Privacy — Top-Rated Team

Who we are

Top-Rated Team is the LinkedIn API product on top-rated.team. Contact contact@top-rated.team.

What we collect

Email, name, and password hash when you sign up.

API keys you mint, and the requests those keys make.

LinkedIn session material you choose to connect (a session cookie, or a native LinkedIn sign-in), plus account identifiers and usage needed to serve the API.

Subscription status for the Top-Rated Team API (trial, active, expired).

In project rooms: what is written in a room, and the AI keys, MCP server credentials and top-voice.ai sign-in you add there, those three stored encrypted. An agent sends a room's recent messages to the AI provider whose key it runs on, and calls only the MCP servers it was given.

For Google Ads: the account IDs a white-label partner links to our manager account, and which of its customers' AI agents may read each. An agent reads an account's data from Google while it answers in a room; what it writes there is kept like any message. A change the Ad Grants agent proposes is kept until a member applies or skips it.

How we use it

To run the API you subscribed to, authenticate its calls, bill its subscriptions, and keep accounts healthy. We do not sell personal data. We do not use connected LinkedIn accounts for our own outreach.

Processors

Hosting, email delivery, and payment processors act on our behalf. LinkedIn requests you make through the Top-Rated Team API are sent to LinkedIn using the session you connected. We do not disclose our infrastructure vendors as part of the public API contract.

Google Calendar

What we access. Only when a member links their own Google Calendar to a booking page, and only through the scopes Google's own consent screen shows them: calendar.freebusy, to see when they are busy; calendar.events.owned, which Google describes as viewing and editing events on calendars they own, and which we use only to write, move and cancel the calls booked through that page; and openid with email, to show which Google account is linked. We ask for nothing else: no Gmail, no Drive, no contacts, and no profile data beyond that address.

A visitor's own calendar. Somebody booking a call may choose to connect theirs, so that the page stops offering times they are already busy in. That asks Google for less again: calendar.freebusy, with openid and email to fill the booking form in for them. Their permission is granted for one visit only, so Google issues nothing that would let us come back later. We read their busy periods once, for the days the page offers, and store none of it: the result travels back in their own browser, encrypted, and stops working after thirty minutes. No token, no email address and no calendar entry of theirs reaches our database, and the member whose page it is sees only the time that was booked.

How we use it. To show a visitor the member's free times, to write the booked call into the member's calendar, and to move or cancel it when the visitor does — Google sends the invitation and the Meet link from the member's own calendar. Nothing else. We do not use Google user data for advertising or profiling, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

Who it is shared with. Nobody, for their own purposes: we do not sell Google user data and we do not pass it to data brokers or advertisers. It reaches Google itself, and the hosting provider that runs this service on our behalf. It reaches an AI assistant only where the member connected one and asked it about their booking page, because that assistant reads the page through the member's own API key. A visitor who books sees the time they chose and the invitation Google sends them, and nothing more of the member's calendar.

How it is stored and protected. The refresh token Google issues is encrypted at rest with AES-256-GCM under a key held outside the database, and is never returned by any page, API response or log. Beside it we keep only the linked account's address and the calendar's id, so the member can see which calendar is connected. Everything travels over TLS, and only that member's own organization can reach it.

How long we keep it, and how to delete it. The token lives until the member unlinks, and unlinking is one click: in the dashboard under your booking page, or DELETE /booking/v1/pages/{slug}/calendar. It revokes our grant at Google and deletes the stored token, the linked address and the calendar id there and then. Revoking the grant yourself at myaccount.google.com/permissions cuts our access off immediately as well; unlink here too, to have the stored token removed. Calls already booked keep their time and the visitor's name and address, so that the member and the visitor can still find them. To have a booking page and its calls deleted, or the whole account closed, write to contact@top-rated.team and we erase what we no longer need for billing or security.

LinkedIn's rules

What you do through Top-Rated Team, your LinkedIn account does, under LinkedIn's User Agreement and its limits. Keeping within them — how much you invite, look up, search and message, and whose data you collect and why — is solely your responsibility. Top-Rated Team does not enforce LinkedIn's limits for you; the ones we recommend are in the Terms.

Retention and your rights

Delete connected LinkedIn accounts and revoke keys from the dashboard at any time. Email us to close the Top-Rated Team account and erase signup data we no longer need for billing or security.