Privacy Policy

TopKnock Marketing LLC ("TopKnock," "we," "us," or "our") operates the TopKnock platform (the "Service"). This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and the rights you have. It applies to the Service, our website, and related communications. It does not cover third-party websites, platforms, or services, which have their own privacy policies.

Who this applies to. This policy covers (i) our Customers and their Authorized Users (contractors and their teams who use the Service), (ii) visitors to our website, and (iii) end users whose data flows through the Service as leads, callers, or message recipients. If you are an end user and you have questions about how your data was collected or used by a contractor, contact that contractor directly — they are the controller of that data.

1. Information We Collect

1.1 Information you provide

• Account & profile. Name, email, phone, password (via our identity provider Clerk), business name, business address, trade category, service area, professional licenses, team-member identities and roles.
• Billing. Payment card, billing address, tax identifiers, and transaction history (processed and stored by our payment processor Stripe; we retain limited metadata such as last 4 digits, brand, and receipt URLs).
• Advertising assets. Photos, videos, logos, trade-specific content, voice-profile inputs, brand guidelines, and ad copy you upload or generate.
• Audio uploads (Pro). Voicemail recordings you create or upload for outbound ringless voicemail drops.
• Integrations credentials. OAuth tokens, API keys, or webhook secrets you supply for Meta Ads, Google Calendar, CRMs, and other connected services.
• Support & feedback. Messages you send to support, chat transcripts, survey responses, and creative feedback you submit.

1.2 Information collected automatically

• Device & usage. IP address, device identifiers, browser type, operating system, pages viewed, actions taken, referrer URLs, timestamps, and crash logs.
• Cookies & similar technologies. Session cookies and local storage for authentication, security (CSRF, rate limiting), preferences, and analytics. See Section 10.
• Audit logs. Records of sensitive actions taken by you or your Authorized Users for security, troubleshooting, and compliance.

1.3 Information collected on behalf of Customers (Lead Data)

When you (as a Customer) run campaigns, connect phone numbers, or enable messaging, we process data about your leads, callers, and message recipients on your behalf. This may include:

• Names, phone numbers, email addresses, ZIP codes, and form-field responses submitted through Meta Lead Forms or your website;
• Call metadata (caller number, called number, start and end time, duration, call outcome) and, where you enable it, call recordings and transcripts;
• SMS / MMS / RCS message content, delivery status, and opt-in / opt-out history;
• Voicemail content delivered through ringless voicemail (Pro);
• Consent records and timestamps;
• Enrichment data appended from third-party data providers (property, ownership, permit, contact).

1.4 Information from third parties

• Meta. Ad account status, campaign and creative performance, audience maturity signals, policy review feedback, webhook notifications.
• CRMs. Job status, booked-vs-quoted outcomes, and other data you choose to sync back.
• Enrichment providers (BatchData, RentCast, Shovels). Property ownership, permit history, valuation, and contact data derived from public records and licensed datasets.
• Google. Business-profile attributes, calendar availability, reviews (if you connect those features).
• Public sources. Business registration, licensing, and public listings for onboarding validation.

2. How We Use Information

We use information to:

• Provide and operate the Service, including creating and optimizing ad campaigns, generating AI ad copy and creatives, routing calls and messages, scoring leads, enriching data, computing ROI, and generating reports;
• Authenticate users, secure the Service, detect and prevent fraud or abuse, and enforce our Terms;
• Charge subscription fees, send receipts, and comply with financial, tax, and anti-money-laundering laws;
• Personalize the Service — for example, learning your business voice ("prompt injections") so the AI generates content aligned with your prior approvals and feedback, on an account-scoped basis;
• Send transactional messages (lead alerts, security notices, service announcements) and, where permitted, marketing communications (you may opt out at any time);
• Conduct analytics, debugging, aggregate usage measurement, and product improvement;
• Fulfill legal obligations and respond to lawful requests from authorities;
• With your authorization, perform specific actions you request (e.g., pushing a lead to your CRM, uploading a Custom Audience to Meta).

We do not sell your personal information for money. See Section 8 regarding "sale" and "sharing" under state privacy laws.

3. Legal Bases (EEA / UK)

If you are in the European Economic Area or United Kingdom, our legal bases are:

• Performance of a contract — to provide the Service and respond to your requests;
• Legitimate interests — to secure, improve, and market the Service, subject to your rights;
• Consent — for optional marketing and certain cookies (you may withdraw at any time);
• Compliance with legal obligations — for tax, accounting, and lawful requests.

4. How We Share Information

We share personal information only in the circumstances below. We do not authorize our service providers to use shared information for their own purposes.

4.1 Service providers (processors / subprocessors)

We engage reputable providers to operate the Service. All processors are under written contracts that restrict their use of your data to providing the Service to you, require appropriate security (encryption in transit and at rest, access controls, breach notification), and, where required for cross-border transfers, include Standard Contractual Clauses.

The named subprocessors we use, the data they process, and their role are:

Business data submitted to any of the AI providers above (OpenAI, Replicate, Stability AI) is not used to train general-purpose models for other customers. We review subprocessors for security and legal compliance; material additions will be announced in-app or by email. Enterprise customers may receive an updated list under a Data Processing Agreement by emailing privacy@topknock.ai.

4.2 At your direction — CRM & workflow integrations

When you authorize an integration with a customer-relationship-management platform or a workflow-automation service, we transmit lead data — including names, phone numbers, email addresses, custom fields, campaign attribution, lead score, and call / SMS activity — to that platform on your behalf. Supported integrations are listed on the Service's integrations page and in your account settings. Your use of each third-party platform is governed by its own privacy policy and terms, which we do not control.

4.3 With Meta — Lead Forms, Conversions API, Custom Audiences

• Lead Forms. When a consumer submits a Meta Lead Form tied to your campaign, Meta shares the submitted data with us so we can deliver it to you.
• Conversions API (CAPI). With your authorization, we send hashed conversion events (e.g., Lead, Schedule, Purchase) with hashed PII to Meta to improve ad optimization for your account.
• Custom Audiences. With your authorization and representation of compliant consent, we upload hashed customer identifiers to Meta for audience creation. We do not upload such lists without your instruction.
• See Section 6 for the Meta Platform Terms disclosures.

4.4 Legal and safety

We may disclose information to: (i) comply with law, legal process, or a lawful request from a government authority; (ii) enforce our Terms and protect our rights, property, or safety, or that of our users or the public; (iii) detect, prevent, or address fraud, security, or technical issues; (iv) respond to subpoenas, court orders, or similar legal process; or (v) in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

4.5 No sale of personal information

We do not sell personal information for monetary consideration. We "share" information with Meta for advertising optimization only at your direction, consistent with the Meta-specific disclosures above. Where state law provides a right to opt out of "sharing" for targeted advertising purposes, you may exercise that right — see Section 8.

5. Call Recording, SMS & Ringless Voicemail

5.1 Call Recording.

The Service can record inbound calls to tracking numbers you provision. Recording is disabled by default; if you enable it, you (the Customer) are the data controller for the recordings and are responsible for legal compliance, including jurisdictions that require all-party consent. We provide pre-call recording disclosures for your use. States that currently require all-party consent include California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington (other states may also require consent under specific circumstances). You must confirm current local law. See the Terms of Service, Section 9.2.

5.2 SMS Messaging.

Messages sent through the Service are transmitted via Twilio. You are responsible for obtaining required consent under the TCPA and state analogs, honoring STOP/HELP keywords, and registering campaigns (e.g., 10DLC) where required. We maintain an opt-out suppression list keyed to phone number for messages you send through the Service; opt-outs are honored for future messages you send through us.

5.3 Ringless Voicemail (Pro).

Ringless voicemail drops are regulated in many jurisdictions. You are responsible for compliance, including any required consent. We store your voicemail audio for delivery and record delivery metadata.

6. Meta Platform Data

When you connect a Meta account to the Service, we access and process data in accordance with Meta's Platform Terms and Developer Policies. Specifically:

• We access only the scopes necessary to deliver the Service (e.g., ads_management, leads_retrieval, pages_manage_ads).
• We do not sell Meta Platform Data.
• We do not use Meta Platform Data for purposes unrelated to providing the Service to you.
• Lead data delivered via Meta Lead Forms is processed solely to deliver those leads to you and to operate the Service features you enable (e.g., CRM sync, SMS follow-up, lead scoring).
• You may disconnect your Meta account at any time in the Service, which revokes our access going forward.
• We retain data consistent with Section 7 below.

7. Data Retention

We retain personal information only as long as necessary to provide the Service and fulfill the purposes described in this policy, then delete or de-identify it, except where longer retention is required or permitted by law (e.g., tax and financial records, dispute resolution, fraud prevention).

8. Your Privacy Rights

8.1 Rights you may have

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion, subject to legal and service-continuity exceptions;
• Obtain a portable copy of your information;
• Opt out of targeted advertising, "sale," or "sharing" of personal information (we do not sell for money; we "share" only at your direction as described in Section 4);
• Opt out of profiling that produces legal or similarly significant effects (we do not engage in such profiling against you);
• Limit the use of sensitive personal information (we do not use SPI for purposes outside those expressly permitted by state law);
• Withdraw consent where processing relies on consent;
• Appeal a denial of a privacy request (required in certain states).

8.2 How to exercise your rights

Send a request to privacy@topknock.ai or contact us at the address below. We will verify your identity before fulfilling requests. We will respond within the time frames required by applicable law (e.g., 45 days under CCPA/CPRA with a 45-day extension where necessary). We will not discriminate against you for exercising your rights.

8.3 Role when you are an end user (lead or consumer)

When a contractor (our Customer) collects your data through the Service, the contractor is the controller. To exercise rights over that data, contact the contractor directly. We will assist our Customers in responding to verified consumer requests as their service provider / processor, as required by law.

8.4 California, Virginia, Colorado, Connecticut, Utah & other state disclosures

We provide the disclosures required by the California Consumer Privacy Act (as amended by the CPRA), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and similar laws. Categories of personal information we collect correspond to Section 1 (Identifiers, Commercial information, Internet/network activity, Geolocation derived from IP, Professional or employment information, Audio/electronic information when recording is enabled, Inferences drawn for lead scoring and personalization). The sources, purposes, and recipients correspond to Sections 1, 2, and 4. We have not sold personal information for money in the preceding 12 months. We do not knowingly sell or share personal information of consumers under 16.

California Shine the Light. California customers may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not share your personal information with third parties for their own direct marketing.

8.5 Do Not Track

Our Service does not currently respond to "Do Not Track" browser signals because no common standard has been adopted. We respect the Global Privacy Control (GPC) signal as an opt-out request for "sale" and "sharing" in jurisdictions that recognize it.

9. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the U.S., you understand that your information will be transferred to, stored in, and processed in the U.S. and in other countries where our subprocessors operate. Where required (e.g., transfers of EEA, UK, or Swiss personal data), we implement appropriate safeguards such as Standard Contractual Clauses.

Do Not Sell or Share

We do not sell or share personal information for cross-context behavioral advertising as defined by the CCPA/CPRA. If you're a California resident and want to submit a verifiable consumer request to know, delete, or correct your data, email privacy@topknock.ai.

If you have Global Privacy Control (GPC) enabled in your browser, we honor that signal automatically — you don't need to do anything else.

10. Cookies & Similar Technologies

We use strictly necessary cookies for authentication, security (CSRF, rate limiting), and core functionality. We use a limited set of first-party cookies and local storage for preferences and analytics. We do not use third-party advertising cookies on the Service. You can control cookies through your browser; blocking strictly necessary cookies may prevent the Service from working.

11. Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

• TLS/HTTPS encryption in transit and encryption at rest at the database layer;
• Access controls, least-privilege, and separation of duties;
• Secret management and regular secret rotation;
• Rate limiting, webhook signature verification (Clerk, Stripe, Meta, Twilio), and idempotency protections;
• Audit logging and monitoring with alerting;
• Secure software development practices, dependency scanning, and security reviews;
• Incident-response procedures.

No system is perfectly secure. If we become aware of a breach that affects your personal information, we will notify you and regulators as required by law.

12. Children's Privacy

The Service is intended for business users 18 years of age or older and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child, contact us at privacy@topknock.ai and we will delete it.

13. Automated Decision-Making & AI

The Service uses automated tools to score leads, optimize ad budgets, and generate content. These processes do not make decisions that produce legal or similarly significant effects on individuals. Lead scores are suggestions for Customer prioritization, not determinations about credit, employment, housing, or insurance. You can always review and override automated outputs.

14. Changes to This Policy

We may update this policy from time to time. We will post the updated policy and revise the "Last updated" date, and for material changes we will notify you by email or in-app notice at least 14 days before the changes take effect. Continued use after the effective date constitutes acceptance.

15. Contact Us

Lost City Creations LLC
d/b/a TopKnock Marketing
290 Indian Ridge Ct
Fountain Inn, SC 29644
USA
Privacy: privacy@topknock.ai
Support: support@topknock.ai
Security: security@topknock.ai

EU/UK representatives: we do not currently have an Article 27 representative; EU/UK visitors may contact us at privacy@topknock.ai.