This policy explains what personal data TopTop Oy collects through toptop.dev, why, and what rights you have. We keep it short and specific to what this website actually does.

Who we are

The data controller is TopTop Oy, Helsinki, Finland (Business ID 3476344-4). For anything about your data, email diyaz.yakubov@toptop.dev.

What we collect and why

When	Data	Purpose	Legal basis (GDPR)
You send the contact form	Name, email, subject, message	Reply to you	Steps before a contract / legitimate interest, Art. 6(1)(b) and (f)
You request a quote	Name, email, company (optional), project type, budget range, description	Prepare and send a quote	Steps before a contract, Art. 6(1)(b)
You book a consultation	Name, email, topic, preferred date and time	Arrange the consultation	Steps before a contract, Art. 6(1)(b)
You subscribe to the newsletter	Email address; delivery events (delivered, opened, clicked, bounced)	Send the newsletter and keep the list healthy	Consent, Art. 6(1)(a). Unsubscribe anytime with the link in every email
You enrol in a TopTop Academy program	Name, email, sign-in data, enrolment, lesson progress, your private lesson notes	Provide the program and the student portal	Contract, Art. 6(1)(b)
You accept analytics cookies	Pages viewed, clicks, device and browser type, approximate location, performance data and browser errors	Understand how the site is used and improve it	Consent, Art. 6(1)(a)
You submit any form above	A submission event in PostHog with your name, email and the form's topic details (subject; company, project type and budget; or consultation topic and date), linked to your visit only if you accepted analytics. This is recorded whether or not you accepted analytics cookies	Track enquiries through our sales pipeline	Legitimate interest, Art. 6(1)(f)
Any visit	IP address, request logs, anonymous performance metrics (Core Web Vitals), server error reports	Run, secure and speed up the site; fix errors	Legitimate interest, Art. 6(1)(f)
You submit any form above	Your IP address in a short-lived submission counter	Prevent spam and abuse (limit repeated submissions)	Legitimate interest, Art. 6(1)(f)

We don't sell your data, and we don't use it for automated decisions with legal or similarly significant effects.

Cookies and local storage

Essential (always on): your cookie choice (toptop_analytics_consent) and your light/dark theme preference, both kept in your browser's local storage. If you sign in to the Academy, Clerk sets cookies needed to keep you signed in.
Analytics (only if you accept): PostHog cookies and local storage that recognise returning visitors. PostHog isn't even downloaded until you click Accept.

You can change your choice at any time via Cookie settings in the site footer. If you withdraw consent, we stop analytics immediately and delete the PostHog cookies and local storage on this site.

Who processes your data for us

We use these service providers (processors) under data processing agreements:

Provider	What for	Location
Vercel Inc.	Website hosting, logs, performance metrics (Speed Insights)	EU: the site's servers run in Stockholm, Sweden. Static pages are served from Vercel's global network
Upstash Inc. (Vercel KV)	Database for form submissions, subscribers, Academy data and short-lived anti-spam counters	EU: primary database in Frankfurt, Germany, with a read copy in Ireland
Resend Inc.	Sending emails and tracking newsletter delivery	EU (Ireland)
PostHog Inc.	Product analytics, enquiry tracking and error tracking	EU (PostHog EU Cloud). IP addresses are anonymised and sessions are not recorded
Clerk Inc.	Academy sign-in and accounts	United States

Where a provider processes data outside the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

Enquiries (contact, quote, consultation): 24 months after our last contact, unless they become a customer relationship.
Newsletter: until you unsubscribe; after that we keep only what's needed to respect your opt-out.
Academy data: for the duration of your enrolment and 12 months after it ends.
Analytics and enquiry events in PostHog: 1 year.
Anti-spam counters (IP address): 1 hour.
Accounting records related to paid services: as required by Finnish accounting law.

Your rights

You can ask us to access, correct, delete, restrict or port your data, object to processing based on legitimate interest, and withdraw consent at any time (this doesn't affect processing done before you withdrew). Email diyaz.yakubov@toptop.dev and we'll respond within one month.

You can also complain to the Finnish data protection authority, the Office of the Data Protection Ombudsman (tietosuoja.fi), or the authority in your own EU country.

Changes

If we change this policy, we'll update the date at the top. For significant changes we'll tell newsletter subscribers and Academy students by email.