Privacy Policy

1. Who is responsible
In short
This notice explains what personal data TopoTopic processes, why, on which legal basis, who receives it, how long it is kept, and the rights you have under the GDPR. The short boxes summarize; the full text governs.
The controller responsible for the processing described here is the operator of TopoTopic identified in the Legal Notice / Imprint("TopoTopic", "we", "us"). TopoTopic is operated from Austria. We have not appointed a data protection officer.
Contact for every privacy matter: support@topotopic.com.
This notice covers the website and service at topotopic.com (the "Service"). It is written to meet Articles 12 to 14 of the EU General Data Protection Regulation (GDPR). The Terms of Service are the contract; this notice is information, and nothing in it asks for your consent except where it says so.

2. Personal data we process
Account and profile data: email address, display name, handle, password hash where you set a password, sign-in identifiers (a Google account identifier or a passkey public key), profile fields you fill in (title, bio, location, website, links, avatar, banner), time zone and account settings.
Content you create or import: recordings, uploads, documents, imported links, transcripts, notes, tasks and reminders, collections, context documents, posts, connections to other users, and share settings.
Messages and calls: messages you exchange with other users or with the assistant, call metadata (participants, times, consent state), and, only when every participant agreed in the call, call transcripts and summaries. Calls are not recorded.
Voice and audio data: audio you record or upload, transcripts, per-session speaker labels, and, only if you separately opt in where the feature is offered, a short voice reference clip (section 7).
Derived data: what the Service generates from your content: summaries, keywords, embeddings, graph structures, ranking signals, learning items and progress, and reports.
Addresses you give us for others: email addresses you enter to invite someone to a workspace or to email a share link from the document reader.
Usage data (only with analytics consent): feature usage events, page views, experiment assignment, and coarse location (country and region). Our analytics store does not keep your IP address.
Security and log data: server logs with shortened IP addresses; sign-in sessions with IP address and browser information; sign-in attempt records with IP address and a hash of the email address used; audit records of security-relevant actions, assistant tool use and real-time connections, which can include the IP address; and a random identifier for your browser as a recording device.
Connected-service data: linked Google account identifiers, authorization tokens for Google services you connect, Google Calendar connection state, and metadata of sources you import.
Acceptance and consent records: which versions of the Terms, this notice and the Cookie Policy you accepted, a fingerprint of their text, when, and from which IP address and browser; and your cookie consent choice.
Reports: content reports you file or that concern your content, our decision on them, and its reasons.
Correspondence: messages you send to our contact address.
Billing data: none at present. Paid plans are not offered.
You are not legally required to give us personal data. An email address or a Google account is needed to create and secure an account; without one we cannot provide the Service.

3. Purposes and legal bases
In short
Almost everything happens because you asked for a feature that needs it. Security, fixing failures and keeping proof run on our legitimate interests. Analytics and voice recognition happen only with your consent.
Purpose | Data | Legal basis (GDPR) |
Providing the Service: accounts, storage, transcription, analysis, search and retrieval, learning, workspaces, messages and calls, people search and suggestions in Connect, sharing you enable, invitations and share emails you send, and support | Account and profile data, content, messages and calls, voice and audio, derived data, connected-service data, addresses you give us for others | Contract, Art. 6(1)(b) |
AI features you use: summaries, answers, keyword extraction, translation, learning content, the voice assistant | Content, voice and audio, derived data | Contract, Art. 6(1)(b) |
Voice recognition across your sessions, where offered | Voice reference clip (special category, section 7) | Explicit consent, Art. 6(1)(a) with Art. 9(2)(a); you can withdraw it at any time |
Service emails: verification, security notices, account lifecycle | Account data | Contract, Art. 6(1)(b) |
Security: abuse and fraud prevention, sign-in monitoring, session integrity, rate limiting, audit logging | Security and log data | Legitimate interests, Art. 6(1)(f): protecting the Service, its users and their content |
Diagnosing and fixing failures in processing a session, and verifying the fix, by the operator (section 8) | The content of the affected session, derived data, log data | Legitimate interests, Art. 6(1)(f): delivering a working Service to the person whose session failed. You can object (section 16) |
Error monitoring and reliability diagnostics | Error events with identifiers redacted | Legitimate interests, Art. 6(1)(f): keeping the Service working |
Handling content reports and deciding on them | Reports, the reported content, our decision | Legal obligation, Art. 6(1)(c), under the Digital Services Act, and legitimate interests, Art. 6(1)(f): keeping unlawful content off the Service |
Optional product analytics and advertising measurement | Usage data, analytics identifiers | Consent, Art. 6(1)(a); storing and reading information on your device only with consent under section 165(3) of the Austrian Telecommunications Act 2021 |
Keeping proof of which Terms you accepted, and of your consent choices | Acceptance and consent records | Legitimate interests, Art. 6(1)(f): establishing, exercising and defending legal claims; and accountability, Art. 5(2) and 7(1) |
Complying with legal obligations and lawful requests | The data the obligation covers | Legal obligation, Art. 6(1)(c) |
We do not sell personal data, and we do not use it for advertising profiles.

4. AI processing
In short
AI features send the material they need to OpenAI (language, voice, images, embeddings) and AssemblyAI (speech-to-text). We do not train models on your content. OpenAI can keep API content for up to 30 days, and longer for some requests, as described below.
To produce the outputs you request, the Service sends portions of your content, audio, transcripts, URLs and related metadata to:
OpenAI: answers, summaries, keyword extraction, learning content and question generation; the voice assistant and live translation; transcription and speaker labeling on some paths; text-to-speech; embeddings; image understanding and generation. For the voice assistant and live translation, your browser connects to OpenAI directly with a short-lived credential issued by our servers.
AssemblyAI: live and uploaded-file speech-to-text, speaker labeling, and transcript analysis for some session features, for which it receives transcript text as well as audio. Live transcription uses AssemblyAI's EU endpoints when our servers can tell that the request comes from the EU; uploaded-file transcription and analysis use United States endpoints.
No other AI provider receives your content. The Subprocessors page lists integrations that exist in the Service but are not enabled.
We do not use your content or data derived from it to train or fine-tune artificial intelligence models. What a provider may do with the content it receives is governed by its terms for API customers.
Provider retention. Our OpenAI configuration does not guarantee zero data retention. OpenAI may keep API content in abuse-monitoring logs for up to 30 days, subject to its terms and to legal or safety exceptions. Requests to OpenAI's Responses API that use the default storage setting can also keep response state for at least 30 days. Deleting a session in TopoTopic does not delete what a provider has retained under its own terms.
Newsstand is currently switched off. Where it is enabled, topic selection may use OpenAI to rank broad interest topics over redacted signals from your recent activity, such as concept labels and short excerpts with internal identifiers removed. The public-web research request is built from the selected topic and public-safe keyword refinements, not from private workspace content, private session notes or internal identifiers, and it uses a stored background response so that the Service can retrieve the result.
The assistant is an automated AI system. When it helps you search, summarize or prepare an action, it retrieves workspace content you have access to and calls the providers above only to complete what you asked. AI output can be wrong; check it before you rely on it.
We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Article 22 GDPR). Ranking, recommendations and learning schedules personalize what you see inside the product and nothing else.

5. Recordings, voice and calls
Audio you record is captured on your device and sent to our servers, which pass it to AssemblyAI or OpenAI for transcription. Recorded audio is stored with the session until you delete the recording, the session or your account.
Speaker labels are per session ("Speaker 1", "Speaker 2"). The Service does not recognize speakers across sessions unless you opt in to voice recognition (section 7).
Calls. Audio calls in Messages connect the participants' browsers directly, or through our own relay server when a direct path is not possible. Calls are not recorded. Live translation, call-native transcript artifacts and summaries are created only after every participant has agreed in the call; until then the Service refuses to store transcript text. With live translation, call audio is sent from your browser to OpenAI, and the translated speech you hear is AI-generated.
Connection setup. To set up a real-time audio connection (voice assistant, live translation, listen-along or a call) your browser asks a public STUN server operated by Google for its public network address. Google receives your IP address and port for this, and no audio, content or account data.
When the assistant prepares an action for you, such as a Google Calendar event or a message draft, nothing is sent until you approve it.
If your recordings include other people, you are responsible for having the consent the law requires. Section 9 tells those people what we do with their data.

6. Imports and connected Google services
Links. When you import a link, our servers fetch it, directly or through Supadata, so the site sees a request from TopoTopic for that address. We retrieve page text, captions or transcripts, thumbnails and metadata, and turn them into items, summaries, keywords, embeddings and graph entries. This includes links to Dropbox shared files and to arXiv papers.
YouTube. The Service uses YouTube API Services to retrieve public video metadata, and retrieves captions through Supadata or YouTube. It does not download or store the video through this flow and does not access your YouTube account. The YouTube Terms of Service and the Google Privacy Policy apply to that use.
Uploads. Documents and images are parsed on our infrastructure and can be sent to the providers in section 4 for the features you use. Where the file type and upload path require a malware scan, the scan must pass before processing. A scan cannot guarantee that a file is harmless.
Google Calendar. If you connect Google Calendar, the Service requests permission only to manage events that it creates itself. It creates, updates and deletes the events you approve and reads those same events back to check for conflicts. It does not read your other calendar entries, and it does not send Google Calendar data to AI providers. You can disconnect in Settings or withdraw access at any time in your Google Account permissions.
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
Import only content you have the right to process. Sites and services you import from handle your request under their own terms.

7. Voice recognition
In short
Voice recognition is currently switched off for everyone. Where we offer it, it is off until you turn it on for yourself, it stores a short clip of your voice, and you can revoke it at any time.
Where the feature is offered and you opt in (Settings, Privacy), a reference clip of 2 to 10 seconds of your voice is stored so that the Service can label you as a speaker in your later sessions. Because this data identifies you by your voice, it is a special category of personal data under Article 9 GDPR, and we process it only with your explicit consent. You can enroll only your own voice.
During matching the clip is sent to OpenAI as part of the transcription request, together with the display names used to label matched speakers. It is not used for any other purpose.
You can revoke consent at any time in Settings, Privacy. Revocation stops matching immediately and starts deletion of the stored clip; copies in backups expire as section 13 describes. Revocation does not affect the lawfulness of earlier processing.

8. Who receives personal data
Providers. The companies listed at Subprocessors receive the data stated there. Those acting as processors work under data-processing agreements; those marked as independent controllers handle the data they receive under their own privacy notices.
Your workspace. Content you add to a shared workspace or collaborative session is visible to its members, administrators and collaborators according to roles and settings.
Other signed-in users. Signed-in users can open your profile through a direct link, handle search or an interaction with you. Your profile visibility setting controls whether you appear in people search and suggestions; members of workspaces you share can always see your profile. Posts you publish in Connect are visible to the members of the workspace you post in, and to others only if you share them. Profiles are not published to the open internet.
People you share with. An unlisted share link works for anyone who has it and does not expire until you revoke it; links to a single upload expire after the period you choose. Recipients can forward a link and, where the product allows it, copy shared material into their own workspace. Shared pages are marked not to be indexed by search engines. Content you explicitly publish is different: it is included in our sitemap and can be indexed.
Authorities and courts, where the law requires it or to establish, exercise or defend legal claims.
A successor. When the company being formed to operate TopoTopic takes over the Service, or in a merger or sale of the business, personal data passes to the new operator, which is bound by this notice.
Access by the operator. People acting for TopoTopic look at your content only to give support you asked for, to diagnose and fix a failure in processing a session and verify the fix, to investigate a report, abuse or a security incident, or where the law requires it. There are two ways this happens, and both are recorded:
Admin tools inside the product. An activity overview shows each recent session's title, keywords, status and the owner's handle. It shows no summaries, transcripts or email addresses. To read content, an administrator must open a review, which requires a reason code and a written justification, shows excerpts limited to 2,000 characters, and creates an audit record.
Operational diagnosis by the operator with direct database access. The overview used day to day shows shortened session titles, status, timing and a pseudonymous account label, without email addresses, handles or summaries. Opening summaries, account identities, or the transcript and content of one session requires a reason code and a written justification, and is refused unless an audit record can be written first. Downloading a session's audio is a separate step with its own recorded justification. An audit record names the tool, the reason, the session concerned and the categories of data opened, never the content itself. Routine operational queries that return counts and metadata are recorded in the same way but are not blocked if the record cannot be written. Copies made for a review are kept in a protected local folder and deleted when the review ends, at the latest after 7 days. The review procedure keeps session content out of AI-assisted engineering tools.

9. If you are not a user
Users can bring information about other people into the Service. You may be concerned if a user recorded or uploaded a conversation you took part in, mentioned you in notes or documents, was in a call with you, or entered your email address to invite you to a workspace or to send you a share link.
What we process: your voice and what you said in a recording, a per-session speaker label, mentions of you in content, or your email address. We receive this data from the user, not from you.
Why and on what basis: to provide the Service to that user (legitimate interests, Art. 6(1)(f): the user's interest in working with their own material). We do not use it for anything else, do not build a profile of you, and do not contact you except to deliver the invitation or share link the user sent.
Who is responsible: the user who captured or uploaded the material decides what it contains and is your first point of contact. For what we do with it, we are responsible.
Your rights: the rights in section 16 apply to you too. Write to support@topotopic.com and tell us enough to find the material, for example who recorded it and when. We may need to involve that user to act on your request.
We cannot notify each person who appears in user content individually, because we do not know who they are; this section is how we inform you (Article 14(5)(b) GDPR).

10. Cookies and device storage
We use cookies and browser storage that are strictly necessary for sign-in, security and the features you use, and, only with your consent, for analytics. The Cookie Policy lists every cookie with its purpose and lifetime and explains how to change your choice.

11. Analytics and error monitoring
In short
Analytics is opt-in. If you enable it, we measure usage with our own pipeline, Google Analytics and PostHog, and measure which advertisements lead to sign-ups. PostHog receives an internal account identifier, not your email or name. Error monitoring runs separately with identifiers redacted.
First-party analytics. With your consent we record product events (page views with page address and title, feature usage, experiment assignment) keyed to a random analytics session identifier and, when you are signed in, to your account. We keep country and region, not your IP address.
Google Analytics 4 and Google Ads measurement. Loaded only after you enable analytics. The same choice enables Google's advertising measurement storage so that conversions can be attributed. Google receives measurement identifiers, page and event information, and the advertisement click identifier when there is one, so that sign-ups and first sessions can be associated with an ad click. Google receives individual events and identifiers, even though its reports show totals. Advertising personalization and Google signals are disabled in our configuration.
PostHog. Loaded only after you enable analytics. PostHog is hosted in the United States and reached through our own domain. When you are signed in we identify the analytics profile with your internal account identifier and may add account class, plan, product surface, release, environment and first-visit attribution. We do not send your email, display name, handle or avatar. Session replay can run only on public pages that are not part of the signed-in product, with all text and inputs masked and media blocked.
Error monitoring (Sentry). Error events with stack traces and runtime metadata are sent to Sentry with EU ingestion, without your IP address, and with emails, tokens, cookie values and internal identifiers redacted. Session replay is not used in Sentry. The app also reports web performance measurements and client errors to our own servers.
Withdrawing analytics consent stops further collection from that browser. Records already collected expire as section 13 describes.

12. Transfers outside the EEA
In short
Our storage is in the EU (Ireland). Providers used for particular features process data elsewhere, mainly in the United States. A provider's EU address or EU endpoint does not mean that all of its processing stays in the EU.
Our databases, file storage and servers are at AWS in the EU (Ireland, eu-west-1). Requests reach them through the AWS content delivery location nearest to you, which can be outside the EU. The providers named in sections 4, 5 and 11 process personal data in the United States or other countries outside the European Economic Area when you use the related feature.
For these transfers we rely on Chapter V GDPR:
Adequacy decisions (Art. 45), in particular the EU-US Data Privacy Framework where the provider's certification covers the service we use.
EU Standard Contractual Clauses (Art. 46(2)(c)) in the provider's data-processing terms, for transfers that no adequacy decision covers.
The Subprocessors page states the location and safeguard for each provider. You can ask us for a copy of the safeguards at support@topotopic.com.

13. How long we keep data
Data | Kept for |
Workspace content, sessions, recorded audio, transcripts, messages, posts | Until you or a workspace administrator delete it, or your account is deleted |
Derived data (embeddings, keywords, graph entries, learning items made from a session) | Deleted with the session or item it came from; file cleanup completes shortly afterwards |
Account and profile data | While your account exists. After a deletion request: a 30-day grace period, then a scheduled purge, with retries if file deletion fails. We do not currently delete inactive accounts automatically |
Voice reference clip | Until you revoke voice recognition or your account is deleted |
Server and application logs | 30 days |
Analytics events and cookie consent records in the current pipeline | 90 days |
Measurement tables from before the current pipeline (page views, interactions, analytics sessions, search logs, experiments, sign-up funnel milestones) | No longer written to and without an automatic expiry at present. Deleted, or stripped of your account reference, when your account is deleted |
Sign-in sessions | Removed after they expire |
Sign-in attempt records and audit records (security actions, assistant tool use, real-time connections, operator access, report decisions), which can include an IP address | No automatic expiry at present. Sign-in attempts hold a hash of the email address, not the address. Your account reference is removed from audit records when your account is deleted |
Acceptance record for the Terms, this notice and the Cookie Policy | The full record, with IP address and browser, while your account exists. A reduced proof without IP address or browser (a keyed hash of your email address, the versions and text fingerprints you accepted, and the date) for 3 years after your account is deleted, the period in which claims under the contract can be brought |
Content reports and our decisions on them | No automatic expiry at present; the reporter's account reference is removed when that account is deleted |
Privacy export files | Download access ends 7 days after the file is generated. The encrypted file itself is not yet deleted automatically and remains until an operational cleanup |
Copies made by the operator for a session review | Deleted when the review ends, at the latest after 7 days |
Encrypted database backups | Continuous backup with a 7-day recovery window. In addition, manual snapshots taken before infrastructure or schema work, which have no automatic expiry; one snapshot from February 2026 is kept as a recovery baseline. Data you delete disappears from the 7-day window as it rolls forward, and from a manual snapshot only when that snapshot is deleted. Snapshots are not used for any purpose other than recovery |
Deletion receipts | Kept as proof of erasure, without your account reference |
Where a row says that there is no automatic expiry at present, we have not yet set a period. We will state one here when we have. We keep data longer than stated only where a legal obligation requires it or where it is needed for a specific legal claim.

14. Deleting and exporting your data
In short
You can delete sessions, request deletion of your account (30 days to change your mind, then a scheduled purge), and export your data as a machine-readable file in Settings, Privacy. The limits of each are stated below.
Deleting a session runs a verified erasure that removes its content, transcripts, audio files including stored file versions, embeddings, graph entries, learning items and generated questions, and records a receipt.
Deleting your account in Settings, Privacy requires recent verification with a passkey or password. If you sign in only with Google, write to support@topotopic.com from the address of your account and we will start the deletion for you after confirming the request with you. The request deactivates the account and starts a 30-day period in which signing in cancels the deletion. After that a scheduled purge removes your account data and stored files; it can take longer if file deletion has to be retried. If you are the last owner of a shared workspace, you must transfer ownership first.
What deletion does not reach. Content you contributed to a shared workspace and messages you sent to other users remain available to them, without your name attached. Copies that other people exported or downloaded are outside our control. Privacy export files you generated earlier, and the backups and records listed in section 13, remain for the periods stated there.
Exporting your data. The export in Settings, Privacy contains the metadata of your collections and sessions, upload metadata, stored transcript text, parsed upload text, the analysis items shown to you, and report records. It does not contain original files, share tokens, records held by other workspace members, embeddings, internal analysis records, account and profile data, messages, or consent records. Session reports can also be exported from the product as documents.
The self-service export is therefore not a complete answer to an access request under Article 15 GDPR. For everything else, or if a control fails, write to support@topotopic.com.

15. Security
We protect personal data with encryption in transit (TLS) and at rest, authenticated route, role and workspace checks, database row-level security on many but not all content tables, scoped credentials, malware scanning of uploads where the upload path requires it, audit logging, and verified deletion for sessions. Our Security and Responsible Disclosure page gives more detail and explains how to report a vulnerability.
If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the supervisory authority and, where Articles 33 and 34 GDPR require it, you.

16. Your rights
Under the GDPR you have the right to:
Access (Art. 15): a copy of your personal data and information about the processing.
Rectification (Art. 16) of inaccurate data.
Erasure (Art. 17) where its conditions apply.
Restriction (Art. 18) of processing in certain situations.
Portability (Art. 20): the data you provided, in a structured, commonly used, machine-readable format.
Object (Art. 21), on grounds relating to your situation, to processing based on legitimate interests. We then stop unless we have compelling legitimate grounds or need the data for legal claims.
Withdraw consent (Art. 7(3)) at any time with effect for the future.
The quickest way is the controls in Settings, Privacy (export, deletion, analytics consent, voice recognition). For anything else write to support@topotopic.com. We verify your identity and answer within one month; for complex requests the law allows two further months, and we tell you if we need them.
A request can be limited by the rights of other people, for example other members of a shared workspace, or by our need to keep the proof and audit records listed in section 13. If we limit a request, we tell you why.
Complaints. You can complain to a supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where you believe the infringement happened. The authority for Austria is the Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, telephone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.

17. Children
The Service is for people aged 16 and over, and users confirm their age when they accept the Terms of Service. We do not knowingly process personal data of children under 16. If you believe a child has created an account, write to support@topotopic.com and we will delete it.

18. Users outside the EU
We apply this notice and the controls it describes to every user, wherever they live. If the law of your country gives you further rights, write to support@topotopic.com and we will handle your request under that law where it applies to us.

19. Changes to this notice
We update this notice when the Service, our providers or the law change. Each version has a version identifier and a date, and earlier versions remain available at Document versions. We show you a materially changed notice in the product before you continue using the Service.

20. Contact
Privacy questions and requests: support@topotopic.com. The Legal Notice / Imprint identifies the controller.