Last updated: October 2026

Privacy policy

Placeholder — replace with legally reviewed text before launch.

Controller

NXT TECH LTD (trading as TopPinned)
Unit A101, 4-6 Greatorex Street, London, England E1 5NF, United Kingdom
hello@toppinned.com · +44 7543 767730

Processing activities

Hosting & server logs

Data: IP address, user agent, requested URL, timestamp
Purpose: Delivering the website, security, error analysis
Legal basis: Art. 6(1)(f) UK GDPR / EU GDPR
Recipients / processors: Vercel Inc. (USA, EU-US Data Privacy Framework / SCCs)
Retention: Per Vercel log retention (typically ≤ 30 days)

Approximate location (personalization)

Data: City and country derived from your IP by our host’s edge network
Purpose: Pre-filling the city in the audit form and showing your city in one sentence on the home page. Never used for redirects or to change content.
Legal basis: Art. 6(1)(f) UK GDPR / EU GDPR
Recipients / processors: Vercel Inc. (request headers only — no third-party IP lookup)
Retention: Not stored

Instant local SEO audit

Data: Business name, city and keyword you enter; Google place ID; public business data from Google; your website’s speed measurement; estimated rankings; our computed scores
Purpose: Running the audit you requested and showing the result page
Legal basis: Art. 6(1)(b) and (f) UK GDPR / EU GDPR
Recipients / processors: Google Ireland Ltd. (Places API, PageSpeed Insights API); DataForSEO (Google Maps ranking data); Upstash Inc. (storage, EU region)
Retention: Place ID, scores and measurements: 30 days, then deleted automatically. Google business data is not stored — it is fetched live when the result is viewed.

Website & AI-readiness scan

Data: Publicly available content of the audited business’s homepage, robots.txt and llms.txt, and of its top 3 competitors’ homepages (titles, contact details, structured data). No visitor data.
Purpose: Checking local-SEO and AI-search signals for the audit report
Legal basis: Art. 6(1)(f) UK GDPR / EU GDPR
Recipients / processors: TopPinned (own scan, run on Vercel)
Retention: Computed results only, 30 days

Business outreach by post or in person

Data: Publicly available business information (name, address, Google profile data, website) and our audit results for that business
Purpose: Sending a business a free summary of its local visibility by letter or bringing it to a visit. We do not send unsolicited marketing emails where the law requires consent.
Legal basis: Art. 6(1)(f) UK GDPR / EU GDPR (direct marketing; you can object at any time, Art. 21)
Recipients / processors: TopPinned; printing and postal services
Retention: Up to 12 months, or immediately deleted if you object (email hello@toppinned.com)

Abuse protection

Data: IP address (as a rate-limit key); Turnstile challenge signals
Purpose: Preventing bots and abuse of the free audit
Legal basis: Art. 6(1)(f) UK GDPR / EU GDPR
Recipients / processors: Cloudflare Inc. (Turnstile); Upstash Inc. (rate limiting)
Retention: Rate-limit counters: up to 1 hour

Report, checklist & contact emails

Data: Name, email, message, audit summary
Purpose: Sending what you requested and replying to you
Legal basis: Art. 6(1)(a) and (b) UK GDPR / EU GDPR
Recipients / processors: Resend Inc. (USA, SCCs)
Retention: As long as needed for the enquiry; leads up to 24 months unless you object

Analytics (only with consent)

Data: Anonymous page views, referrer, device type (no cookies)
Purpose: Improving the website
Legal basis: Art. 6(1)(a) UK GDPR / EU GDPR, PECR, § 25(1) TDDDG
Recipients / processors: Plausible Insights OÜ (EU)
Retention: Aggregated statistics only

WhatsApp & booking links

Data: Only if you click: data you share with WhatsApp or the booking tool
Purpose: Contacting us through your preferred channel
Legal basis: Art. 6(1)(a) and (b) UK GDPR / EU GDPR
Recipients / processors: WhatsApp Ireland Ltd.; Cal.com, Inc. (booking)
Retention: Per provider

About Google data

The audit uses Google Maps Platform. Google’s Privacy Policy (policies.google.com/privacy) and the Google Maps terms additionally apply.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time with effect for the future. You may lodge a complaint with a supervisory authority, e.g. the UK Information Commissioner’s Office (ICO, ico.org.uk) or the supervisory authority in your EU country of residence.