referrer. We do not currently send your email, display name, handle, or avatar as PostHog person properties. On a small set of pages, session replay may capture interaction recordings with all inputs masked and sensitive elements excluded.
Error monitoring (Sentry). To detect and fix failures, error events with stack traces and runtime metadata are sent to Sentry with EU-region ingestion. Error reports are sent without your IP address attached, and emails, tokens, cookie values, and internal identifiers are redacted from report contents before sending. This runs on our legitimate interest in keeping the Service working.
Reliability signals. The app reports web performance metrics and client error reports to our own endpoints for reliability purposes.
Withdrawing analytics consent stops future collection from that browser; it does not retroactively delete analytics records collected while consent was enabled, which expire on the schedules above.

11. International data transfers
In short
Our primary storage is in the EU (Ireland). Providers used for particular features may process copies elsewhere. A provider's EU address or EU ingestion endpoint does not by itself mean all of its processing stays in the EU.
Our primary infrastructure (AWS) is located in the EU (Ireland, eu-west-1), and error monitoring uses EU-region ingestion. Some service providers process personal data in the United States or other countries outside the European Economic Area when you use the related features.
For those transfers we rely on the safeguards of Chapter V GDPR:
Adequacy decisions (Art. 45 GDPR): including the EU-US Data Privacy Framework where the receiving provider and service are covered by a current certification.
EU Standard Contractual Clauses (Art. 46(2)(c) GDPR): used under provider data-processing terms for transfers not covered by an adequacy decision. AssemblyAI additionally offers EU endpoints, which we use for live transcription of EU visitors where regional routing information is available.
The per-provider schedule is maintained at Subprocessors. You can request a copy of the relevant safeguards via support@topotopic.com. Provider establishment and regional routing are separate from the legal safeguard for any onward transfer outside the EEA.

12. Data retention
We keep personal data only as long as needed for the purposes above. Current retention practice:
Data | Retention |
Workspace content, sessions, recorded audio, transcripts | Until deleted by you or a workspace administrator |
Account data | While your account is active, then the 30-day deactivation grace period after a deletion request, scheduled cleanup and any storage-deletion retries, and the time for backups to cycle out |
Derived data (embeddings, keywords, graph and index artifacts) | Deleted or de-linked with the source deletion; storage cleanup completes asynchronously afterwards. Some derived learning artifacts and de-linked operational records persist until account deletion, subject to shared-workspace retention and backup cycles |
Server and application logs | Up to 30 days |
First-party analytics events | Event records in the current pipeline are deleted after 90 days; session-level and funnel milestone records are retained longer for aggregate measurement and are deleted or stripped of your account reference on account deletion |
Security records (session histories, sign-in attempts) | Kept while relevant to account security, abuse prevention, and incident investigation; security audit records are retained as an audit trail with your user reference removed on account deletion |
Encrypted database backups | Rolling short-term window (at least a 7-day point-in-time recovery window), plus operational snapshots and temporary database copies used for infrastructure work. Deleted data leaves the rolling window as it cycles out and leaves operational snapshots and temporary copies when those copies are deleted |
Data export files | Download access expires 7 days after generation. The encrypted storage object is not currently deleted automatically when that access expires and can remain until a separate operational cleanup |
Legal acceptance and consent records | Kept as proof of compliance while your account exists; after account deletion, erasure receipts with your user reference removed are retained as proof of deletion |
Deletion audit records | Kept as proof of erasure with your user reference removed or set to null |
We may retain limited information beyond these periods where a legal obligation requires it, or where it is necessary to establish, exercise, or defend legal claims.

13. Deletion, export, and your controls
In short
You can delete individual sessions, request account deletion (a 30-day grace period followed by scheduled cleanup), and export supported data as a machine-readable file from Settings, Privacy. The current limitations on privacy export files are stated below.
Deleting content. You can delete sessions and content inside the product. Session deletion runs through a verified erasure process that removes the session's content, transcripts, audio files (including stored file versions), embeddings, and graph entries, and records a verification receipt. Learning and practice artifacts generated from a session and de-linked operational records can persist until account deletion.
Deleting your account. Requesting account deletion in Settings, Privacy requires recent verification with a passkey or password. If your account has neither, for example because you use only Google sign-in, contact support for an assisted request. Requesting deletion first deactivates the account and starts a 30-day grace period during which signing in cancels the deletion. After the grace period, a scheduled purge removes account-scoped data and stored file versions covered by the deletion workflow, subject to the limits in Section 12. Cleanup can take longer than the grace period if storage deletion needs to be retried. If you are the last owner of a shared workspace, you may need to transfer ownership before deletion can complete. Content you contributed to shared workspaces may remain available to other members, and messages you sent to other users remain in those conversations, in each case with references to your user removed or set to null.
What deletion cannot reach. Deletion inside the Service does not delete copies or excerpts previously exported, downloaded, copied, or retained by other workspace members or share recipients, and records held by independent services (for example the payment processor) are governed by their own retention obligations. The account purge does not currently enumerate already-generated privacy export objects, which can remain in encrypted storage until a separate operational cleanup.
Exporting your data. Settings, Privacy lets you request a machine-readable export. Exports currently include user-owned collection and session metadata across workspaces where you are a member, plus user-owned upload metadata, stored transcript text, parsed upload text, user-facing session analysis items, and report records where available. Exports do not currently include original file binaries, bearer-style share tokens, shared-workspace records retained by others, internal embeddings, hidden system analysis records, backups, or legal-retention copies. Session reports can additionally be exported from the product in document formats.
The self-service export is not a complete response to every GDPR access request. For other personal data, including account, consent, security, or message records not covered by that export, contact support@topotopic.com. Use the same contact if a deletion or export control is unavailable or fails.

14. Security
We apply technical and organizational measures designed to protect personal data (Article 32 GDPR), including encryption in transit (TLS) and at rest, authenticated route, role, and workspace checks, row-level security on many user-content tables, scoped credentials, malware scanning of uploads, audit logging, and receipt-backed verification for specific deletion flows. Not every user-content table relies on database row-level security. Our Security and Responsible Disclosure page describes how to report vulnerabilities.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected users in line with Articles 33 and 34 GDPR.
No system is completely secure. You are responsible for maintaining the security of your own account credentials and devices.

15. Your rights
In short
You can ask for access, correction, deletion, restriction, portability, and you can object to legitimate-interest processing and withdraw any consent. You can also complain to the Austrian data protection authority or your local one.
Under the GDPR you have the right to:
Access (Art. 15): obtain a copy of your personal data and information about the processing.
Rectification (Art. 16): have inaccurate data corrected.
Erasure (Art. 17): have data deleted where the conditions apply.
Restriction (Art. 18): limit processing in certain situations.
Portability (Art. 20): receive data you provided in a structured, commonly used, machine-readable format.
Objection (Art. 21): object, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop unless compelling legitimate grounds override, or the processing serves legal claims.
Withdraw consent (Art. 7(3)): where processing is based on consent, withdraw it at any time with effect for the future, without affecting the lawfulness of processing before withdrawal.
The fastest paths are the built-in controls (Settings, Privacy) for export, deletion, consent, and voice recognition. For anything else, contact support@topotopic.com. We will verify your identity and respond within one month; for complex requests this can be extended by up to two further months, and we will tell you if that happens.
Some requests may be limited by law, by security requirements, or by the need to preserve shared-workspace records, audit and provenance evidence, fraud-prevention records, or the rights of other users. Where a request is limited, we will explain why.
Complaints. You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. The authority for Austria is: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, telephone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.

16. Children
The Service is not directed at children under 16, and our Terms of Service require users to be at least 16 years old. We do not knowingly process personal data of children under 16; if you believe a child has created an account, contact support@topotopic.com and we will delete it.

17. Regional notes
United Kingdom and Switzerland. If you are in the UK or Switzerland, the rights and safeguards described in this policy apply equivalently under UK GDPR and the Swiss Federal Act on Data Protection.
California and other regions. We extend the core controls in this policy (access, export, deletion, no sale of personal information, no sharing for cross-context behavioral advertising) to all users regardless of location. If your local law grants you additional rights, contact support@topotopic.com and we will handle the request under that law where it applies to us.
Browser privacy signals. We do not currently respond to browser "Do Not Track" or Global Privacy Control signals. Optional analytics stays off unless you enable it through the consent controls, regardless of those signals.

18. Changes to this policy
We update this policy when the product or our providers change. Each version carries a version identifier and a "Last updated" date, and material changes are presented for review and renewed acceptance in the product before you continue using the Service.

19. Contact
Privacy questions and requests: support@topotopic.com. Controller and operator details are published in the Legal Notice / Imprint.