Privacy Policy

TopFound ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what we collect, how we use and share it, and the choices and rights you have over your information.

It applies to our website, our platform, and the services we provide to clients. It also explains how we comply with applicable privacy laws, including the General Data Protection Regulation (GDPR) for individuals in the EEA, UK, and Switzerland, and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

By using our services or providing us with information, you consent to the practices described here.

2.1 Information You Provide

We collect information you give us directly, including:

• Contact information: name, email address, phone number, company name, and job title.
• Account information: login details and account preferences.
• Business information: website URLs, industry, goals, analytics access, and marketing history.
• Payment information: billing address and payment method details, processed by our payment providers — we do not store full card numbers.
• Communications: the content of emails, messages, call notes, and support requests.
• Form submissions: information submitted through our audit, contact, and booking forms.

2.2 Automatically Collected Information

When you visit our website, we automatically collect:

• Device information: IP address, browser type, operating system, and device identifiers.
• Usage data: pages visited, time on page, referring URLs, clicks, and navigation paths.
• Location data: approximate geographic location — country, and where available region and city — inferred from your IP address. We record this alongside forms you submit, such as a booking or contact request, so we can respond in your business hours and understand where enquiries come from. It is derived on our servers and needs no permission prompt; we do not use your device's GPS or the browser location feature, which would ask you first. The accuracy is city-level at best, and a VPN or company network will report its own location instead of yours.
• Cookies and tracking data: as described in the Cookies & Tracking Technologies section below.

2.3 Information from Third Parties

We may receive information about you from:

• Business partners and referral sources
• Publicly available sources and business directories
• Analytics and advertising providers
• Social media platforms, where you interact with our profiles

We use the information we collect to:

• Deliver the services: provide, maintain, and improve our services and platform.
• Communicate: respond to enquiries, send service updates, and provide support.
• Manage accounts: create and administer accounts, process autopay charges, and send receipts.
• Market responsibly: send relevant offers and content where you have opted in or where permitted by law.
• Analyze and improve: understand how our site and services are used and improve them.
• Protect: detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Comply: meet legal obligations and enforce our agreements.

For individuals in the EEA, UK, or Switzerland, we process personal data on the following legal bases:

• Contract: processing necessary to perform our contract with you or to take steps at your request before entering into one.
• Legitimate interests: processing for our legitimate business interests, such as improving our services, direct marketing to business contacts, and fraud prevention — balanced against your rights.
• Consent: where you have given consent, for example for certain cookies and marketing messages.
• Legal obligation: processing necessary to comply with applicable law.

We do not sell your personal information. We may share it in the circumstances below.

5.1 Service Providers

We share information with vendors who process data on our behalf under contract, including:

• Hosting and infrastructure providers: for website and platform delivery.
• Email and SMS providers: for account and marketing communications.
• Payment processors: our payment processor, for autopay charges and receipts. We do not store full card numbers.
• Analytics providers: for website and campaign measurement.
• IP geolocation providers: when you submit a form, your IP address may be sent to a geolocation service so we can determine the approximate country, region, and city it corresponds to. We store that approximate location with your enquiry; we do not store the IP address itself.
• AI model providers: when you request an AEO report, your website, the competitor you enter, publicly available content from your site, and buyer questions about your category are sent to AI model providers — Google Gemini, and OpenAI, Anthropic and Perplexity through OpenRouter — to check how their assistants answer and to write the report. Your name, email address, and phone number are not sent.
• CRM and support tools: for managing client relationships.

5.2 Other Disclosures

We may also disclose personal information:

• To comply with a legal obligation, subpoena, or lawful request
• To protect our rights, privacy, safety, or property, or those of others
• In connection with a merger, acquisition, financing, or sale of business assets
• With your consent, or at your direction

6.1 How We Use SMS

Where you opt in, we use SMS for appointment reminders, service and reporting notifications, and replies to your requests.

6.2 Consent for SMS

We obtain express written consent before sending SMS. Consent is never a condition of purchase, and you can withdraw it at any time.

6.3 Where Phone Numbers Are Collected

Phone numbers are collected through our website forms, booking pages, onboarding, and direct conversations, with the consent language shown at the point of collection.

6.4 Opting Out of SMS

Reply STOP to any message to opt out, or HELP for assistance. Message and data rates may apply depending on your carrier and plan.

6.5 Mobile Information Sharing

We do not sell, rent, or share mobile phone numbers or SMS consent with third parties or affiliates for their marketing purposes. Numbers are shared only with the providers that deliver messages on our behalf.

We use cookies and similar technologies to run our website and understand how it is used:

• Essential cookies: required for core site functionality and security.
• Analytics cookies: help us understand how visitors use the site so we can improve it.
• Marketing cookies: used to measure campaigns and show relevant advertising.
• Preference cookies: remember your settings and choices.

You can control cookies through your browser settings, and where required we ask for consent before setting non-essential cookies. Disabling certain cookies may affect how the website works.

We retain personal information for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law. Factors we consider include:

• The duration of our relationship with you
• Legal, tax, and accounting obligations
• Resolution of disputes and enforcement of agreements
• Business needs for records and analysis

When data is no longer needed, we securely delete or anonymize it.

9.1 Rights for All Users

Regardless of where you live, you can:

• Ask what personal information we hold about you
• Request correction of inaccurate information
• Ask us to delete information we no longer need
• Unsubscribe from marketing email at any time
• Opt out of SMS by replying STOP

9.2 GDPR Rights (EEA, UK, Switzerland)

If you are in the EEA, UK, or Switzerland, you also have the right to:

• Access: obtain a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted in certain circumstances.
• Restriction: limit how we process your data.
• Portability: receive your data in a structured, machine-readable format.
• Object: object to processing based on legitimate interests, including direct marketing.
• Withdraw consent: at any time, without affecting processing carried out beforehand.

You also have the right to lodge a complaint with your local supervisory authority.

9.3 CCPA/CPRA Rights (California Residents)

California residents have the right to:

• Know: what personal information we collect, use, and disclose.
• Delete: request deletion of personal information we hold about you.
• Correct: request correction of inaccurate personal information.
• Opt out: of the sale or sharing of personal information — we do not sell or share personal information as those terms are defined.
• Limit: the use of sensitive personal information.
• Non-discrimination: you will not receive different service for exercising these rights.

To exercise any of these rights, contact us through the website or the email we use to communicate with you about your account. We will verify your request and respond within the timeframes required by law.

We and our service providers may process personal information in countries other than your own, including countries whose data protection laws differ from those where you live.

Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, together with additional measures where required.

We maintain technical and organizational measures appropriate to the risk, including:

• Encryption of data in transit and at rest
• Access controls and least-privilege permissions
• Regular security assessments and updates
• Employee training on data protection
• Vendor security requirements and contractual safeguards

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

Our services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes by posting the updated policy on our website and updating the “Effective Date” at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us.