Privacy policy

Your account

You sign up with your email address or with your Google account. We keep your email address and, if you use Google, the name and email address your Google account shares with us. If you choose a password, our login provider stores it only in a scrambled (hashed) form that nobody can read back.

Your project inputs

To build a map you answer five questions: what your business sells and how it earns, your main topic, what searchers want, your target country and your competitor websites. We store these answers with the project.

Research data and generated content

For each project the tool gathers competitor keywords, search volumes and live search results, then builds a topical map, content briefs and articles. We store all of this, and the Excel and Word files you export, so you can come back to it. Research data is public search data about topics and websites, not data about you.

Billing

When paid plans are available, payments are handled by Stripe. We receive what we need to manage your plan, such as the plan you chose, whether a payment succeeded and your invoices. We never see or store your full card details.

The waiting list

If you leave your email address in the waiting-list form, it is passed to the sign-up page so you do not have to type it again. We use it only to write to you when early access opens.

Messages you send us

If you use the contact form, we receive your name, your email address, the topic you chose, the subject and your message. The same applies when you email us directly. We use them only to reply to you.

Technical logs

Like every website, our servers record basic technical details when you visit: your IP address, your browser type, the pages requested, the time and any errors. We use these logs to keep the service running and secure.

• To create and run your account and let you log in.
• To research your topic and build your maps, briefs and articles.
• To send the emails the service needs, such as email verification, password reset and receipts.
• To take payments and keep the records that tax law requires, once paid plans start.
• To write to you when early access opens, if you joined the waiting list.
• To reply to messages you send us through the contact form or by email.
• To keep the service secure, find faults and stop abuse.

Each project is visible only to your account, and it is never used to build another customer's map. We do not sell your data and we do not show you advertising.

Data protection law, including the GDPR, asks us to name the reason we are allowed to use each kind of data:

• Contract: your account, project inputs, generated content, service emails and billing. We need them to provide the service you signed up for.
• Consent: the waiting-list email. You can withdraw your consent at any time by writing to us.
• Legitimate interests: technical logs and security checks, so the service stays reliable and safe, and replying to messages you send us.
• Legal obligation: billing records we must keep for tax and accounting.

We use only the cookies the service needs to work, mainly the one that keeps you logged in. We use no analytics, advertising or tracking cookies, so there is no cookie banner to accept.

Our fonts are served from our own domain, so your browser does not contact Google or any other font service when you open the site.

We use a small number of providers (processors) who handle data only on our instructions and only to provide their part of the service:

• Supabase: database, login and file storage. Holds your account, projects and exports.
• Vercel: hosting. Serves the website and app and keeps the technical logs.
• OpenAI: the AI that writes suggestions, briefs and articles. It receives your project inputs and research data for the task at hand.
• DataForSEO: keyword and search data. It receives your topic, target country and competitor websites, not your account details.
• Resend: sends the emails the service needs, and passes messages from the contact form to our inbox. It receives your email address and the content of the email.
• Stripe: payments, once paid plans start. It receives your payment details directly from you.
• Inngest: runs long tasks, such as building a map, in the background. Planned for a later phase; it would receive the task details of your project.

Under OpenAI's terms for business use of its API, data sent through the API is not used to train its models by default.

Some of our providers are based in, or process data in, the United States and other countries outside the UK and the European Economic Area. When data leaves those areas, we rely on safeguards the law accepts, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

Our main database is hosted in PlaceholderSupabase data region.

• Account, projects and generated content: for as long as your account is open. When you delete your account, we delete them within Placeholderdeletion period after account closure.
• Waiting-list email: until we have written to you about early access, or sooner if you ask us to remove it.
• Messages you send us: for Placeholderhow long contact messages are kept, then deleted.
• Technical logs: for Placeholderlog retention period, then deleted.
• Billing records: for as long as tax and accounting law requires.

You can ask us to:

• Give you a copy of the data we hold about you.
• Correct data that is wrong.
• Delete your data.
• Send your data to you, or to another service, in a common format.
• Stop or limit how we use your data, or object to a use based on legitimate interests.
• Withdraw a consent you gave, such as for the waiting list.

We answer within one month. It is free. You also have the right to complain to the data protection authority where you live.

To use any of these rights, write to hello@topical.systems

• All traffic to the site and app is encrypted (HTTPS).
• Each project can be read only by the account that owns it.
• Keys to our providers are kept on the server and never sent to your browser.
• Card payments go straight to Stripe, so card numbers never reach our servers.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

Topical Systems is a tool for businesses. It is not meant for anyone under 16, and we do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

If we change this policy, we will update the date at the top of this page. If a change matters, for example a new kind of data or a new provider, we will also email account holders before it takes effect.

Placeholderlegal entity name and registered address

Email: hello@topical.systems