Privacy Policy

1. Who we are

TopJob is a trading name of Horner Systems, a sole trader business operated by James Horner, based in West Yorkshire, United Kingdom.

We are registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration number is ZC218244.

If you have any questions about this policy or how we handle your data, contact us at: hello@topjobapp.com

2. What TopJob does

TopJob is a missed-call lead capture service for UK small businesses. When a customer calls a business using TopJob and the call goes unanswered, TopJob automatically sends an SMS to the caller inviting them to describe what they need, and simultaneously plays a voicemail greeting giving the caller the option to leave a message. SMS replies and voicemails are transcribed, analysed, and presented to the business owner as a structured lead.

This policy covers two groups of people whose data we process:

• Business customers — sole traders and small businesses who subscribe to and use TopJob.
• End users — members of the public who call a business using TopJob and interact with the automated SMS system.

3. Data we collect and why

3a. Business customers

• Email address — used to authenticate you into the TopJob dashboard. We use a one-time code login system; no password is stored.
• Business name — used to personalise the SMS messages sent to your callers on your behalf.
• Mobile phone number — used to send you notifications when a new lead arrives.
• Billing information — payments are handled entirely by Stripe, a trusted global payment processor used by millions of businesses. We do not store your card details — they are entered directly into Stripe's secure system and never pass through TopJob. We receive confirmation of payment status only. You can read Stripe's privacy policy at stripe.com/gb/privacy.
• Account preferences — settings such as auto-archive and service pause status, stored to operate the service correctly.

Legal basis: Contract — processing is necessary to provide the service you have subscribed to.

3b. End users (callers)

• Mobile phone number — obtained automatically from the network when your call is diverted to TopJob. This number is not provided by you directly — it is captured from the network signalling on the diverted call. Used to send you an automated SMS reply, to receive your reply message, and to allow the business owner to follow up with you directly about your enquiry.
• SMS message content — the message you send in reply to our automated SMS. This may include details about the work you need, your postcode, and any other information you choose to include.
• AI-extracted data — your message is analysed by an artificial intelligence system (OpenAI) to extract structured information such as job type, urgency, and postcode. This extracted data is stored alongside your original message.
• Voicemail recording and transcription — if you leave a voicemail after calling a business that uses TopJob, the audio is recorded and stored temporarily by Twilio, then automatically transcribed using OpenAI's Whisper service. The transcription is stored alongside your enquiry and deleted after 90 days. Transcriptions may contain errors.

Legal basis: Legitimate interests (UK GDPR Article 6(1)(f)). TopJob's legitimate interest is operating a commercial service that connects callers with the businesses they have already contacted. The subscribing business's legitimate interest is receiving and responding to customer enquiries that would otherwise be lost. The caller's own interest in getting a response to their enquiry also supports this processing. We have assessed that these interests are not overridden by your rights, given that: you initiated contact by dialling the number; the processing is limited and proportionate; the outreach is a direct response to your call; and you can stop all further contact immediately by replying STOP. Our Legitimate Interests Assessment is available on request.

4. How we use artificial intelligence

When an end user sends an SMS reply, the content of that message is sent to OpenAI's API for automated analysis. OpenAI extracts structured information (such as job type, urgency level, and postcode) to help the business owner quickly assess the enquiry.

No automated decision-making with legal or similarly significant effect takes place. The AI output is presented to the business owner as a summary to assist their manual review — the business owner makes all decisions about how to respond to enquiries.

Where a caller leaves a voicemail, the audio recording is also sent to OpenAI's Whisper API for transcription. The same data handling terms apply.

OpenAI processes data under their API terms of service. Data submitted via the API is not used by OpenAI to train their models. API data is retained by OpenAI for up to 30 days for safety monitoring purposes, then permanently deleted. For more information, see OpenAI's privacy policy at openai.com/privacy.

5. Our role as data controller

TopJob acts as an independent data controller in respect of caller personal data. We determine the purposes and means of this processing — including the choice of AI vendor, the fields extracted from messages, the retention periods, and the sub-processors used. The subscribing business receives the delivered lead and is a separate controller in respect of how they use it.

This means TopJob is directly responsible for the lawfulness of the processing described in this policy and for handling your rights requests in its own right. The data protection obligations between TopJob and subscribing businesses are set out in Schedule 2 of the Terms of Service.

6. SMS communications and your right to opt out (PECR)

SMS messages are sent to end users using Twilio's messaging platform. These messages are sent in direct response to a missed call — they are a legitimate business communication, not unsolicited marketing.

You can opt out of receiving SMS messages from a specific business at any time by replying with any of the following words: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT. You will receive a confirmation message and will not receive further SMS messages from that business via TopJob.

To re-subscribe, reply START at any time.

Opt-out records are stored per business — opting out of one business's messages does not affect messages from other businesses using TopJob.

7. Who we share your data with

We use the following third-party services to operate TopJob. Each acts as a data processor on our behalf:

• Supabase — database and authentication. Data is stored on servers in the European Union (Belgium). supabase.com
• Twilio — SMS sending and receiving, and voicemail recording and storage. Processes phone numbers, message content, and voice recordings. Twilio processes data in the United States under Standard Contractual Clauses. twilio.com
• OpenAI — AI analysis of SMS message content and voicemail transcription. Data submitted via the API is not used by OpenAI to train their models and is retained for up to 30 days for safety monitoring purposes, then permanently deleted. Processes data in the United States under Standard Contractual Clauses. openai.com
• Stripe — payment processing. Handles all billing data for business customers. We do not receive or store card details. Data is processed in the UK/EU. stripe.com
• Resend — transactional email delivery. Used to send login codes, welcome emails, and account notifications to business customers. Data is processed in the European Union. resend.com
• Vercel — web hosting and serverless infrastructure. Hosts the TopJob application. Vercel processes data in the United States under Standard Contractual Clauses. vercel.com
• Upstash — rate limiting and idempotency via Redis. Processes limited request metadata. Data is stored in the European Union (London). upstash.com
• Sentry — error monitoring. May capture technical error data including request details. Data is stored in the European Union. sentry.io

We do not sell your data to any third party. We do not share your data with any party not listed above, except where required by law.

8. Data retention

• Caller personal data (phone number, name, message content, postcode, AI summary) — automatically removed 6 months after a lead is marked as completed (booked or passed). An anonymised record of the job type and outcome is retained to support the business owner's historical reporting.
• Active leads — leads awaiting a response are automatically archived after 7 days. The underlying personal data is removed after 6 months as above.
• Business customer account data — retained for the duration of your subscription and deleted within 30 days of account closure.
• Opt-out records — retained indefinitely to honour your opt-out preference. Deleted on request.
• Call logs — retained for up to 90 days and then deleted automatically.
• Voice recordings and transcriptions — deleted automatically after 90 days. The audio file is deleted from Twilio's servers and the transcription is removed from your lead record at the same time.

If you are an end user and wish to request deletion of your data before the automatic deletion period, contact us at hello@topjobapp.com.

9. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data.
• Right to erasure — you can ask us to delete your personal data, subject to legal obligations.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can ask for your data in a machine-readable format.
• Right to object — you can object to processing based on legitimate interests.

To exercise any of these rights, email us at hello@topjobapp.com. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to complain to the ICO at ico.org.uk or by calling 0303 123 1113.

10. Data security

We take reasonable technical and organisational measures to protect your data, including:

• All data transmitted over HTTPS/TLS encryption
• Database access restricted by row-level security policies
• Authentication via one-time codes — no passwords stored
• API keys and secrets stored as encrypted environment variables, never in code
• Error monitoring via Sentry to detect and respond to technical issues

In the event of a data breach that poses a risk to individuals, we will notify the ICO within 72 hours as required by law, and will aim to notify affected individuals as quickly as reasonably possible.

11. Cookies

TopJob uses session cookies strictly necessary to keep you logged in. We do not use tracking cookies, advertising cookies, or any third-party analytics cookies. No cookie consent banner is required as we only use essential cookies.

12. International transfers

Some of our third-party processors operate outside the UK and European Economic Area. Where this occurs, we rely on Standard Contractual Clauses (SCCs) to ensure appropriate safeguards are in place. The following processors handle data in the United States under SCCs: Twilio (SMS, voice, and voicemail processing), OpenAI (AI analysis and transcription), and Vercel (application hosting and serverless functions). All other processors listed in section 7 store and process data within the UK or European Union.

13. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated. We will notify business customers of significant changes by email.

14. Contact

Horner Systems (trading as TopJob)
West Yorkshire, United Kingdom
hello@topjobapp.com

A full business address is available on request.