Privacy Policy — Toplio

The Hebrew version above is the authoritative text. Where the two differ, the Hebrew prevails.

Last updated: 8 October 2026

Toplio ("we", "us") is the controller responsible for your personal data. Toplio operates toplio.io and the Toplio service. This policy explains what we collect, how we use it, and what we do with data obtained from your Google Business Profile.

1. Information we collect

Account data. When you sign up and sign in, we receive your name and email address. If you sign in with a password, our authentication provider stores only a one-way encrypted representation of it — we never see or store the password itself.

Google Business Profile data. With your authorisation, we access the business locations you manage: business name, address, categories, opening hours, photos, posts, customer reviews and ratings, and performance metrics. We use this to operate the service.

WhatsApp number and messages. If you use the WhatsApp approval flow, we store the phone number you nominate and a record of the messages exchanged — what we asked, what you decided, and when. Where those messages contain review content, that content is deleted on the same 30-day schedule described in section 8.

Technical logs. Our hosting provider records requests to the service — IP address, browser type and the page requested — which we use to operate, debug and secure it.

2. How we use your data

• Draft replies to your Google reviews and posts for your profile
• Send those drafts to you on WhatsApp for approval, and publish what you approve
• Translate replies into the language a review was written in, before publishing
• Show you the state of your profile and your activity over time
• Maintain, debug and improve the service
• Send you service messages — account and security notices

3. AI processing

We use third-party AI providers to generate and translate content. These are the providers:

• OpenAI
• Google (Gemini)

What we send them: the review text and the reviewer's name; business details from your profile — name, category, description, opening hours, services and website address; information you have given us about the business, including offers and coupon codes; past replies and reviews, as examples of style; and your instructions, edits and drafts of replies and posts, together with their translations. We ask for your consent to this when you connect your Business Profile to the service, and we send data to these providers only to provide the features you use.

For both providers:

• We do not use your data, or your customers' reviews, to train AI models, and our providers do not use them to train or improve theirs. We use these providers on paid API terms under which submitted content is not used to develop their products.
• Providers may retain content briefly for abuse detection and security. It is not used for training or product improvement.
• We do not publish anything without your consent, unless automatic publishing has been explicitly turned on — by you, or by the agency that manages your profile.

4. Data received from Google APIs

Toplio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we use this data only to provide and improve the user-facing features of the service; we do not sell it, use it for advertising, or transfer it to others except as described in this policy, to operate the service, with your consent, or as required by law; and no one on our side reads it except with your consent, for security purposes, or as required by law.

5. Messaging

Messages are delivered over WhatsApp through Twilio. This means the messages we send you, and the replies you send back, pass through Twilio's systems and WhatsApp's on the way. Both providers are listed in section 6.

6. Who we share data with

We do not sell your data. We share it only with providers who help us run the service:

We may also disclose data where required by law, or to investigate abuse or protect our rights.

7. If an agency manages your profile

Where a marketing agency uses Toplio to manage your Google Business Profile, that agency directs what is done with your profile and we act on their instructions and yours. The agency can see the locations connected to their account.

Agencies warrant that they are authorised by each business whose profile they connect. Google's Business Profile policies require an agency to obtain the business owner's authorisation before responding to reviews or managing a listing on their behalf, and connecting a location to Toplio is a representation that this authorisation exists.

You retain control of your Google Business Profile at all times and can revoke Toplio's access from your Google account without our involvement.

8. How long we keep it

• Review content from Google — deleted after 30 calendar days, wherever we hold it. This includes review text inside the WhatsApp messages we sent you. We do not keep an archive of your reviews. Google's Business Profile API terms permit only limited, temporary storage, and we comply with that rather than retaining review history.
• Replies we drafted, and the record of your approvals — these are ours and yours, not Google's, and we keep them while your account is active.
• Account records — kept while your account is active and afterwards as long as the law requires.
• Technical logs — our hosting provider retains request logs for a short period set by them, after which they are no longer available to us.
• System records — a record of what the service did and when: messages sent, replies published, and the decisions behind them. Kept for 90 days. These hold identifiers, status codes and counts — not review text, message content or reviewer names.
• Photos and video you send — held only long enough to publish them to Google, then deleted from our storage.
• A logo you upload — kept while your account is active, to show it in the service and in materials we produce for you.

9. Security

Data is stored in a PostgreSQL database hosted by Supabase, in Ireland (EU). Separation between customers is enforced at the database level itself, so every query is confined to the account it came from. Traffic is encrypted in transit, and Google access tokens are encrypted at rest.

On our side, access to customer data is limited to those who need it to operate the service and provide support.

10. Your rights

You can ask us to access, correct, export or delete your data, and you can close your account at any time. You can revoke Toplio's access to your Google Business Profile directly from your Google account, at any time, without asking us. Contact privacy@toplio.io

11. Cookies

Only what is needed for sign-in, sessions and remembering your language preference. No advertising or tracking cookies.

12. Changes

We may update this policy. For material changes we will notify you by email or a notice in the service before they take effect.

13. Contact

Toplio · privacy@toplio.io