Who we are
Topfloor is a private members' network operated from the United Kingdom. Topfloor (“we”, “us”) is the controller of the personal data described in this policy, which means we decide how and why it is used.
You can contact us about anything in this policy at admissions@thetopfloor.co.
The short version
What we collect
When you apply: your name, email address, city, country, vocation, why you want to join, and how you heard about us.
When you are a member: your profile (such as your name, headline, location and any photo), what you post and comment on, likes, your private messages with other members, your floor (standing), and the date you joined.
Notifications: if you switch on notifications, a technical token for your device or browser that lets us send you notifications.
Payments: when payments are introduced, they will be handled by our payment provider. We receive confirmation of payment and your subscription status, but not your full card number.
Technical data: basic information needed to keep the service working and secure, such as your sign-in session.
Why we use it, and our legal basis
- To review your application and run your membership — to take steps at your request and to perform our agreement with you (contract).
- To keep Topfloor safe, private and working — preventing misuse and protecting members (our legitimate interests).
- To send notifications and messages you ask for, such as a morning message or alerts (your consent, which you can withdraw by turning notifications off).
- To email you about your application and membership (contract and legitimate interests).
- To meet our legal obligations, such as tax and accounting records (legal obligation).
We will not use your details to market third-party products, and we will not feature you publicly without your agreement.
Who sees your data
Other members see your profile and what you choose to share inside Topfloor. Only you and the person you are messaging can see a private message.
The small team that operates Topfloor can technically access stored data in order to run and secure the service. We do not read private messages except where it is necessary for safety, security or legal reasons.
We use trusted service providers to run Topfloor, who handle data only on our instructions: Supabase (database and sign-in), Vercel (website hosting), Resend (email), and notification delivery services provided by your browser or device. A payment provider will be added when payments begin. We never sell your data to anyone.
Moving data abroad
Some of our providers may process data outside the UK. Where they do, we rely on appropriate safeguards required by UK data protection law, such as approved standard contractual clauses or UK-recognised adequacy arrangements.
How long we keep it
Applications: kept while your application is being considered. Declined or cleared applications are removed from our systems when we dismiss them.
Members: kept for as long as you are a member. If you leave or ask us to delete your account, we delete your profile, posts, messages and notification tokens, except for anything we must keep by law, such as payment records.
Financial records: kept for the period required by UK tax and accounting law.
Your rights
Under UK data protection law you have the right to:
- be told what personal data we hold about you and to receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- ask us to restrict how we use it, or object to certain uses;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on it.
To use any of these rights, email admissions@thetopfloor.co. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the UK's Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.
Cookies and tracking
Topfloor uses only essential cookies and similar storage, for example to keep you signed in and to run the app. We do not use advertising or analytics cookies, and we do not track you across other websites. Because these are strictly necessary, they do not require a consent banner.
Security
We use industry-standard protections, including encrypted connections and access controls, and we limit who can reach your data. No online service can be completely secure, so we also ask you to keep your sign-in details private. If a breach affects your data in a way that is likely to cause you harm, we will tell you and the regulator as the law requires.
Changes to this policy
We may update this policy as Topfloor grows, for example when payments begin. If we make a material change, we will let members know. The date at the top shows when it was last updated.