Privacy Policy

Effective July 21, 2026 · TopperBase LLC ("we", "us", "our"), operator of TopperBase (the "Service").

1. Overview and roles

This Policy explains how we handle personal data in connection with the Service. It covers two groups: (a) the staff of businesses that subscribe to the Service ("Subscribers"), whose account data we collect directly and for which we act as a controller; and (b) the customers and contacts whose information a Subscriber enters into the Service ("Subscriber Customers"), which we host and process on the Subscriber's behalf and for which we act as a processor under the Subscriber's instructions and the terms of this Policy.

2. Information we collect

• Account information (from Subscribers): full name, email address, a securely hashed password, assigned role, and account timestamps (creation, last login).
• Security and activity logs: IP address, the actions a user takes in the Service, and timestamps. We keep these to authenticate users, secure accounts, and detect and investigate abuse.
• Subscriber Customer data (entered by Subscribers): information a Subscriber records about its own customers and jobs, which may include names, company names, postal addresses, phone and fax numbers, email addresses, tax identification and tax-exemption numbers, vehicle details (including VINs), and the quotes, invoices, and payment records associated with them. Subscribers decide what to enter; we do not control or independently use this content.
• Cookies inside the application: we set a single strictly-necessary session cookie to keep signed-in users authenticated and to protect against cross-site request forgery. No advertising or analytics cookie is set anywhere behind the sign-in.
• Analytics on our public pages: our public marketing pages - the home page and the counter manual - use Google Analytics 4 to count visits and see which pages get read. This sets Google cookies and sends Google the page address, an approximate location derived from your IP address, and basic device and browser information. It runs on those public pages only: it is not loaded on the sign-in screen or on any page behind it, so no Subscriber or Subscriber Customer record ever reaches Google. You can opt out for every site you visit with Google's browser add-on at tools.google.com/dlpage/gaoptout. We do not use advertising cookies, and we do not sell or share personal information for cross-context behavioural advertising.

3. How we use information

We use personal data to: provide, operate, secure, and support the Service; authenticate users and manage accounts; prevent, detect, and respond to fraud or abuse; maintain records such as audit logs; comply with legal obligations; and communicate with Subscribers about the Service. We do not sell personal data, and we do not use Subscriber Customer data for our own purposes.

4. How we share information

We share personal data only as needed to run the Service:

• Infrastructure and service providers that host and operate the Service, each under confidentiality and data-protection obligations. In full, and in the United States:

  Provider	What it does
  Oracle Cloud Infrastructure	Hosts the application and the database.
  Cloudflare	Serves the site and terminates TLS, so it handles requests in transit. It stores no records.
  Backblaze B2	Holds the nightly encrypted off-site backup.
  Amazon Web Services (SES)	Delivers outbound email, which carries recipient addresses and any attached document.
  Google (Analytics)	Counts visits to our public marketing pages. Never loaded behind the sign-in, so it receives no Subscriber or Subscriber Customer records.
  Brevo	Delivers outbound email for Subscribers who use their own relay rather than ours.

  We will update this list before adding a provider that handles personal data.
• Public reference data: vehicle make/model reference data is retrieved from the U.S. NHTSA vPIC public API. No Subscriber or Subscriber Customer personal data is transmitted to it.
• Legal and safety: where required by law, to protect rights and safety, or in connection with a business transfer.

We do not otherwise disclose personal data to third parties.

5. Data retention

We retain account and log data for as long as an account is active and as needed for security, dispute resolution, and legal compliance. Subscriber Customer data is retained while the Subscriber keeps it in the Service; on account termination the Subscriber has thirty days to export it, after which we delete it from our live systems; encrypted backups age out on their normal schedule and are not retained separately.

6. Security and data breaches

We use industry-standard safeguards, including encrypted transport (TLS with HSTS), hashed passwords (argon2), CSRF protection, rate limiting, session protections, and network isolation of the database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a security incident occurs that compromises personal data — for example a leak, loss, theft, or unauthorized access — we will investigate, take reasonable steps to contain and remediate it, and notify affected Subscribers, Subscriber Customers (through the relevant Subscriber), and regulators as and when required by applicable law and within the timeframes it requires. Because we act as a processor for Subscriber Customer data, we will inform and support the relevant Subscriber so they can meet their own notification obligations. You are responsible for safeguarding your account credentials, and for incidents arising from your or your users' acts or omissions.

7. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal data, or to object to or restrict certain processing. Subscribers may exercise these for their account data by contacting us. Because Subscriber Customer data is controlled by the relevant Subscriber, requests about that data should be directed to that Subscriber; we will assist them as their processor. To make a request, contact us at support@topperbase.com.

8. Children's privacy

The Service is a business tool intended for use by adults in a commercial setting and is not directed to children. We do not knowingly collect personal data from children.

9. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will update the effective date above and notify Subscribers as required by law and by requiring re-acceptance within the Service before continued use.

10. Contact us

TopperBase LLC · support@topperbase.com.

Read the Terms of Service →