Privacy Policy
This Privacy Policy explains how TheTop Holdings Inc., a Delaware corporation ("TheTop," "we," "us," or "our"), collects, uses, shares, and protects personal information. TheTop provides the Transparency Dashboard and TheTop Engine, software that helps organizations see, control, and reduce the cost of their artificial intelligence usage (together, the "Services").
1. Scope of This Policy
This Policy applies to personal information we handle as a controller, which means information where we decide why and how it is used. That covers:
- visitors to thetop.com and our other websites
- people who request a demo, contact us, or otherwise communicate with us
- business contacts at our customers, prospects, partners, vendors, and investors
- administrators and users who hold an account in the Services, with respect to their account and login information
- people who apply for a job with us
This Policy does not apply to the data our customers process through the Services. That data is described in Section 2 and is governed by our agreement with each customer. It also does not apply to third-party websites or services, including the artificial intelligence providers our customers use, each of which has its own privacy practices.
2. Data We Process on Behalf of Customers
Our customers are organizations. When a customer uses the Services, we process data on that customer's behalf and under its instructions. For that data, the customer is the controller (or "business") and TheTop is a processor (or "service provider"). The customer decides which accounts to connect, which features to turn on, and which of its people and systems are included.
Depending on the Services and features a customer uses, the data we process for the customer may include:
- Transparency Dashboard. Account, seat, usage, billing, and directory information drawn from the artificial intelligence provider accounts the customer connects. This typically includes the names, work email addresses, roles, and departments of the customer's personnel, together with figures about their artificial intelligence usage and its cost. Where a provider makes activity or conversation content available to the customer through an administrative or compliance interface and the customer grants access to it, we may process that content to produce counts, classifications, and detections.
- TheTop Engine. When a customer directs artificial intelligence traffic through our gateway or installs our connectors in its tools, we process the content of that traffic, including prompts, responses, files, conversation history, and session transcripts, in order to route requests, serve cached responses, apply the customer's policies, and provide organizational memory. The caching and memory features store content, and facts extracted from it, for as long as the customer keeps those features enabled.
If your employer or another organization uses the Services and you have a question or a request about your information in the Services, please contact that organization. If you send the request to us, we will refer it to the customer and assist the customer as our agreement with it requires.
We do not sell the content our customers process through the Services, and we do not use that content to train artificial intelligence models that are made available to other customers.
3. Information We Collect
Information you give us.
- Contact and demo requests: name, work email address, company, phone number, the artificial intelligence providers your organization uses, an approximate range of monthly artificial intelligence spend, how you heard about us, and anything else you choose to tell us.
- Account information: name, work email address, employer, role, sign-in identifiers received from your organization's single sign-on provider, and your settings and preferences.
- Business and billing contacts: name, title, work contact details, and invoicing information for the people we deal with at customers, partners, and vendors.
- Communications: emails, messages, support requests, meeting notes, and call or meeting recordings where you have been told a recording is being made.
- Job applications: resume, work history, education, contact details, and any other information you submit when you apply.
Information we collect automatically. When you visit our websites or sign in to the Services, we, our service providers, and our advertising partners collect IP address, approximate location derived from IP address, device and browser type, operating system, pages viewed, referring page, dates and times of access, and actions taken in the Services such as sign-ins and administrative changes. We collect some of this through cookies and similar technologies, described in Section 7.
Information from other sources. We receive information from the customer organization that sets up your account, from single sign-on and identity providers, from scheduling and communication tools you use to interact with us, from partners and referrers, from recruiters and references, and from public and commercial sources of business contact information.
We do not seek to collect sensitive personal information such as health data, biometric identifiers, precise geolocation, or information about race, religion, or sexual orientation, and we ask that you not send it to us.
4. How We Use Information
We use personal information to:
- provide, operate, secure, and support the Services and our websites
- create and manage accounts and authenticate users
- respond to demo requests and inquiries and schedule meetings
- bill customers and manage our commercial relationships
- send service, security, and administrative notices
- send marketing communications about our products to business contacts, where permitted, with the ability to opt out at any time
- measure the effectiveness of our advertising and show our ads to people who have visited our websites, where you have accepted marketing cookies
- understand how our websites and Services are used and improve them
- detect, investigate, and prevent fraud, abuse, and security incidents
- evaluate job applicants
- comply with law, enforce our agreements, and protect our rights and the rights of others
We may create aggregated or de-identified information that does not identify any individual or customer and use it for any lawful purpose, including analytics, benchmarking, and product development. We do not attempt to re-identify de-identified information.
5. Artificial Intelligence and Automated Processing
The Services use automated processing, including machine learning models, to classify usage, estimate costs and savings, route requests, and extract facts for organizational memory. Some of these functions use models supplied by third parties acting as our service providers or accessed through the customer's own provider accounts. This processing is carried out for the customer and at its direction.
TheTop does not use the Services to make decisions that produce legal or similarly significant effects on individuals. Customers decide how they use the information the Services provide, and they are responsible for those decisions.
6. How We Share Information
We share personal information with:
- Service providers that work for us under contract, such as cloud hosting and infrastructure providers, model providers, analytics, email and communication, scheduling, customer relationship management, payment and invoicing, recruiting, and security vendors.
- Advertising partners such as LinkedIn, which receive identifiers and information about your activity on our websites through cookies and similar technologies when you accept marketing cookies, and use it to measure our advertising and to show you our ads on their platforms. Their use of that information is governed by their own privacy policies.
- The customer organization you belong to, for account and usage information associated with that organization's use of the Services.
- Artificial intelligence providers a customer has connected, when the customer directs traffic to them through the Services. Their handling of that data is governed by the customer's agreement with them.
- Professional advisors such as lawyers, accountants, auditors, and insurers.
- Authorities and other parties where we believe in good faith that disclosure is required by law or legal process, or is needed to protect the rights, property, or safety of TheTop, our customers, or others.
- Parties to a business transaction such as a merger, acquisition, financing, reorganization, or sale of assets, including during diligence, subject to appropriate confidentiality protections.
- Others at your direction or with your consent.
We do not sell personal information for money. Disclosures to advertising partners described above may be considered "sharing" for cross-context behavioral advertising, "targeted advertising," or a "sale" under some U.S. state laws. You can opt out as described in Section 12.
7. Cookies and Similar Technologies
We use cookies and similar technologies that are necessary for our websites and the Services to work, such as keeping you signed in, and to measure and improve performance, such as analytics and error monitoring. With your consent, we also use marketing cookies, such as the LinkedIn Insight Tag, to measure the results of our advertising and to show our ads to people who have visited our websites. Marketing cookies are not set until you accept them in our cookie banner, and you can change or withdraw your choice at any time through the "Your Privacy Choices" link at the bottom of every page of our websites. You can also control cookies through your browser settings. Blocking some cookies may affect how our websites and the Services function.
8. Retention
We keep personal information for as long as we need it for the purposes described in this Policy, including to maintain our relationship with you, meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When we no longer need it, we delete or de-identify it. Copies may remain in routine backups for a limited time before they are overwritten.
Data we process on behalf of a customer is retained according to our agreement with that customer and the customer's own settings.
9. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls based on role and need, and logging of access to sensitive systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or information has been compromised, please contact us using the details in Section 15.
10. International Transfers
TheTop is based in the United States, and we process personal information in the United States and in other countries where we or our service providers operate. These countries may have data protection laws that differ from the laws where you live. Where the law requires, we use appropriate safeguards for international transfers, such as standard contractual clauses approved by the relevant authorities.
11. Your Choices and Rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and receive a copy of it
- correct inaccurate information
- delete your information
- object to or restrict certain processing
- receive your information in a portable format
- withdraw consent where we rely on consent
- opt out of marketing communications
To make a request, email privacy@thetop.com. We will need to verify your identity before we act, usually by confirming control of the email address associated with your information. You may use an authorized agent, who must show proof of authority. We will not discriminate against you for exercising your rights. If we decline your request, you may appeal by replying to our response, and we will tell you the outcome and how to contact your regulator if you remain dissatisfied.
You can unsubscribe from marketing emails at any time by using the link in the email or by contacting us. We will still send you service and transactional messages.
If your information is in the Services because your employer or another organization is our customer, please direct your request to that organization, as described in Section 2.
12. Additional Information for Residents of Certain Regions
United States. Residents of California and of other states with comprehensive privacy laws have the rights described in Section 11, to the extent those laws apply to us. In the past twelve months we have collected the following categories of personal information: identifiers and contact details; commercial and billing information; internet and network activity; approximate location; professional and employment information; audio or visual information where a call or meeting is recorded; and inferences drawn from the above about business interests. We collect it from the sources and use it for the purposes described in Sections 3 and 4, and we disclose it to the categories of recipients described in Section 6 for business purposes. In the past twelve months we have disclosed identifiers and internet and network activity to advertising partners, as described in Section 6, which may be considered "sharing" for cross-context behavioral advertising, "targeted advertising," or a "sale" under these laws. We do not otherwise sell personal information, we do not knowingly sell or share the personal information of anyone under sixteen, and we do not use sensitive personal information for purposes beyond those the law permits without a right to limit. You can opt out of this sharing at any time by selecting "Your Privacy Choices" at the bottom of any page of our websites and declining marketing cookies, or by turning on Global Privacy Control in your browser, which we treat as a valid opt-out request for that browser.
European Economic Area, United Kingdom, and Switzerland. Where the law of these regions applies, we rely on the following legal bases: performing a contract with you or your organization; our legitimate interests in operating, securing, improving, and marketing our business, where those interests are not overridden by your rights; compliance with legal obligations; and your consent where we ask for it. You have the right to lodge a complaint with your local data protection authority.
13. Children
Our websites and the Services are intended for business use and are not directed to anyone under eighteen. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.
14. Changes to This Policy
We may update this Policy from time to time. We will post the updated version on this page and change the date at the top. If a change is material, we will give additional notice, such as by email or a notice in the Services.
15. Contact Us
TheTop Holdings Inc.
700 North Fairfax St, Suite 614
Alexandria, VA 22314
privacy@thetop.com