Privacy Policy

Last updated: October 9, 2026  ·  Effective: October 9, 2026

Contents

1. Who we are
2. Information we collect
3. Cookies, browser storage & tracking
4. How we use information
5. How we share information
6. Where information is stored
7. How we protect information
8. How long we keep information
9. Your choices and rights
10. Children
11. Other websites
12. Changes to this policy
13. Contact us

1. Who we are and what this policy covers

Top Tier Plan ("Top Tier Plan," "we," "us") provides an online platform that automotive dealerships and other businesses (our "Customers") use for employee training, daily tasks, process documentation, internal messaging, and pre-hire assessments. This policy explains how we handle personal information on our website, toptierplan.com, on each Customer's site hosted at toptierplan.com, and in our phone app.

This policy covers:

• Website visitors to toptierplan.com.
• Platform users — employees, managers, and administrators of our Customers who have accounts.
• Job applicants whom a Customer invites to complete a pre-hire assessment.

Our role. When a Customer uses the platform for its own employees and applicants, that Customer decides what information goes into its site and how it is used, and we process that information on the Customer's behalf as its service provider. If you are an employee or applicant of a Customer, your employer (or prospective employer) is responsible for its own use of your information, and you may also contact it directly with questions or requests. We will help our Customers respond.

2. Information we collect

2.1 Account and profile information

Name, username, password (stored only in scrambled, one-way encrypted form — we cannot see it), work email address, mobile phone number, phone extension, employee number, and role and job positions. This is entered by you when you register or by your employer when it creates your account.

2.2 Information created while using the platform

• Training: assigned modules, answers, scores, number of attempts, and time taken.
• Tasks: tasks assigned to or created by you, and a time-stamped log of when tasks are created and completed.
• Messages: text messages you send to coworkers through the platform.
• Uploads and records your employer adds: documents, process photos, warranty paperwork (which may include repair order numbers and vehicle identification numbers), and work lists such as open repair orders, loaners, and extended warranty schedules (which may include the names of the business's own customers, repair order and stock numbers, dollar amounts, and comments).
• Business tools: schedules, vendor and staff directories, and business figures that managers enter into calculators and reports.

2.3 Job applicants

If a Customer invites you to take a pre-hire assessment, we collect your name, email address, the position you applied for, and your assessment answers and results, and make them available to that Customer. You do not need an account to take an assessment.

2.4 Phone notifications

If you turn on message notifications in our phone app, your phone's browser (through Apple or Google) gives us a technical notification address and security keys so we can deliver alerts to that phone. You can turn notifications off at any time.

2.5 Technical information

Like most websites, our hosting provider's servers automatically record standard technical information when you visit, such as your IP address, browser type, the pages requested, and the date and time. We use it to keep the service secure and working.

2.6 Sensitive information

We do not intentionally collect sensitive personal information, such as Social Security or driver's license numbers, financial account or payment card numbers, health information, biometric data, or precise location. Please do not enter this kind of information into the platform — for example, in comments, messages, or uploads.

3. Cookies, browser storage, and tracking

• No advertising trackers or outside analytics. We do not use tools such as Google Analytics, Meta Pixel, or similar tracking, we do not use third-party advertising cookies, and we do not sell or share personal information for targeted advertising.
• Basic visit statistics on toptierplan.com. On our home page and our Privacy and Security pages, our own software counts page views and clicks on buttons and links (for example, "Book a demo"), without cookies. For each, it records the page, the button or link, the website that referred you, your device type (desktop, phone, or tablet), and an anonymous visitor code made by scrambling your IP address and browser details together with the date. The code changes every day, so it can't be used to identify you or follow you from one day to the next. We use these statistics only to understand how our website is used, and keep them for about 13 months. They are not collected on our Customers' sites or in the phone app.
• Browser storage that makes the site work. We use your browser's local storage to keep you signed in, remember settings (such as whether the Messages panel is open or the color theme you picked in the phone app), and keep a working copy of data so pages load quickly. This storage is strictly necessary for the service. Clearing it signs you out.
• Phone app files. Our phone app saves its own program files on your device so it opens quickly and works with a weak signal.
• Content delivery networks. Only when a manager uploads a spreadsheet or a PDF guide, the platform loads a reading library from a public content delivery network (jsDelivr for spreadsheets, cdnjs for PDFs), which receives that person's IP address as part of delivering the file. Ordinary use of the platform makes no requests to outside servers.

4. How we use information

• To provide and operate the platform for our Customers and their users, including accounts and sign-in.
• To send service emails, such as account set-up, password reset, username reminders, and training or task notices, and the phone notifications you turn on.
• To give a Customer's managers and administrators the reports, results, and activity information the platform is designed to provide.
• To keep the platform secure, prevent misuse, and troubleshoot problems.
• To improve the platform, using aggregated or de-identified information where possible.
• To comply with the law and enforce our agreements.

We do not send marketing emails to platform users, and we do not use automated decision-making that produces legal or similarly significant effects. Assessment scores are provided to the hiring business, which makes its own decisions.

5. How we share information

We do not sell personal information. We share it only as follows:

• With the Customer you work for or applied to. Its administrators and managers can see the information described in this policy for their own business, according to their role — for example, training results, task activity logs, and applicant results. Messages are company records and may be reviewed by the Customer's administrators.
• With service providers that help us run the platform, only for that purpose:
  • Hostinger — website and database hosting, and delivery of the emails the platform sends.
  • Apple and Google push notification services — to deliver phone notifications. Notifications contain only the sender's name and a short notice, never the message text.
  • jsDelivr — delivery of one software library, as described above.
  • Our business email and email security providers (Microsoft 365 through GoDaddy, with Proofpoint filtering), when you email us.
• For legal reasons — to comply with a law, court order, or other legal process; to protect the rights, property, or safety of Top Tier Plan, our Customers, users, or others; or to investigate misuse.
• In a business transfer — if Top Tier Plan is involved in a merger, acquisition, or sale of assets, subject to this policy's protections.
• With your consent or at your direction.

6. Where information is stored

The platform is hosted on servers in the United States, and it is intended for businesses located in the United States.

7. How we protect information

• All traffic is encrypted with HTTPS.
• Passwords are stored only as one-way encrypted hashes, must be at least 12 characters, and common passwords are blocked.
• Each Customer's data is kept in its own separate database.
• Access is role-based, and new self-registered accounts must be approved by the business.
• Temporary passwords must be changed at first sign-in, and changing or resetting a password signs out other devices.
• On the website, users are signed out automatically after 30 minutes of inactivity.
• Our system only accepts requests from our own websites.

No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we confirm a security incident affecting a Customer's data, we will notify that Customer within 72 hours and provide any other notices required by law.

8. How long we keep information

• Messages are deleted automatically after 3 months.
• Warranty uploads are deleted automatically after 60 days.
• Password reset links expire after 60 minutes.
• Account, training, task, and other platform data is kept while the Customer's subscription is active, or until the Customer or an authorized user deletes it.
• When a Customer's subscription ends, its data is kept for 30 days so the Customer can request an export, then deleted from our active systems, and from backups within 90 days.
• Server logs are kept according to our hosting provider's standard schedule.

9. Your choices and rights

You can ask to:

• Know and access the personal information we have about you;
• Correct information that is inaccurate;
• Delete your information; and
• Get a copy of your information in a portable format.

Depending on the state you live in (for example, California, Texas, Virginia, or Colorado), you may have these and other rights under state privacy laws, including the right to opt out of the sale of personal information, targeted advertising, or certain profiling — which we do not do — and the right to appeal our decision on a request. We will not discriminate against you for exercising your rights.

How to make a request. Email us at the address in section 13. We may need to verify your identity before acting on a request, and we will respond within 45 days (or sooner if the law requires). If we deny your request, you may appeal by replying to our response. If your request concerns information a Customer controls — for example, your records as an employee or applicant — we may refer you to that Customer or work with it to respond. Many profile details can also be updated by your manager or administrator.

10. Children

The platform is designed for businesses and their workforce. It is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will delete it.

11. Other websites

The platform may contain links to websites we don't operate, including links that Customers add to their own content. We are not responsible for the privacy practices of those sites.

12. Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page and change the "Last updated" date above. If we make material changes, we will also notify our Customers before the changes take effect.

13. Contact us