On this page
The short version
- We collect what you type into the checker (business name, category, city and, if you add it, your website) and the results of the check.
- We collect your email only when you give it to us, for example to unlock the full audit or after you buy.
- Card payments are handled by Stripe. Your card details never reach our servers.
- Our analytics are cookieless counts with no personal data in them.
- We set one session cookie, and only after you buy, so you stay signed in.
- The AI engine sees your business name, category and city in the questions we ask it. It never sees your email.
- Your results are private unless you tap Share. You can delete a share link at any time.
- We don't sell your personal information, and we don't use it for advertising.
This policy explains what TopThree AI ("TopThree", "we", "us") collects when you use this site, why, how long we keep it, who processes it for us, and how to ask us to see or delete it. We've kept it short and specific. If something here is unclear, email us at [PLACEHOLDER: contact email].
What we collect and why
| What | When | Why |
|---|---|---|
| Business name, category, city | You run a check | To build the questions we ask the AI engine and to find your business in its answers |
| Website address | You add it (optional) | To run the AI-readiness audit of your public pages |
| Check results | Every check | To show you the exact prompts, the raw AI answers, which businesses were named and your audit score, and to show history over time |
| Email address | You give it: to unlock the full audit, start the weekly re-check, sign in, buy, or send a correction request | To send you the result, re-check emails, sign-in links and receipts, and to link your purchases to your account |
| Fix Pack intake details | You fill in the intake form after buying a Fix Pack | To build your Fix Pack files. This can include your business address, phone, hours, services, price ranges, service areas and profile links |
| Purchase records | You buy | Plan, amount, dates and the Stripe customer and subscription IDs, so we know what you're entitled to |
| Correction and removal requests | You send one | To review and act on it |
| IP address | Every request | Briefly, to rate-limit the free checker and stop abuse. We don't use it to identify you |
| Analytics counts | You use the site | To see which pages and steps work. Cookieless, with no names, emails, business names, websites, cities or AI answers in them |
Public pages we read. When you give us a website, we fetch its public homepage, robots.txt, llms.txt and sitemap, the same as any visitor or search engine could. For a Fix Pack, we also fetch the public homepages of the businesses AI named instead of you, to compare them. We never log in to any site or account.
What we never collect. Passwords to your website, CMS, Google Business Profile or social accounts. We never ask for them and never log in for you.
Cookies and storage on your device
- Session cookie: after you buy, we set one secure, HttpOnly cookie that keeps you signed in. We don't set it before you buy, and it isn't used for tracking.
- Saved checks: free checks you run are saved in your own browser's local storage so you can find them again. They stay on your device until you clear them. If you later sign in, we add them to your account.
- Bot protection: our bot check (Cloudflare Turnstile) may read browser signals to tell people from bots. [FOUNDER VERIFY: whether Turnstile sets any cookie]
- Stripe: when you go to checkout, you're on Stripe's pages, and Stripe's own cookies and privacy policy apply there.
- Visit ID (not a cookie): when you open the site we create a random ID in your browser's session storage. It isn't a cookie, holds nothing about you, and is cleared when you close the tab. We send it with a free check, an email confirmation and a checkout, together with how you found us (the campaign tags in the link, a partner code, the page you landed on and the referring website's domain), so we can count which sources lead to checks and purchases. We don't store your IP address or browser details with it, and it never goes to advertisers.
- We use no advertising cookies and no third-party tracking pixels.
What the AI engine receives
To run a check, we send questions to an AI engine. Those questions contain your business name, category and city, and the names of businesses the engine named earlier in the same check. They do not contain your email address or anything from the Fix Pack intake form.
Which engine answered is shown on every result:
- Llama 3.3 70B on Cloudflare Workers AI is the default. It runs on Cloudflare's network.
- OpenAI is used only if we switch that engine on, and the result will say so. OpenAI states that data sent through its API is not used to train its models by default. [FOUNDER APPROVAL + FOUNDER VERIFY]
- Any other engine would be added to this list before we use it.
The AI answers we store may name your business and other businesses. They are the engine's words, not ours.
Who processes data for us
We use a small number of service providers. They process data only to provide their service to us.
| Provider | What for | Data involved |
|---|---|---|
| Cloudflare | Hosting (Workers), database (D1), cache (KV), the AI engine (Workers AI), bot protection (Turnstile) and web analytics if enabled | Everything stored by the service, plus request data such as IP address |
| Stripe | Payments, subscriptions, billing portal, receipts | Your name, email, billing details and card details (entered directly with Stripe) |
| Email provider [PLACEHOLDER: provider name] | Sending sign-in links, results, re-check emails and receipts, once email sending is switched on [FOUNDER APPROVAL] | Your email address and the email content |
| OpenAI | Only if the OpenAI engine is switched on, and results will say so [FOUNDER APPROVAL] | The check questions (business name, category, city, competitor names) |
| Google (Places API) | Only if the Google Business Profile comparison is switched on [FOUNDER APPROVAL] | The business name and city used to look up public Google listings |
These providers may store and process data in the United States and other countries. [FOUNDER VERIFY: D1 and KV data location settings]
We don't sell or rent personal information, and we don't share it for advertising. We may disclose information if the law requires it, or to protect our service and users from fraud or abuse.
Public share pages
Your results are private by default. A public page at /s/… is created only when you tap Share. Before you share, you can hide your business name, competitor names, or both. Share pages never include your email address. They are set to noindex by default, so search engines are asked not to list them, unless you choose otherwise.
You can delete a share link at any time from your dashboard. After that, the link shows a "removed" page. Copies someone already downloaded, such as a share image, are outside our control.
Our "who AI recommends" pages
We publish pages on our own site that show what an AI engine answered to a general question such as "best plumber in Austin", with the engine, date and method. These answers can name businesses. They come from stored answers to general questions that don't name any one business. Some of those answers may come from checks our users ran, but the pages never show who ran a check, never include an email, and never use questions that name the business that ran the check. [FOUNDER CONFIRM]
If your business appears and something is wrong, or you'd like it removed, use the "Request a correction or removal" link on the page or send a correction request.
If we contact your business
[FOUNDER VERIFY: keep this section only if outreach is used]
We may email a business at an address it publishes on its own website or listing, with a link to a private result for that business. Every such email includes our postal address and a one-click unsubscribe, and we honor unsubscribes promptly and keep a suppression list so we don't email you again. Private result links expire after 30 days.
How long we keep it
These are our defaults. [FOUNDER CONFIRM all periods]
| Data | Kept for |
|---|---|
| Free check results (prompts, AI answers, named businesses) not linked to an account | 12 months, then deleted |
| Check results in a paid account | While the account is open, then 90 days, then deleted |
| Email addresses from the free checker or unlock | Until you unsubscribe or ask us to delete it, or 24 months with no activity |
| Fix Pack intake details and generated files | While the account is open, then 90 days |
| Purchase and invoice records | As long as tax and accounting law requires (commonly 5 to 7 years) [FOUNDER VERIFY] |
| Share pages | Until you delete them, or your account is deleted |
| Private result links sent to businesses | 30 days |
| Rate-limit records (IP address) | Up to 24 hours |
| Correction and removal requests | 24 months |
| Unsubscribe (suppression) list | Kept, so we keep honoring it |
| Analytics counts | Kept; they contain no personal data |
| Backups | Overwritten on a rolling basis [FOUNDER VERIFY: D1 Time Travel retention] |
Your choices and rights
You can ask us to:
- show you the personal information we hold about you,
- correct it,
- delete it, or
- stop sending you email.
Email us at [PLACEHOLDER: contact email] from the address you used with us. We'll reply within 30 days. [FOUNDER CONFIRM] We may ask you to confirm the request from that address so we don't hand your data to someone else. Deleting your data doesn't delete records we must keep by law, such as invoices.
You can cancel a subscription yourself at any time from the Stripe billing portal linked in your dashboard. Every non-transactional email has a one-click unsubscribe link. Unsubscribing doesn't stop receipts or sign-in links you ask for.
Email and CAN-SPAM
Our emails say who they're from, use honest subject lines, include our postal address and include a working unsubscribe link in every marketing email. We process unsubscribes promptly and well within the 10 business days the US CAN-SPAM Act allows. Because we operate from Australia, we also follow the Spam Act 2003 (Cth), which requires unsubscribes to take effect within 5 business days. [FOUNDER VERIFY]
Where we operate
TopThree serves businesses in the United States and is operated from Australia. [PLACEHOLDER: legal entity or founder name] We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). [FOUNDER VERIFY: whether the Act applies directly, e.g. the small business exemption, and if not, whether to commit to the APPs voluntarily] If you're in Australia and unhappy with how we've handled a complaint, you can contact the Office of the Australian Information Commissioner (OAIC).
Whatever your location, we'll respond to access and deletion requests as described above. [FOUNDER VERIFY: whether any US state privacy law applies at our size]
Security
We use HTTPS everywhere, keep secrets out of code that reaches your browser, check payments and bot-protection tokens on the server, and limit who can read check results and Fix Packs to their owner. No system is perfectly secure. If we learn of a breach that affects your personal information, we'll tell you as the law requires.
Children
TopThree is a business tool. It is not meant for anyone under 16, and we don't knowingly collect personal information from them. If you think a child has given us information, email us at [PLACEHOLDER: contact email] and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change is significant, such as a new kind of data or a new provider that receives personal information, we'll also say so on the site, and by email if you have an account, before it takes effect.
Contact
Privacy questions and requests go to a person, by email.
- Company
- TopThree AI [PLACEHOLDER: legal entity name]
- Postal address
- Location
- Australia [PLACEHOLDER: city]
[PLACEHOLDER: contact email and postal address. Set SITE.contactEmail and SITE.postalAddress]