Privacy Policy

Effective Date: May 7, 2026 Last Updated: October 29, 2026 This Privacy Policy explains how Topolo Technology Inc. ("Topolo") and TopoloOne collect, use, and protect personal information when you visit `topolo.io`, request a demo, start signup or checkout, contact us, or use Topolo platform services. Where we process personal data on behalf of a customer through the services, we act as its processor or subprocessor under our Data Processing Agreement . The customer is responsible for lawful instructions and privacy information concerning its own processing. This policy describes Topolo's own processing.

1. What We Collect

1.1 Information You Provide We collect information you choose to submit, including: • contact details such as name, email address, company, role, and message content • demo, waitlist, feedback, support, and developer-program form details • signup, workspace, and account profile information • billing and checkout information handled through Topolo billing services and payment processors 1.2 Information Collected Automatically We collect limited technical information needed to deliver and protect the website, including: • IP address, user agent, browser, device, and approximate region • security, rate-limit, and abuse-prevention signals • page, form, checkout, and account-flow metadata needed to operate the service • optional Cloudflare Web Analytics, product-improvement, and experiment-assignment events when you allow them 1.3 Cookies and Local Storage Topolo uses storage for: • essential site delivery, security, forms, checkout, and account flows, including one first-party cookie on Topolo's app domain, `topolo_session_hint`, that holds only the value "1" so signed-in pages load without first showing the public page; it lasts no longer than your sign-in session (at most 7 days) and is removed when you sign out • your consent choice through Topolo Consent • optional Cloudflare Web Analytics, product-improvement measurement, and product-experiment assignment after analytics consent We do not load non-essential Web Analytics, assign persistent A/B-test cookies, or record optional product-improvement events until analytics consent is granted.

2. How We Use Information

We use personal information for these purposes: • provide, secure, monitor, and improve Topolo services • respond to demo, support, feedback, and developer-program requests • create and manage accounts, workspaces, app access, and checkout flows • process billing, prevent fraud, and reconcile subscriptions • send transactional service messages • send marketing communications only where permitted by law or consent • run optional Cloudflare Web Analytics, product-improvement measurement, and experiment assignment after consent

3. Legal Bases

Depending on where you are located, we rely on: • Contract or steps before a contract for signup, checkout, account access, billing, demos, and requested services. • Legitimate interests for site security, fraud prevention, abuse prevention, service reliability, business operations, and responding to direct inquiries. • Consent for optional Cloudflare Web Analytics, product-improvement measurement, persistent product-experiment assignment, and marketing communications where consent is required. • Legal obligation where we must retain or disclose information to comply with applicable law.

4. Vendors and Processors

Topolo currently uses the following categories of processors for the marketing website and related platform setup: • Cloudflare for managed hosting and storage, network security, bot protection and optional website analytics • Topolo Consent for consent state, GPC handling, and audit evidence • Topolo Auth for signup, login, account, and service-access flows • Topolo Nexus, Topolo Pay, and payment processors for checkout, billing, subscription, and usage workflows • TopoloOne website services for forms, demo requests, waitlist, feedback, and support routing The website does not currently run third-party advertising pixels or sell personal information. If that changes, Topolo Consent configuration and this policy must be updated before those uses are enabled. Our subprocessor list identifies external providers used for applicable services. Topolo Auth, Consent, Nexus and Pay are Topolo products rather than separate legal entities.

5. Sharing

We do not sell personal information. We share information only as needed to: • operate the website and platform through service providers • carry out requests you or your organization direct, such as returning data to an AI assistant you connect (see 5.1) • complete account, billing, checkout, support, and security workflows • comply with legal obligations • protect Topolo, users, and the public from fraud, abuse, or security threats • complete a business transaction such as a merger, financing, acquisition, or sale, subject to appropriate safeguards 5.1 AI Assistants and Connected Agents You or your organization can connect an AI assistant or agent client, such as Claude or another Model Context Protocol (MCP) client, to Topolo through the Topolo MCP server, CLI, or API using a credential issued in Topolo. Connecting ChatGPT through Topolo sign-in is not available yet; see Topolo for ChatGPT . When you connect an assistant: • the assistant acts on your behalf with the credential you authorize, limited to the organization, applications, and permissions that credential grants • Topolo receives the requests the assistant sends, such as the action requested and its inputs, which may include personal information you or the assistant include; Topolo does not request or collect your full conversation history from the assistant • Topolo returns data only within the permissions that credential grants; your organization's human-approval rules and Topolo's own permission checks still apply to protected actions • information Topolo returns, and anything you share in the conversation, is processed by the assistant's provider under that provider's own terms and privacy policy, not this policy • Topolo may record the connection, the credential used, and the requests made, including their time and technical details such as IP address, for security, audit, abuse prevention, and support, and keeps these records as described in Section 7 (Retention) Topolo does not sell this information. You can revoke an assistant's access at any time by revoking its API key or agent installation in your Topolo account settings, and administrators with the required permissions can revoke it for your organization. Removing the connection inside the assistant stops it from sending new requests but does not by itself revoke the Topolo credential.

6. Security

Topolo is built primarily on Cloudflare infrastructure. Data is transmitted over HTTPS and stored in platform-managed services with access controls, environment separation, and operational logging. Access is limited to people and systems that need it for service operation, support, security, billing, or compliance work.

7. Retention

We keep information only as long as needed for the purpose collected, including: • account and billing records while the account or legal obligation remains active • form and support records while needed to respond and maintain business records • consent state and consent events for audit evidence • security and operational logs for reliability, fraud prevention, and incident response • AI assistant and agent access records, meaning the connection, the credential used, and the requests made, for 12 months, after which they are deleted, unless we need them longer to investigate a security incident or meet a legal obligation; short-lived operational logs are deleted within 30 days. Changes an assistant makes inside an application become part of that application's records and are kept with them. Deletion requests are handled according to applicable law and may preserve records that must be retained for legal, security, billing, or dispute purposes.

8. Your Choices

You can: • use the Topolo Consent preference controls to allow or reject optional analytics • enable Global Privacy Control in your browser; Topolo Consent treats it as an opt-out signal for restricted optional purposes • unsubscribe from marketing emails using the link in those emails • contact us to request access, correction, deletion, portability, withdrawal of consent, or an opt-out where applicable

9. Regional Privacy Rights

Depending on your location, you may have rights under laws such as the EU GDPR, UK GDPR and PECR, California CPRA, and other US state privacy laws. These may include rights to access, delete, correct, port, restrict, object, withdraw consent, opt out of sale or sharing, opt out of targeted advertising or profiling, and appeal certain decisions. Topolo does not currently sell personal information or run third-party advertising pixels on `topolo.io`. You may complain to the UK Information Commissioner or another relevant supervisory authority where applicable.

International Transfers

Topolo Technology Inc. is based in the United States. Information may be processed in the United States and other countries where the relevant service providers operate. Where required, transfers are subject to appropriate safeguards, including applicable standard contractual clauses and the UK Addendum described in the DPA. Contact privacy@topolo.io for relevant transfer information or a copy of applicable safeguards, subject to lawful redaction.

10. Children

Topolo services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

11. Changes

We may update this policy as Topolo services, vendors, or legal requirements change. Material changes will be posted on this page and, where appropriate, communicated by email or in-product notice.

12. Contact

For privacy requests or questions, contact: Email: privacy@topolo.io Address: Topolo Technology Inc., 16958 Coastal Highway, Lewes, Delaware, 19952, United States. Privacy Questions? Contact privacy@topolo.io for privacy questions, rights requests, or consent-related issues.