Privacy Policy

Effective 1 August 2026

This policy explains how Topline Data Labs LLC handles personal information, both on this website and in the software we operate for our clients. Those are two different things, and this policy keeps them separate.

This website collects nothing

This site is a set of static pages. It has no contact forms, no accounts, and no login. It sets no cookies, runs no analytics, and loads no scripts, fonts, images, or other resources from third parties. We do not build profiles of visitors and we have no advertising or marketing trackers of any kind.

The site is served by Cloudflare, our hosting provider, which processes standard technical request information such as IP address for the purpose of delivering the page and protecting against attacks and abuse. That processing is necessary for the site to work securely.

Personal data we process for clients

Most of the personal data we handle does not belong to us. When an organization engages us to build and operate a system, that organization decides what data is collected and why. In data protection terms, the client is the controller and Topline Data Labs LLC is the processor. Our handling of that data is governed by our contract and data processing agreement with the client, not by this policy.

How we handle client data

• We process personal data only on the client's documented instructions and only to provide the service.
• We do not sell personal data, and we do not share it for cross-context behavioral advertising.
• We do not use client personal data to train artificial intelligence models, and we do not provide it to AI vendors for that purpose.
• We use a limited set of service providers, for example hosting and managed database providers, each bound by contract to equivalent protections. A current list is available to clients on request, and clients are notified before it changes.
• On termination, client data is returned or deleted according to the terms of the client agreement.

Security

We use access controls, encryption in transit, encryption of sensitive fields at rest, multi-factor authentication on administrative accounts, and audit logging. No system is perfectly secure, but we design for least privilege and for the ability to detect and reconstruct what happened.

Retention

Client data is retained for as long as the client agreement requires, and then returned or deleted. We keep ordinary business records, such as invoices and correspondence, for as long as tax and legal obligations require.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to be free from discrimination for exercising those rights. California residents have these rights under the California Consumer Privacy Act as amended.

Where we act as a processor for a client, please direct requests to that client, since they hold the relationship and the record. Where we hold information about you directly, for example if you have corresponded with us, contact us using the details below.

Children

This website is not directed to children, and we do not knowingly collect personal information from children through it. Where a client's system involves information about minors, that collection is governed by the client's own policies and our agreement with them.

Changes

If this policy changes materially, we will update the effective date above and publish the revised version here.

Contact

Questions about this policy can be sent to [email protected], or by post to: