Privacy Policy

At a glance
The numbered sections below are the full notice and they govern. This overview says what happens in the situations people ask about most.
You record, upload or import. The material is stored at AWS in Ireland. To transcribe and analyze it, parts of it go to AI providers, mostly in the United States (sections 4 to 6). It stays until you delete it.
You talk to the assistant or use Live. Your audio goes from your browser to OpenAI. A translated call is translated by AI from the moment it connects, and its captions are stored (section 5).
You share. New memos are private. What you add to a shared workspace is visible to its members, and a share link opens for anyone who has it (section 8).
You allow analytics. Google Analytics, Google Ads measurement and PostHog, including masked session replays, run only after you allow them, and you can switch them off at any time (section 11).
You delete. Deleting a memo erases it, with the exceptions listed in section 14. Deleting your account takes effect after 30 days.
What we do not do. We do not sell personal data, we do not use it for advertising profiles, and we do not train AI models on your content.
Your rights, and how to use them, are in section 16. Questions: support@topotopic.com.

1. Who is responsible
In short
This notice explains what personal data TopoTopic processes, why, on which legal basis, who receives it, how long it is kept, and the rights you have under the GDPR. The short boxes summarize; the full text governs.
The controller responsible for the processing described here is the operator of TopoTopic identified in the Legal Notice / Imprint ("TopoTopic", "we", "us"). TopoTopic is operated from Austria. We have not appointed a data protection officer.
Contact for every privacy matter: support@topotopic.com.
This notice covers the website and service at topotopic.com (the "Service"). It is written to meet Articles 12 to 14 of the EU General Data Protection Regulation (GDPR). The Terms of Service are the contract; this notice is information, and nothing in it asks for your consent except where it says so.

2. Personal data we process
Account and profile data: email address, display name, handle, password hash where you set a password, sign-in identifiers (a Google account identifier or a passkey public key), profile fields you fill in (title, bio, location, website, links, availability for opportunities, résumé link and overview, avatar, banner), time zone and account settings.
Content you create or import: recordings, uploads, documents, imported links, pasted text, transcripts, notes, tasks and reminders, collections, context documents, posts, the people you follow, and share settings. Questions you ask about a memo are kept with your name.
Messages and calls: messages you exchange with other users or with the assistant. For calls: the participants and times, the connection data the browsers exchange, including network addresses, the captions shown during translation, the consent state, and, only when every participant agreed in the call, call transcripts and summaries. Calls are not recorded.
Voice and audio data: audio you record, upload or translate with Live, transcripts and captions, per-session speaker labels and the names you give speakers, and, only if you separately opt in where the feature is offered, a short voice reference clip (section 7).
Derived data: what the Service generates from your content: summaries, notes, insights, questions, decisions and actions, keywords, the topics and the people named in your material that the Map shows, embeddings, thumbnails, ranking signals, learning items and progress, and reports.
Addresses you give us for others: email addresses you enter to invite someone to a workspace.
Usage data (only with analytics consent): page views, feature usage events, experiment assignment, masked session replays, and coarse location (country and region). Our analytics store does not keep your IP address.
Service statistics: records that certain actions happened, for example that a message was sent or a search was run, with the time, the product area and your account, without the content (section 11).
Security and log data: server logs with shortened IP addresses; request records; sign-in sessions with IP address and browser information; sign-in attempt records with IP address and a hash of the email address used; audit records of security-relevant actions, assistant tool use and real-time connections, which can include the IP address; and a random identifier for your browser as a recording device.
Connected-service data: linked Google account identifiers, authorization tokens for Google services you connect, Google Calendar connection state, and metadata of sources you import.
Acceptance and consent records: which versions of the Terms, this notice and the Cookie Policy you accepted, a fingerprint of their text, when, and from which IP address and browser; and your cookie consent choice.
Reports: content reports you file or that concern your content, our decision on them, and its reasons.
Correspondence: messages you send to our contact address.
Billing data: none at present. Paid plans are not offered.
You are not legally required to give us personal data. An email address or a Google account is needed to create and secure an account; without one we cannot provide the Service.

3. Purposes and legal bases
In short
Almost everything happens because you asked for a feature that needs it. Security, fixing failures, service statistics and keeping proof run on our legitimate interests, and you can object to them. Analytics and voice recognition happen only with your consent.
Purpose | Data | Legal basis (GDPR) |
Providing the Service: accounts, storage, transcription, analysis, search and retrieval, the Map, learning, tasks and reminders, workspaces, messages and calls, live translation, finding people by handle in Connect, sharing you enable, invitations you send, and support | Account and profile data, content, messages and calls, voice and audio, derived data, connected-service data, addresses you give us for others | Contract, Art. 6(1)(b) |
AI features you use: transcription, reports, decisions and actions, answers, keyword, topic and people extraction for the Map, translation, text to speech, thumbnails, the voice assistant and the searches it runs for you | Content, voice and audio, derived data | Contract, Art. 6(1)(b) |
Voice recognition across your sessions, where offered | Voice reference clip (special category, section 7) | Explicit consent, Art. 6(1)(a) with Art. 9(2)(a); you can withdraw it at any time |
Service emails: verification, security notices, account lifecycle | Account data | Contract, Art. 6(1)(b) |
Security: abuse and fraud prevention, sign-in monitoring, session integrity, rate limiting, audit logging | Security and log data | Legitimate interests, Art. 6(1)(f): protecting the Service, its users and their content |
Diagnosing and fixing failures in processing a session, and verifying the fix, by the operator (section 8) | The content of the affected session, derived data, log data | Legitimate interests, Art. 6(1)(f): delivering a working Service to the person whose session failed. You can object (section 16) |
Service statistics: understanding which features are used and how well | Service statistics (section 11), without content | Legitimate interests, Art. 6(1)(f): operating, securing and improving the Service. You can object (section 16) |
Error monitoring and reliability diagnostics | Error events with identifiers redacted | Legitimate interests, Art. 6(1)(f): keeping the Service working |
Handling content reports and deciding on them | Reports, the reported content, our decision | Legal obligation, Art. 6(1)(c), under the Digital Services Act, and legitimate interests, Art. 6(1)(f): keeping unlawful content off the Service |
Optional product analytics and advertising measurement | Usage data, analytics identifiers | Consent, Art. 6(1)(a); storing and reading information on your device only with consent under section 165(3) of the Austrian Telecommunications Act 2021 |
Keeping proof of which Terms you accepted, and of your consent choices | Acceptance and consent records | Legitimate interests, Art. 6(1)(f): establishing, exercising and defending legal claims; and accountability, Art. 5(2) and 7(1) |
Complying with legal obligations and lawful requests | The data the obligation covers | Legal obligation, Art. 6(1)(c) |
We do not sell personal data, and we do not use it for advertising profiles.

4. AI processing
In short
AI features use OpenAI language models through AWS, OpenAI directly for voice, translation, text to speech, images and embeddings, and AssemblyAI for speech to text, all in the United States. We do not train models on your content. Providers can keep some requests for up to 30 days, as described below.
To produce the outputs you request, the Service sends portions of your content, audio, transcripts, URLs and related metadata to:
AWS Bedrock: OpenAI language models, run by AWS, for answers, report sections, decisions and actions, keyword and topic extraction, the topics, people and connections on the Map and their explanations, the questions used to retrieve your material, and image understanding. These requests use United States endpoints in Northern Virginia and Oregon, and OpenAI does not receive them. When you ask the assistant to look something up on the web, the search query it writes goes to the web search of AWS Bedrock in the United States, which can fetch public web pages to answer it.
OpenAI directly: the voice assistant, whose audio connection runs between your browser and OpenAI after our servers set it up, together with the recent part of your conversation; Live and translated calls, for which your browser connects to OpenAI with a short-lived credential issued by our servers; transcription and speaker labeling for some languages and paths; text to speech for Listen and read-aloud; embeddings; and memo thumbnails, which are made automatically from a memo's title, summary and keywords. OpenAI also receives a pseudonymous identifier for your account with some requests, and metadata about the assistant's tool calls, such as the tool name and timing, without their content.
AssemblyAI: live and uploaded-file speech to text and speaker labeling, for which it receives audio. Its processing takes place in the United States: uploaded files always use its United States endpoints, and live transcription can use its EU endpoints only when our servers can tell that a request comes from the EU, which at present they cannot.
In addition, Supadata can create a transcript with AI when you import a link to media that has none (section 6). No other AI provider receives your content. The Subprocessors page lists integrations that exist in the Service but are not enabled.
We do not use your content or data derived from it to train or fine-tune artificial intelligence models. What a provider may do with the content it receives is governed by its terms for API customers.
Provider retention. Our OpenAI configuration does not guarantee zero data retention. OpenAI may keep API content in abuse-monitoring logs for up to 30 days, subject to its terms and to legal or safety exceptions. Our AWS Bedrock requests use store: false, so response state is not stored for later retrieval; AWS states that it can keep requests that its abuse detection flags for up to 30 days and that it does not share them with the model provider. Deleting a session in TopoTopic does not delete what a provider has retained under its own terms.
The assistant is an automated AI system. When it helps you search, summarize or prepare an action, it retrieves workspace content you have access to and calls the providers above only to complete what you asked. AI output can be wrong; check it before you rely on it.
We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Article 22 GDPR). Ranking, recommendations and learning schedules personalize what you see inside the product and nothing else.

5. Recordings, voice and calls
Audio you record is captured on your device and sent to our servers, which pass it to AssemblyAI or OpenAI for transcription. Recorded audio is stored with the session until you delete the recording, the session or your account.
Speaker labels are per session ("Speaker 1", "Speaker 2"). A name you give a speaker applies to that session. The Service does not recognize speakers across sessions unless you opt in to voice recognition (section 7).
Translated calls. Audio calls between users connect the participants' browsers directly, or through our own relay server when a direct path is not possible. Calls are not recorded. From the moment a call connects, each participant's browser sends the speech it receives to OpenAI for translation, and the translated speech you hear is AI-generated. The captions shown during the call, in both languages, are stored with the call. A call transcript and summaries are created only after every participant has agreed in the call; until then the Service refuses to store transcript text. To connect a call, the browsers exchange connection data, including network addresses, through our servers, and we keep it with the call.
Live. When you translate your microphone, a browser tab or a media file with Live, the audio goes from your browser to OpenAI, and the captions are stored with your Live session. If the audio includes other people, section 9 applies to them.
Connection setup. To set up a translated call or a Live session, your browser asks a public STUN server operated by Google for its public network address. Google receives your IP address and port for this, and no audio, content or account data.
When the assistant prepares a message or a Google Calendar event for you, nothing is sent or created until you approve it.
If your recordings include other people, you are responsible for having the consent the law requires. Section 9 tells those people what we do with their data.

6. Imports and connected Google services
Links. When you import a link, our servers fetch it, directly or through Supadata, so the site sees a request from TopoTopic for that address. We retrieve page text, captions or transcripts, thumbnails and metadata, and turn them into items, summaries, keywords, embeddings and entries on the Map. For a video, podcast or social media link without a transcript, Supadata can create one with AI. This includes links to Dropbox shared files and to arXiv papers. Our servers also fetch links posted in messages, to show a preview.
YouTube. The Service uses YouTube API Services to retrieve public video metadata, and retrieves captions through Supadata or from YouTube, using our own account. If you enable AI transcription when importing a YouTube link, Supadata can process the video's audio to create a transcript when captions are unavailable. TopoTopic does not download or store the video through this flow and does not access your YouTube account. A YouTube link in a message is shown with YouTube's embedded player and thumbnail, which your browser loads from Google when the message is on screen. The YouTube Terms of Service and the Google Privacy Policy apply to that use.
Uploads and pasted text. Documents, images and text you paste are parsed on our infrastructure and can be sent to the providers in section 4 for the features you use. Where the file type and upload path require a malware scan, the scan must pass before processing. A scan cannot guarantee that a file is harmless.
Google Calendar. If you connect Google Calendar, the Service requests permission only to manage events that it creates itself. It then creates and updates events for your reminders and for tasks that have a due date, and the events the assistant prepares once you approve them, and it reads those same events back to check for conflicts. It does not read your other calendar entries, and it does not send Google Calendar data to AI providers. You can disconnect in Settings or withdraw access at any time in your Google Account permissions.
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
Import only content you have the right to process. Sites and services you import from handle your request under their own terms.

7. Voice recognition
In short
Voice recognition is currently switched off for everyone. Where we offer it, it is off until you turn it on for yourself, it stores a short clip of your voice, and you can revoke it at any time.
Where the feature is offered and you opt in (Settings, Privacy), a reference clip of 2 to 5 seconds of your voice is stored so that the Service can label you as a speaker in your later sessions. Because this data identifies you by your voice, it is a special category of personal data under Article 9 GDPR, and we process it only with your explicit consent. You can enroll only your own voice.
During matching the clip is sent to OpenAI as part of the transcription request, together with the display names used to label matched speakers. It is not used for any other purpose.
You can revoke consent at any time in Settings, Privacy. Revocation stops matching immediately and starts deletion of the stored clip; copies in backups expire as section 13 describes. Revocation does not affect the lawfulness of earlier processing.

8. Who receives personal data
Providers. The companies listed at Subprocessors receive the data stated there. Those acting as processors work under data-processing agreements; those marked as independent controllers handle the data they receive under their own privacy notices.
Your workspace. Content you add to a shared workspace, other than a memo you keep private, is visible to its members, administrators and collaborators according to roles and settings. Questions you ask about a memo, and their answers, are shown with your name to everyone who can open that memo. A correction that an editor makes to the Map is stored with that editor's account and changes the Map for every member.
Other signed-in users. Signed-in users can open your profile through a link or a conversation. Your profile visibility setting controls whether people outside your workspaces can find you by name and what they see on your profile; members of workspaces you share can always see it. Posts you publish in Connect are visible to the members of the workspace you post in, and to others only if you share them. Profiles are not published to the open internet. When you invite a friend, the invitation page shows your name to anyone who has its link.
People you share with. New memos are private. A share link opens for anyone who has it, although a link to a memo can require sign-in. Links made in the Share dialog of Library expire after the period you choose, 7 days unless you change it; links made from the Share sheet of a report, and links to a collection, an item or a workspace, work until you turn them off; links to a single source file expire after 24 hours. Recipients can forward a link and, where the product allows it, copy shared material into their own workspace. Shared pages are marked not to be indexed by search engines, with one exception: a collection you make public has its own page, which is included in our sitemap and can be indexed. If you pass a link on through another service, such as X, Bluesky, Instagram or WhatsApp, that service receives it.
Authorities and courts, where the law requires it or to establish, exercise or defend legal claims.
A successor. When the company being formed to operate TopoTopic takes over the Service, or in a merger or sale of the business, personal data passes to the new operator, which is bound by this notice.
Access by the operator. People acting for TopoTopic look at your content only to give support you asked for, to diagnose and fix a failure in processing a session and verify the fix, to investigate a report, abuse or a security incident, or where the law requires it. There are two ways this happens, and both are recorded:
Admin tools inside the product. An activity overview shows each recent session's title, keywords, status and the owner's handle. It shows no summaries, transcripts or email addresses. To read content, an administrator must open a review, which requires a reason code and a written justification, shows excerpts limited to 2,000 characters, and creates an audit record.
Operational diagnosis by the operator with direct database access. The overview used day to day shows shortened session titles, status, timing and a pseudonymous account label, without email addresses, handles or summaries. Opening summaries, account identities, or the transcript and content of one session requires a reason code and a written justification, and is refused unless an audit record can be written first. Downloading a session's audio is a separate step with its own recorded justification. An audit record names the tool, the reason, the session concerned and the categories of data opened, never the content itself. Routine operational queries that return counts and metadata are recorded in the same way but are not blocked if the record cannot be written. Copies made for a review are kept in a protected local folder and deleted when the review ends, at the latest after 7 days. The review procedure keeps session content out of AI-assisted engineering tools.

9. If you are not a user
Users can bring information about other people into the Service. You may be concerned if a user recorded, uploaded or translated a conversation you took part in, mentioned you in notes or documents, was in a call with you, or entered your email address to invite you to a workspace.
What we process: your voice and what you said in a recording, a per-session speaker label or the name a user gave you as a speaker, mentions of you in content, including your name, your role and things assigned to you that the Service extracts from it, or your email address. We receive this data from the user, not from you.
Why and on what basis: to provide the Service to that user (legitimate interests, Art. 6(1)(f): the user's interest in working with their own material). We do not use it for anything else, do not build a profile of you across users, and do not contact you except to deliver the invitation the user sent.
Who is responsible: the user who captured or uploaded the material decides what it contains and is your first point of contact. For what we do with it, we are responsible.
Your rights: the rights in section 16 apply to you too. Write to support@topotopic.com and tell us enough to find the material, for example who recorded it and when. We may need to involve that user to act on your request.
We cannot notify each person who appears in user content individually, because we do not know who they are; this section is how we inform you (Article 14(5)(b) GDPR).

10. Cookies and device storage
We use cookies and browser storage that are strictly necessary for sign-in, security and the features you use, and, only with your consent, for analytics. The Cookie Policy lists every cookie with its purpose and lifetime and explains how to change your choice.

11. Analytics and error monitoring
In short
Analytics is opt-in. If you enable it, we measure usage with our own pipeline, Google Analytics and PostHog, record masked session replays, and measure which advertisements lead to sign-ups. PostHog receives internal identifiers, not your email or name. Independently of that choice, our servers count which features are used, without content. Error monitoring runs separately with identifiers redacted.
First-party analytics. With your consent we record product events from your browser (page views with page address and title, feature usage, experiment assignment) keyed to a random analytics session identifier and, when you are signed in, to your account. We keep country and region, not your IP address.
Service statistics. Our servers also record that certain actions happened, for example that a message was sent, a search was run or an account deletion was requested, with the time, the product area and page, the experiment group, your account and workspace, and the country and region of the request. These records contain no content and no IP address. They do not depend on your analytics choice because they are made on our servers, not on your device; we keep them to operate, secure and improve the Service, on our legitimate interests, and you can object (section 16). They expire as section 13 describes.
Google Analytics 4 and Google Ads measurement. Loaded only after you enable analytics. The same choice enables Google's advertising measurement storage so that conversions can be attributed. Google receives measurement identifiers, the full address of each page, event information, and the advertisement click identifier when there is one, so that sign-ups and first sessions can be associated with an ad click. Google receives individual events and identifiers, even though its reports show totals. Some sign-up and first-use events are also sent to Google Analytics from our servers, again only with your consent, with your browser's Google Analytics identifier or, when it has none, an identifier derived from our analytics session. Advertising personalization and Google signals are disabled in our configuration.
PostHog. Loaded only after you enable analytics. PostHog is hosted in the United States and reached through our own domain. It receives your IP address with each request and, in our configuration, keeps it with each event. When you are signed in we identify the analytics profile with your internal account identifier and a pseudonymous workspace identifier, and may add account class, plan, product surface, release, environment and first-visit attribution. We do not send your email, display name, handle or avatar.
Session replay. PostHog can record how a page is used, such as clicks, scrolling and page layout. The text you read or write is replaced, inputs are masked, and images, video, audio and network contents are left out; only fixed interface labels, such as the names of buttons, stay readable. A replay therefore shows the shape of a visit and not what you read or wrote. Replay can run on public pages, during sign-up and onboarding, on your first report, and for 10 minutes after you use the controls of Memo, Library or a report. On signed-in pages it runs only if you allowed analytics after this version of the notice took effect; an earlier consent covers replay on public pages only.
Error monitoring (Sentry). Error events with stack traces and runtime metadata are sent to Sentry with EU ingestion, without your IP address, and with emails, tokens, cookie values and internal identifiers redacted. Session replay is not used in Sentry. The app also reports client errors to our own servers and, only with analytics consent, web performance measurements.
Withdrawing analytics consent stops further collection from that browser and removes our own analytics and attribution cookies. Records already collected expire as section 13 describes.

12. Transfers outside the EEA
In short
Our storage is in the EU (Ireland). Providers used for particular features process data elsewhere, mainly in the United States. A provider's EU address or EU endpoint does not mean that all of its processing stays in the EU.
Our databases, file storage and servers are at AWS in the EU (Ireland, eu-west-1). Requests reach them through the AWS content delivery location nearest to you, which can be outside the EU. The providers named in sections 4, 5, 6 and 11 process personal data in the United States or other countries outside the European Economic Area when you use the related feature. For the voice assistant, Live and translated calls, your browser sends audio to OpenAI in the United States directly.
For these transfers we rely on Chapter V GDPR:
Adequacy decisions (Art. 45), in particular the EU-US Data Privacy Framework where the provider's certification covers the service we use.
EU Standard Contractual Clauses (Art. 46(2)(c)) in the provider's data-processing terms, for transfers that no adequacy decision covers.
The Subprocessors page states the location and safeguard for each provider. You can ask us for a copy of the safeguards at support@topotopic.com.

13. How long we keep data
Data | Kept for |
Workspace content, sessions, recorded audio, transcripts, messages, posts | Until you or a workspace administrator delete it, or your account is deleted. Messages and context documents you delete are hidden at once, but their text is kept until the account that holds them is deleted |
Derived data (embeddings, keywords, Map entries, learning items made from a session) | Deleted with the session or item it came from, with the exceptions in section 14; file cleanup completes shortly afterwards. Keyword and topic labels are kept in a shared list without a link to you or to the session |
Call records: participants, times, captions, connection data | Kept with the call. No automatic expiry at present |
Account and profile data | While your account exists. After a deletion request: a 30-day grace period, then a scheduled purge, with retries if file deletion fails. We do not currently delete inactive accounts automatically |
Voice reference clip | Until you revoke voice recognition or your account is deleted |
Server and application logs | 30 days |
Request records kept in our database | No automatic expiry at present |
Analytics events, service statistics and cookie consent records in the current pipeline | 90 days |
What Google Analytics, PostHog and Sentry receive (sections 11 and 12) | Google Analytics: 14 months for events and for user-level data, the user-level period restarting with each visit. PostHog: events up to seven years, the retention of our plan; session replays 30 days. Sentry: 30 days |
Measurement tables from before the current pipeline (page views, interactions, analytics sessions, search logs, experiments, sign-up funnel milestones) | No longer written to and without an automatic expiry at present. Deleted, or stripped of your account reference, when your account is deleted |
Sign-in sessions, including IP address and browser | Kept after they expire or are revoked until your account is deleted. We do not yet remove them automatically |
Sign-in attempt records and audit records (security actions, assistant tool use, real-time connections, operator access, report decisions), which can include an IP address | No automatic expiry at present. Sign-in attempts hold a hash of the email address, not the address. Records of assistant tool use can contain short excerpts of what you asked, up to 500 characters per field. Your account reference is removed from audit records when your account is deleted |
Acceptance record for the Terms, this notice and the Cookie Policy | The full record, with IP address and browser, while your account exists. A reduced proof without IP address or browser (a keyed hash of your email address, the versions and text fingerprints you accepted, and the date) for 3 years after your account is deleted, the period in which claims under the contract can be brought |
Content reports and our decisions on them | No automatic expiry at present; the reporter's account reference is removed when that account is deleted |
Privacy export files | Download access ends 7 days after the file is generated. The encrypted file itself is not yet deleted automatically and remains until an operational cleanup, also after your account is deleted |
Copies made by the operator for a session review | Deleted when the review ends, at the latest after 7 days |
Encrypted database backups | Continuous backup with a 7-day recovery window. In addition, manual snapshots and archives taken before infrastructure or schema work, which have no automatic expiry; one snapshot from February 2026 is kept as a recovery baseline. Data you delete disappears from the 7-day window as it rolls forward, and from a manual snapshot or archive only when that copy is deleted. These copies are not used for any purpose other than recovery |
Deletion receipts | Kept as proof of erasure, with your account identifier and the names of the deleted files but without their content |
Where a row says that there is no automatic expiry at present, we have not yet set a period. We will state one here when we have. We keep data longer than stated only where a legal obligation requires it or where it is needed for a specific legal claim.

14. Deleting and exporting your data
In short
You can delete memos and recordings, request deletion of your account (30 days to change your mind, then a scheduled purge), and export your data as a machine-readable file in Settings, Privacy. The limits of each are stated below.
Deleting a memo runs a verified erasure that removes its recording and transcripts, audio files including stored file versions, its analysis, embeddings, Map entries, learning items and generated questions, and records a receipt. It does not yet reach: the uploaded file a memo was made from, which stays among the workspace's files; your Ask conversations about the memo; short excerpts kept in search and assistant records; notifications that mention it; import records with the address you imported; and Map explanations already shown to you. These remain until the workspace or your account is deleted. Deleting only the recording keeps the transcript and the write-up.
Deleting your account in Settings, Privacy requires recent verification with a passkey or password. If you sign in only with Google, write to support@topotopic.com from the address of your account and we will start the deletion for you after confirming the request with you. The request deactivates the account and starts a 30-day period in which signing in cancels the deletion. After that a scheduled purge removes your account data and stored files; it can take longer if file deletion has to be retried. If you are the last owner of a shared workspace, you must transfer ownership first.
What account deletion does not reach. Sessions and other content you added to a shared workspace stay available to its members, without your name attached. Messages you sent in conversations that other people started stay, without your name. Conversations you started are deleted for every participant, together with their replies. Your posts and your uploaded files are deleted everywhere. A name another user gave you as a speaker in their memo stays in that memo. Copies that other people exported or downloaded are outside our control. Privacy export files you generated earlier, and the backups and records listed in section 13, remain for the periods stated there.
Exporting your data. The export in Settings, Privacy contains the metadata of your collections and sessions, upload metadata, stored transcript text, parsed upload text, every stored analysis item including earlier versions, the questions and answers on your memos, including questions other people asked, and report records. It does not contain original files and recordings, notes, tasks, reminders, saved items, messages, context documents, Map corrections, account and profile data, share tokens, embeddings, records held by other workspace members, or consent records. Reports and answers can also be exported from the product as documents.
The self-service export is therefore not a complete answer to an access request under Article 15 GDPR. For everything else, or if a control fails, write to support@topotopic.com.

15. Security
We protect personal data with encryption in transit (TLS) and at rest, authenticated route, role and workspace checks, database row-level security on many but not all content tables, scoped credentials, malware scanning of uploads where the upload path requires it, audit logging, and verified deletion for sessions. Our Security and Responsible Disclosure page gives more detail and explains how to report a vulnerability.
If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the supervisory authority and, where Articles 33 and 34 GDPR require it, you.

16. Your rights
Under the GDPR you have the right to:
Access (Art. 15): a copy of your personal data and information about the processing.
Rectification (Art. 16) of inaccurate data.
Erasure (Art. 17) where its conditions apply.
Restriction (Art. 18) of processing in certain situations.
Portability (Art. 20): the data you provided, in a structured, commonly used, machine-readable format.
Object (Art. 21), on grounds relating to your situation, to processing based on legitimate interests, such as service statistics and the diagnosis of failed sessions. We then stop unless we have compelling legitimate grounds or need the data for legal claims.
Withdraw consent (Art. 7(3)) at any time with effect for the future.
The quickest way is the controls in Settings, Privacy (export, deletion, analytics consent, voice recognition), or "Cookie preferences" at the foot of public pages for the analytics choice. For anything else write to support@topotopic.com. We verify your identity and answer within one month; for complex requests the law allows two further months, and we tell you if we need them.
A request can be limited by the rights of other people, for example other members of a shared workspace, or by our need to keep the proof and audit records listed in section 13. If we limit a request, we tell you why.
Complaints. You can complain to a supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where you believe the infringement happened. The authority for Austria is the Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, telephone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.

17. Children
The Service is for people aged 16 and over, and users confirm their age when they accept the Terms of Service. We do not knowingly process personal data of children under 16. If you believe a child has created an account, write to support@topotopic.com and we will delete it.

18. Users outside the EU
We apply this notice and the controls it describes to every user, wherever they live. If the law of your country gives you further rights, write to support@topotopic.com and we will handle your request under that law where it applies to us.

19. Changes to this notice
We update this notice when the Service, our providers or the law change. Each version has a version identifier and a date, and earlier versions remain available at Document versions. We show you a materially changed notice in the product before you continue using the Service.

20. Contact
Privacy questions and requests: support@topotopic.com. The Legal Notice / Imprint identifies the controller.