Privacy Policy

This Privacy Policy explains how TopoTopic ("TopoTopic", "we", "us") processes personal data when you use our website and services at topotopic.com(the "Service"). It is written to meet the transparency requirements of Articles 12 to 14 of the EU General Data Protection Regulation (GDPR).

The controller of this processing is the TopoTopic operator identified in our Legal Notice / Imprint. TopoTopic is operated from Austria and is in the process of incorporating there; the Legal Notice is updated as registration details are finalized. We are not currently required to appoint a data protection officer and have not appointed one.

TopoTopic is operated independently. Unless a written agreement or the Legal Notice says otherwise, people or organizations outside the TopoTopic operator that may be connected with developing, supporting, facilitating, hosting, funding, reviewing, advising on, or providing services to TopoTopic do not operate the Service and are not controllers of this processing.

This policy applies to the Service, including workspaces, capture and import flows, Newsstand, Messages calls, live translation, and AI-assisted features. For contractual terms, see our Terms of Service.

Contact for all privacy matters: support@topotopic.com.

We process personal data in these categories:

• Account and profile data: email address, display name, handle, password hash (never the password itself), sign-in identifiers (for example a Google account identifier or passkey public key), profile fields you choose to fill in (such as title, bio, location, website, links, avatar, banner), timezone, and account settings.
• Content you create or import: documents, uploads, URLs, recordings, transcripts, notes, messages, collections, context documents, share settings, and related metadata.
• Voice and audio data: audio you record or upload, transcripts, in-session speaker labels, and, only if you separately opt in, a short voice reference clip used to recognize you as a speaker (see Section 7).
• Derived and operational data: artifacts we generate to run the Service, such as summaries, keywords, embeddings, graph structures, ranking signals, learning progress, and indexing artifacts.
• Usage data: feature usage events, page views, and coarse location (country and region) derived from network information. Our first-party analytics store does not keep your raw IP address.
• Security and log data: server logs (with truncated IP addresses), session records including IP address and browser information, sign-in attempt records, and audit events used to keep accounts safe.
• Connected-service data: linked Google account identifiers, Google Calendar connection state, authorization tokens for services you connect, imported source metadata, and authorization status.
• Consent and acceptance records: which document versions you accepted, when, from which network address and browser, and the consent choices you made, kept as proof of compliance.
• Billing data (when paid plans are enabled): subscription state, invoices, and limited billing metadata from our payment processor. Payment card numbers are handled by the processor, not stored by us.
• Support communications: messages you send to our support address.

You are not legally required to provide personal data, but core data (such as an email address) is needed to create and secure an account; without it the Service cannot be provided.

We process personal data for the following purposes, each with its legal basis under Article 6 GDPR:

Where we rely on legitimate interests, you can object as described in Section 15. We do not sell personal information and we do not share personal information for cross-context behavioral advertising.

The Service processes workspace content using third-party AI providers to generate the outputs you request. Depending on the feature path, this may involve sending portions of your content, audio, URLs, transcripts, public-safe topic or query text, or related metadata to:

• OpenAI: language model features (answers, summaries, keyword extraction, learning content, question generation), voice assistant and live translation, transcription and speaker labeling for some paths, text-to-speech, embeddings, and image understanding and generation.
• AssemblyAI:live and uploaded-file speech-to-text, speaker labeling, and transcript analysis for some session features (which receives transcript text, not only audio). Live transcription can use AssemblyAI's EU endpoints for EU visitors when regional routing information is available; uploaded-file transcription and some analysis paths currently use United States endpoints.
• Google: document understanding and text recognition for document and image processing (including the Focus reading flow and image uploads), plus sign-in, calendar, and YouTube import integrations you connect.
• Anthropic: an alternate assistant chat provider that can serve chat responses where enabled; current product flows default to OpenAI.

We do not use Customer Content to train or fine-tune general artificial intelligence or machine learning models. When we send content to these providers, we contract with them, where available, to process Customer Content only for the outputs or imports you request and not for general model training. Provider names, purposes, regions, and transfer safeguards are listed at Subprocessors.

Conversational and voice surfaces in the Service are automated AI assistants. When the assistant helps you search, summarize, or draft actions, it may retrieve workspace context and call integrated providers only to complete the workflow you requested. Generated material can contain errors, and search, retrieval, and ranking involve machine-generated representations of your content (such as embeddings). Review AI output before relying on it; it is not professional advice.

For Newsstand, topic selection may use an AI provider to rank broad interest topics over redacted signals derived from your recent activity, such as concept labels and short excerpts with internal identifiers removed. The public-web research request itself is built from the selected broad interest topic and public-safe keyword refinements rather than private workspace content, private session notes, or internal workspace identifiers.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Ranking, recommendations, and learning-schedule features personalize what you see inside the product; they do not determine your legal position or access to essential services.

When you use voice recording features:

• Audio is captured on your device and transmitted to our servers, or, for some live voice-assistant and translation features, streamed directly from your browser to the provider.
• Audio may be sent to providers such as AssemblyAI or OpenAI to generate live transcripts, uploaded-file transcripts, speaker-labeled outputs, summaries, translations, call-native transcript artifacts, or voice-assistant responses, depending on the feature path.
• Recorded audio is stored with the session until the session or account is deleted, or until you delete the original recording in Studio; transcripts and analysis you keep are preserved.
• Transcripts are stored in your workspace for search and retrieval.

Speaker attribution in this context is per-session labeling (for example "Speaker 1" and "Speaker 2"). By default, TopoTopic does not store voice reference data and does not identify speakers across sessions.

Voice assistant and call workflows may also search your workspace, translate active call audio using live translation, persist call transcript artifacts, or draft next actions. If an assistant flow prepares a Google Calendar event or a message draft, the action remains pending until you approve it in Messages.

Recording and transcription depend on feature requirements, including in-session speaker labeling and audio retention, which are core to how these features work. If your recordings include other people, you are responsible for obtaining their consent where required by law.

When you import URLs or external content:

• We may retrieve public or user-authorized metadata, page text, captions, transcript text, thumbnails, or linked-media metadata from the source or associated APIs. The fetch is made from our servers, so the source sees a request for the URL you imported.
• Imported content can be converted into workspace items, summaries, keywords, embeddings, and graph structures.
• For YouTube imports, we retrieve publicly available metadata and captions using the YouTube Data API and caption providers, and do not download or store the video file itself through that flow.
• Uploaded documents and images are parsed on our infrastructure; document understanding and text recognition may involve Google as described in Section 4, and uploads are scanned for malware before further processing.

You must have the right to import and process any content you submit. Our use of the YouTube API is subject to the YouTube Terms of Service and Google Privacy Policy. External source services, websites, and connected accounts process your request under their own terms. Do not import private, paid, confidential, or restricted content unless you have permission to process it in TopoTopic.

If you opt in to Voice Recognition (Settings, Privacy), a short audio reference clip (2 to 10 seconds) is stored to help automatically label you as a speaker in future sessions within your workspace. Because this data can uniquely identify you from characteristics of your voice, it is a special category of personal data under Article 9 GDPR, and we process it only with your explicit consent (Article 9(2)(a) GDPR).

The clip is used only for the speaker matching workflow you requested. During matching it is sent to OpenAI as part of the transcription request, together with the display names used to label matched speakers. It is not used to identify you anywhere outside your own workspace, and it is not used for advertising or training general models.

You can revoke consent at any time in Settings, Privacy. Revocation deactivates the profile immediately and starts deletion of the stored reference clip, subject to the backup and legal-retention limits described in Section 12. Revoking consent does not affect the lawfulness of processing before the revocation.

We share personal data only in these situations:

• Service providers (processors): vendors that process data on our behalf to run the Service, for example cloud hosting and storage, speech processing, AI providers, source and calendar integrations, email delivery, consent-gated analytics, error monitoring, and payments. They may process personal data only to provide their service to us. The current schedule, including regions and transfer safeguards, is at Subprocessors.
• Within your workspace and shared sessions: content you add to a shared workspace or collaborative session is visible to workspace members, administrators, or direct collaborators according to roles and settings.
• Sharing you enable: if you make content public or create an unlisted share link, it is accessible according to that share scope. Some share links do not expire until revoked. Link-shared content can be forwarded by recipients, and accepted share links may allow the recipient to view or copy the shared material into their own workspace where the product permits.
• Operator access: our administrative tooling allows audited, reason-coded operator access to account records and to limited, redacted content excerpts for support, abuse review, and incident investigation.
• Legal and safety: to comply with law, respond to lawful requests, protect rights and safety, and prevent fraud or abuse.
• Business transfers: if we are involved in a merger, acquisition, financing, incorporation of the operating entity, or sale of assets, personal data may be transferred as part of that transaction under appropriate safeguards.

We do not intentionally submit link-shared pages to search engines, and share pages are marked not to be indexed; we cannot control what third parties do with links you give them. Content you explicitly set to public is different: public pages are included in our sitemap and can be indexed by search engines.

User profiles are not published to the open internet. Signed-in users can reach a profile through a direct link, handle search, in-product interactions, or people discovery suggestions. The profile visibility setting controls whether your profile appears in people discovery and similar suggestion surfaces; members of workspaces you share can still view your profile.

We use cookies and similar technologies for essential functionality (authentication, security, consent storage, and service operation), for preferences, and for analytics only when you choose to enable it. Optional analytics scripts stay off until you consent, and you can change your choice at any time in Settings, Privacy.

The complete list of cookies, browser storage, lifetimes, and controls is in our Cookie Policy.

First-party analytics. With your consent, we record product events (page views, feature usage, experiment assignment) keyed to a random analytics session identifier and, when you are signed in, an account reference. Event records can include the address and title of the page you were viewing. The first-party analytics store keeps coarse location (country and region) rather than raw IP addresses. Event records in the current analytics pipeline are deleted after 90 days. Some measurement records are retained longer for aggregate product measurement: session-level records, signup and funnel milestone records with their acquisition attribution, and a small suppression registry that enforces analytics exclusions. Retained measurement records are deleted or stripped of your account reference when your account is deleted.

Google Analytics 4. Loaded only after you enable analytics, with IP shortening, without Google advertising signals, and without ad personalization.

PostHog. Loaded only after you enable analytics. PostHog is hosted in the United States, and requests are routed through our own domain. If you are signed in and analytics is enabled, the analytics profile may include your account email, display name, handle, and avatar reference, along with first-visit attribution (for example the campaign or referrer that brought you here). On a small set of pages, session replay may capture interaction recordings with all inputs masked and sensitive elements excluded.

Error monitoring (Sentry). To detect and fix failures, error events with stack traces and runtime metadata are sent to Sentry with EU-region ingestion. Error reports are sent without your IP address attached, and emails, tokens, cookie values, and internal identifiers are redacted from report contents before sending. This runs on our legitimate interest in keeping the Service working.

Reliability signals. The app reports web performance metrics and client error reports to our own endpoints for reliability purposes.

Withdrawing analytics consent stops future collection from that browser; it does not retroactively delete analytics records collected while consent was enabled, which expire on the schedules above.

Our primary infrastructure (AWS) is located in the EU (Ireland, eu-west-1), and error monitoring uses EU-region ingestion. Some service providers process personal data in the United States or other countries outside the European Economic Area when you use the related features.

For those transfers we rely on the safeguards of Chapter V GDPR:

• EU-US Data Privacy Framework (adequacy under Art. 45 GDPR): OpenAI, Google, Stripe, PostHog, and Twilio are certified participants.
• EU Standard Contractual Clauses (Art. 46(2)(c) GDPR): used with providers such as AssemblyAI and Anthropic, and as a fallback with certified providers. AssemblyAI additionally offers EU endpoints, which we use for live transcription of EU visitors where regional routing information is available.
• EU-established providers: Sentry ingestion in the EU and Supadata (established in Germany).

The per-provider schedule is maintained at Subprocessors. You can request a copy of the relevant safeguards via support@topotopic.com.

We keep personal data only as long as needed for the purposes above. Current retention practice:

We may retain limited information beyond these periods where a legal obligation requires it, or where it is necessary to establish, exercise, or defend legal claims.

Deleting content.You can delete sessions and content inside the product. Session deletion runs through a verified erasure process that removes the session's content, transcripts, audio files (including stored file versions), embeddings, and graph entries, and records a verification receipt. Learning and practice artifacts generated from a session and de-linked operational records can persist until account deletion.

Deleting your account. Requesting account deletion in Settings, Privacy first deactivates the account and starts a 30-day grace period during which signing in cancels the deletion. After the grace period, a scheduled purge permanently deletes the account and its stored data, including stored file versions, subject to the limits in Section 12. If you are the last owner of a shared workspace, you may need to transfer ownership before deletion can complete. Content you contributed to shared workspaces may remain available to other members, and messages you sent to other users remain in those conversations, in each case with references to your user removed or set to null.

What deletion cannot reach. Deletion inside the Service does not delete copies or excerpts previously exported, downloaded, copied, or retained by other workspace members or share recipients, and records held by independent services (for example the payment processor) are governed by their own retention obligations.

Exporting your data. Settings, Privacy lets you request a machine-readable export. Exports currently include user-owned collection and session metadata across workspaces where you are a member, plus user-owned upload metadata, stored transcript text, parsed upload text, user-facing session analysis items, and report records where available. Exports do not currently include original file binaries, bearer-style share tokens, shared-workspace records retained by others, internal embeddings, hidden system analysis records, backups, or legal-retention copies. Session reports can additionally be exported from the product in document formats.

We apply technical and organizational measures designed to protect personal data (Article 32 GDPR), including encryption in transit (TLS) and at rest, row-level access controls in the database, scoped credentials, malware scanning of uploads, audit logging, and verified deletion flows. Our Security and Responsible Disclosure page describes how to report vulnerabilities.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected users in line with Articles 33 and 34 GDPR.

No system is completely secure. You are responsible for maintaining the security of your own account credentials and devices.

Under the GDPR you have the right to:

• Access (Art. 15): obtain a copy of your personal data and information about the processing.
• Rectification (Art. 16): have inaccurate data corrected.
• Erasure (Art. 17): have data deleted where the conditions apply.
• Restriction (Art. 18): limit processing in certain situations.
• Portability (Art. 20): receive data you provided in a structured, commonly used, machine-readable format.
• Objection (Art. 21): object, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop unless compelling legitimate grounds override, or the processing serves legal claims.
• Withdraw consent (Art. 7(3)): where processing is based on consent, withdraw it at any time with effect for the future, without affecting the lawfulness of processing before withdrawal.

The fastest paths are the built-in controls (Settings, Privacy) for export, deletion, consent, and voice recognition. For anything else, contact support@topotopic.com. We will verify your identity and respond within one month; for complex requests this can be extended by up to two further months, and we will tell you if that happens.

Some requests may be limited by law, by security requirements, or by the need to preserve shared-workspace records, audit and provenance evidence, fraud-prevention records, or the rights of other users. Where a request is limited, we will explain why.

Complaints. You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. The authority for Austria is: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, telephone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.

The Service is not directed at children under 16, and our Terms of Service require users to be at least 16 years old. We do not knowingly process personal data of children under 16; if you believe a child has created an account, contact support@topotopic.com and we will delete it.

United Kingdom and Switzerland. If you are in the UK or Switzerland, the rights and safeguards described in this policy apply equivalently under UK GDPR and the Swiss Federal Act on Data Protection.

California and other regions. We extend the core controls in this policy (access, export, deletion, no sale of personal information, no sharing for cross-context behavioral advertising) to all users regardless of location. If your local law grants you additional rights, contact support@topotopic.com and we will handle the request under that law where it applies to us.

Browser privacy signals.We do not currently respond to browser "Do Not Track" or Global Privacy Control signals. Optional analytics stays off unless you enable it through the consent controls, regardless of those signals.

We update this policy when the product or our providers change. Each version carries a version identifier and a "Last updated" date, and material changes are presented for review and renewed acceptance in the product before you continue using the Service.

Privacy questions and requests: support@topotopic.com. Controller and operator details are published in the Legal Notice / Imprint.