Topline stores the marketing text you choose to check. If you choose to share campaign results, it also stores aggregate totals such as sends and clicks. Topline does not ask for or collect subscriber lists, recipient addresses or recipient-level engagement events.
This notice explains how Jacquard Group Limited handles personal data specifically in connection with Topline.
1. Who we are
Topline is operated by Jacquard Group Limited (Jacquard, we, us). Jacquard Group Limited is registered in England and Wales under company number 09453268. Its registered office is 82 St John Street, London, United Kingdom, EC1M 4JN.
Questions and privacy requests can be sent to privacy@jacquard.com. This notice should be read with the Topline Terms of Service and the shorter Data Use statement.
2. Our role
Jacquard is controller for personal data used to manage Topline accounts, authentication, billing, security, service communications and the operation of the service.
Marketing text and campaign information submitted by a customer are Customer Content. If Customer Content contains personal data, the customer is normally controller and Jacquard processes that data on the customer's behalf. The Data Processing Terms in the Terms of Service apply to that processing.
3. Personal data we collect
Account and authentication data
- name, work email address and profile image, where provided;
- sign-in method and provider identifiers;
- authentication tokens and database-backed session records needed to sign you in and keep you signed in; and
- your workspace, role, brand access and last-active information.
Workspace, team and billing data
- workspace and brand names, plan, credit balance and service settings;
- team membership, roles and the email addresses of people invited to a workspace;
- API-key name, display fragment, creator and use dates; Topline stores only a one-way hash of the key itself; and
- Stripe customer and subscription identifiers, plan status, renewal date and a limited card description such as card brand and last four digits. Stripe, not Jacquard, holds the full card details.
Submitted copy and scores
Topline stores each submitted line of marketing text, the channel, score and verdict, time of the check, workspace and brand, and whether it came from a user, connected assistant or API key. This allows the customer to see history and usage and allows Topline to provide the service.
Optional aggregate campaign results
If a customer chooses to share results, Topline may receive the exact marketing line, total sends or impressions, total clicks, optional aggregate opens and attributed revenue, channel and send date. Topline associates that submission with the relevant workspace, brand, user, assistant or API key and, where possible, the earlier check.
These are campaign totals, not individual events. Topline does not solicit or provide fields for recipient names, email addresses, telephone numbers, subscriber lists, device identifiers or recipient-level engagement histories. Customers must not submit that information. Aggregate campaign totals that cannot reasonably identify an individual are not personal data, but Jacquard treats them as confidential Customer Content.
Connected assistants
When an AI assistant connects, Topline records the client registration, redirect addresses, the verified assistant name or unverified host label, the user, workspace and selected brand, and hashed access and refresh tokens. The assistant can submit copy and, when the user asks it to, aggregate campaign results. Topline returns scores, results and credit information to the assistant through the connected session.
Technical and security data
Topline records request identifiers, route, method, response status, timing, service events and authenticated account, workspace, connection or API-key identifiers. Application logs exclude submitted copy, request and response bodies, email addresses and credentials. Infrastructure security and access logs may include IP address, requested URL, user agent, timestamps, security-rule decisions and similar connection information.
If you contact us, we also process the details and contents of the correspondence needed to answer and keep an appropriate support record.
4. Where the data comes from
We receive personal data:
- from you and other authorised workspace users;
- from Google or Microsoft if you choose that sign-in method;
- from a connected AI assistant or API client acting on your instructions;
- from Stripe in connection with subscription and payment status; and
- automatically from browsers, devices and infrastructure when Topline is used.
Topline does not connect directly to an email, advertising or other marketing platform to obtain Customer Content or campaign results.
5. Why we use personal data
- Provide Topline and perform the contract: create accounts, authenticate users, score copy, store history, display aggregate results, manage workspaces, provide API and assistant connections, allocate credits and administer subscriptions.
- Operate and protect the service: prevent abuse, enforce limits, investigate faults and security incidents, maintain audit trails and protect Jacquard, customers and users. We rely on our legitimate interests in running a secure and reliable business service.
- Communicate: send sign-in links, invitations, connection notices, low-credit messages, billing information and important service or legal updates. This is necessary to provide the service and administer the customer relationship.
- Meet legal obligations and establish or defend legal claims: including accounting, tax, regulatory and law-enforcement requirements.
Jacquard does not use submitted copy or aggregate campaign results to train or improve Neural 2.1 or another model unless Jacquard and the customer separately agree that use in writing. Topline does not use personal data for advertising and does not sell personal data.
Topline's scores evaluate marketing text, not people. Topline does not make solely automated decisions about individuals that produce legal or similarly significant effects.
6. Who receives the data
We may disclose relevant data to:
- Amazon Web Services, including Amazon SES: application and model hosting, database, backups, security logs and transactional email;
- Stripe: subscription and payment processing;
- Google or Microsoft: authentication, only if you choose that provider;
- the connected AI assistant: the tool response and related information needed to complete a request made through that assistant;
- professional advisers, auditors and insurers under duties of confidentiality;
- authorities or other parties where required by law or reasonably necessary to protect legal rights; and
- a buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
An AI assistant, email platform or advertising platform chosen by the customer is governed by the customer's relationship with its provider. It is not Jacquard's subprocessor merely because the customer uses it to send information to or receive information from Topline.
7. Locations and international transfers
Topline's application, database and self-hosted Neural 2.1 service run in Amazon Web Services in Ireland (eu-west-1). Some providers, including Stripe, Google and Microsoft, may process data in other countries under their service arrangements.
Where personal data is transferred from the UK or European Economic Area to a country without an applicable adequacy decision, Jacquard uses a lawful safeguard such as the UK International Data Transfer Agreement or Addendum and the European Commission's Standard Contractual Clauses, together with supplementary measures where required. Contact privacy@jacquard.com for information about relevant safeguards.
8. Retention
- Account, workspace and Customer Content: while the workspace is active. Following workspace closure or a verified deletion request, in-scope records are deleted or irreversibly anonymised within 30 days, unless a legal obligation or documented legal hold requires retention.
- Backups: residual copies expire through the normal backup cycle no later than 90 days after operational deletion and are isolated from ordinary use.
- Application, security, WAF and load-balancer logs: 30 days.
- Sign-in and connection credentials: for their configured validity period or until use, expiry or revocation.
- Billing and tax records: up to six years where needed for legal, tax and accounting purposes.
- Support and legal records: for as long as reasonably required to resolve the matter and establish or defend legal claims.
Automated customer-content deletion is being implemented. Until it is available, Jacquard will fulfil verified closure and deletion requests through a controlled manual process.
9. Cookies
Topline currently uses only cookies needed to provide and secure the service: a session cookie, sign-in security and callback cookies, and short-lived cookies that remember the email address and return location during an email-link sign-in. Topline does not currently use advertising or analytics cookies. If that changes, this notice and any required consent controls will be updated before non-essential cookies are used.
10. Security
Jacquard uses technical and organisational safeguards appropriate to the risk. These include encrypted external connections, encrypted database and log storage, access controls, hashed API and connection credentials, structured log redaction, monitoring, backups and confidentiality obligations. No internet service can guarantee absolute security. Please report a suspected security issue to infosec@jacquard.com.
11. Your rights
Depending on the law that applies, you may have rights to access, correct, erase or restrict personal data, object to certain processing, receive portable data, and withdraw consent where processing relies on consent. You may also complain to the UK Information Commissioner's Office or your local data-protection authority.
Send a request to privacy@jacquard.com. We may need to verify your identity and, where Customer Content is concerned, coordinate with the customer that controls the data. Rights may be subject to legal exemptions.
12. Children
Topline is a business service for people aged 18 or over. It is not directed to children, and customers must not submit children's personal data in Customer Content.
13. Changes and contact
We may update this notice to reflect changes in Topline, the law or our processing. We will change the date above and, where a change materially affects users, provide a prominent notice or email before it takes effect where practicable.
Contact: privacy@jacquard.com, or write to General Counsel, Jacquard Group Limited, 82 St John Street, London, United Kingdom, EC1M 4JN.