Legal

Privacy Policy

Last updated 26 October 2026.

Who we are

TOPY.AI is operated by TOPY AI LTD, a private limited company registered in England (company number 15680659), registered office 5 Audley Rise, Tonbridge, TN9 1XU, United Kingdom. We are the controller of the personal data described here. Contact us at [email protected].

What we collect

• Account details — your email address, name and profile photo, and how you sign in (Google or email and password), through Google Firebase Authentication.
• What you put into TOPY — your projects and ideas, business plans and templates, onboarding conversations, documents and images you upload or link, and the records you keep in the CEO workspace (decisions, risks, journal, go-to-market plans, research sources, investor contacts and updates, growth experiments, project memory). Investor contacts you add may include other people’s names and contact details; you are responsible for having a basis to store them.
• Billing — your plan, credit balance and transactions. Card payments are handled by Stripe; we never see or store your card number.
• Connected apps and agents — when you connect an assistant (for example Claude, ChatGPT or the TOPY CLI) we keep the connection (app name, permissions, when it was last used) and the access keys it uses, stored only as one-way hashes. We log each change an agent makes for you (tool, summary, time) so you can see it in your account.
• Integrations you choose — if you connect LinkedIn or a Cloudflare domain, the tokens and account details those services give us for that purpose.
• Usage and device data — server logs (IP address, browser, pages and API calls, errors) and, on our website, Google Analytics, which uses cookies. You can block or delete these cookies in your browser settings.

How we use it

To run your account and the service; to generate and revise business plans, templates and other content you ask for; to process payments and credits; to keep the service secure (authentication, abuse and fraud prevention, rate limits, audit logs); to support you; and to improve the product. We rely on our contract with you, our legitimate interests (security and improvement) and, where the law requires it, your consent — for analytics cookies, and for any marketing emails, which you can unsubscribe from at any time.

AI processing

When you ask TOPY to write or change something, the relevant content (for example your project details and the plan sections involved) is sent to Google’s Gemini API to produce the result. Google processes it as our service provider under its Gemini API terms. We do not sell your personal data, and we do not use your content to train AI models of our own.

Who we share it with

Only with providers that run parts of the service for us, under contracts that limit their use of the data:

We disclose data to authorities only when the law requires it.

International transfers

Our servers are in the EU (France). Some providers process data in other countries, including the United States; where they do, we rely on the safeguards the law requires, such as adequacy regulations or standard contractual clauses.

How long we keep it

Account and content data are kept while your account is open. Archived plans, templates and projects can be restored until you delete them; records you delete in the CEO workspace are removed straight away. Connected-app access tokens last one hour and refresh tokens 90 days unless you disconnect the app sooner. When you ask us to delete your account we delete or anonymise your data, except records the law requires us to keep (such as billing records for tax purposes), which we keep only as long as required.

Security

Data is encrypted in transit (TLS). API keys and app tokens are stored as hashes; changes an assistant makes need your confirmation, which is signed and bound to that exact change; you can disconnect any app at once from Dashboard → API keys.

Your rights

Under UK and EU data protection law you can ask to access, correct, delete or export your data, object to or restrict some processing, and withdraw consent. Write to [email protected]. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

Children

TOPY.AI is a service for adults running or starting a business and is not directed at children.

Changes

We will post changes on this page and, for significant ones, tell you by email or in the app.