Controller and scope

The operator below is responsible for TopTier’s processing unless a third party tells you it acts as a separate controller for its own service.

Operator details are not configured in this development deployment. Production launch is blocked until they are supplied and verified.

This notice covers TopTier’s public website, account dashboard, support, ranking, checkout initiation and related operational communications. It does not govern external company websites linked from profiles.

Data we process

• Account data: email address, display name, avatar, authentication identifiers and account timestamps supplied directly or by an enabled sign-in provider.
• Workspace and public profile data: memberships and roles, company and founder information, links, descriptions, metrics, evidence submissions and moderation records.
• Payment and transaction data: amount, currency, status and processor identifiers needed to reconcile one-time payments, refunds and disputes. Full card details are handled by Stripe and are not stored by TopTier.
• Product-funnel events: a closed event name, time, client or server source, company identifier where applicable, and bounded properties such as CTA placement, sign-in method or share channel. Client interaction events require analytics consent; authoritative payment confirmation and publication events are recorded server-side to measure the service flow without storing email addresses or free text.
• Product data: watchlist entries, notifications, support requests, account-erasure requests and security or audit events.
• Consent-based analytics: non-unique profile views and outbound clicks. These events are not stored unless the analytics cookie is set to “granted”. A keyed one-way network value is computed transiently for short-window abuse control but is not inserted into analytics events; raw IP addresses, full referrers and user-agent strings are not stored in these events.

Purposes and legal grounds

We process data to create and secure accounts, provide private drafts and public profiles, enforce role-based access, operate rankings, reconcile payments, answer support, prevent abuse and meet legal obligations. Depending on the context, this is necessary to perform a contract, comply with law or pursue legitimate interests in running a secure and trustworthy service.

Non-essential product analytics is based on your explicit choice. Refusing analytics does not prevent access to the service, and an outbound website link still works without tracking. You can change the choice on the Cookies page.

Recipients and subprocessors

Data is disclosed only as needed to operate the service: Supabase provides authentication and database infrastructure; Stripe provides hosted payment processing; the selected hosting provider delivers the application; enabled OAuth providers handle sign-in; when email is enabled, Resend delivers transactional messages such as invitations, digests and alerts; and when error monitoring is enabled, Sentry receives error reports that are scrubbed before sending, without request bodies, cookies, headers, query strings, user details or breadcrumbs, and with email addresses, payment keys and session tokens masked. These providers process data under their own terms and applicable data-protection commitments. The optional TopTier Weekly digest email is sent only if you opt in from account settings, based on your consent, and you can unsubscribe at any time from the link in every digest or in account settings. Optional overtake alert emails, which tell a company member when a competitor moves ahead of their company, are likewise sent only if you opt in, based on your consent, and you can unsubscribe at any time from the link in every alert or in account settings.

We may also disclose information to professional advisers, authorities or parties to a corporate transaction where legally required and appropriately protected. Public profile information is visible to anyone and may be indexed or copied by third parties.

International transfers and security

Providers may process data outside your country. Where required, the operator must put an approved transfer mechanism and supplementary safeguards in place before production use. TopTier applies access controls, server-side authorization, encryption in transit, restricted service credentials and audit records, but no online system can promise absolute security.

Retention

No validated production analytics-retention target is configured in this deployment. Account and workspace data is kept while the account or service relationship is active and then only as long as necessary for support, security, disputes and legal obligations.

Payment, accounting and audit records may need longer statutory retention and may be restricted or pseudonymized rather than erased immediately. Public copies or search-engine caches outside TopTier’s control may persist after unpublishing.

Your choices and rights

Subject to applicable law, you may ask to access, export, correct, delete or restrict personal data, object to certain processing, withdraw consent and complain to your competent supervisory authority. The account settings provide a JSON export and an idempotent erasure-request workflow.

An erasure request does not immediately delete an account. If you are the last owner of a company, ownership must first be transferred or the company’s future resolved so that the request cannot orphan a workspace. TopTier may verify identity and retain data where law or active disputes require it.

Children, changes and contact

TopTier is intended for people able to enter a binding business agreement and is not directed to children. We may update this notice when the service or law changes; material changes will be communicated where required.

Send privacy and data-rights requests to The privacy contact is not configured in this development deployment.. Include enough information to identify your account, but never send passwords, card details or authentication tokens.