Terms of Service
Last updated 8 October 2026.
These terms govern the use of TopHolders. Part A is the contract for the service. Part B is the data processing agreement for the personal data you enter into it.
Part A. Terms of Service
1. Who we are, and who may use the service
The service is provided by:
("we", "us"). The customer is the company or person that creates a workspace ("you").
We offer the service only to businesses within the meaning of § 14 BGB: companies, and persons acting in their trade, business or profession. Consumers may not use it. By creating a workspace you confirm that you act for a business.
These terms apply to every workspace. Terms of your own do not apply, even if we do not object to them.
2. The service
TopHolders shows a token project who holds its token, how those holdings move, and how to act on it. What each plan includes is shown on our pricing page when you choose it. A workspace tracks one token of its own.
We may change, add or remove features, as long as the service keeps its purpose. We tell you by email before a change that removes something your plan includes.
3. Where the data comes from, and what it is not
- The service reads public blockchains and data from third-party providers. That data can be late, incomplete or wrong, and labels for wallets are a best guess, not a fact. The service shows where a reading comes from and how fresh it is, and says when something is unknown.
- Nothing in the service is investment, legal or tax advice. You decide what to do with what it shows.
4. Accounts and your team
- Keep your sign-in details secret. Tell us at once if you think someone else has them.
- You are responsible for the people you invite into your workspace and for what they do in it.
- Give us correct information when you sign up, and keep your email address current.
5. Prices, payment and renewal
- Prices are the amounts in USDC shown on the pricing page and at checkout. You pay with a USDC transfer on the Base network to the address the checkout shows. Network fees (gas) are yours and are shown by your wallet. Taxes and duties on your side are yours.
- A payment counts once we have verified the transfer on the blockchain. A transfer sent without going through checkout is matched to a workspace by hand.
- A paid month is one calendar month in UTC from its start. There is no automatic renewal: each month is paid by a new transfer that you sign yourself, so there is nothing to cancel.
- The Starter and Growth plans start with a free 7-day trial. Scale has none. When a trial ends unpaid, the workspace becomes read-only at once.
- When a paid month ends unpaid, the workspace keeps working for 72 hours. After that it becomes read-only: you can still read the data already stored, sign in and pay, but nothing new is fetched and no alerts are sent. Paying again restores it with your settings.
- An upgrade takes effect when it is paid, and starts a new month then; the rest of the old month is not credited. A downgrade takes effect when you next pay, at the lower price.
- A month you have started is not refunded, unless the law or section 10 says otherwise. We may refund at our discretion. A refund goes, in USDC on Base, to the address the payment came from.
6. What you may and may not do
- Use the service only lawfully. The data you enter about token holders, and how you contact them, is your responsibility: you are the controller of that data (Part B).
- Do not try to reach another workspace's data, test or bypass our security, overload the service, or copy it automatically at scale.
- Do not use the service to harass anyone, or to deal with persons or wallets that sanctions law forbids you to deal with.
If you break these rules seriously, we may suspend the workspace. We tell you why by email, and lift the suspension once the cause is gone.
7. Availability
We work to keep the service running, but we do not promise a fixed availability. It can be interrupted for maintenance, by faults, or when a blockchain or a data provider we rely on is unavailable. We announce planned maintenance in advance where we can.
8. Your data
- The data you enter stays yours. You allow us to store and process it only to provide the service to you.
- To remove a workspace, ask us by email to delete it. We delete it and its data within 30 days. Copies remain in our nightly backups until those are replaced, normally within 14 days. Payment records are kept, as our privacy policy explains.
- Before that, you can ask us by email for the data you entered, and we send it to you in a machine-readable format.
9. Liability
- We are liable without limit for damage caused intentionally or by gross negligence, for injury to life, body or health, under the Product Liability Act, and where we have given a guarantee.
- For slight negligence we are liable only if we breach an essential obligation: one whose fulfilment makes the contract possible at all and on which you may regularly rely. Our liability is then limited to the foreseeable damage typical for this kind of contract.
- Beyond that, our liability for slight negligence is excluded.
- These limits also protect the people who work for us. Liability under Art. 82 GDPR is not affected.
10. Term and ending the contract
- The contract runs as long as your workspace exists. You can end it at any time by email; we then delete the workspace as section 8 describes.
- We can end it with 30 days' notice by email. We then refund, in USDC, the unused part of a month you have already paid.
- Either side can end it at once for good cause, in particular a serious breach of these terms.
11. Changes to these terms
We tell you about a change to these terms by email at least 30 days before it applies. It applies from the first month you pay after that date. If you do not agree, you do not renew, and the version you agreed to stays in force until your paid month ends.
12. Final provisions
- German law applies. The UN Convention on Contracts for the International Sale of Goods (CISG) does not.
- The courts of Munich, Germany, have jurisdiction where the law allows us to agree on it: in particular when you are a merchant or a legal entity under public law, or when you have no general place of jurisdiction in Germany. Where the law gives a jurisdiction that cannot be changed by agreement, that one applies.
- Notices under these terms may be given by email.
13. If a clause is invalid
If a clause of these terms is invalid, the rest of them remain in force.
Part B. Data processing agreement (Art. 28 GDPR)
B1. Scope and roles
This part applies to the personal data you enter about other people: the names, email addresses and notes you record about token holders and other contacts, and the history of your changes to those records ("Customer Data"). For Customer Data you are the controller and we are your processor.
Wallet data we read from public blockchains and data providers is not Customer Data. We process it as controller, as our privacy policy explains.
B2. What is processed
- Subject matter: storing and showing Customer Data in the service.
- Duration: as long as your workspace exists, and then until deletion under B9.
- Nature: storing, showing, changing and deleting, as you use the service.
- Purpose: providing the service to you.
- Types of data: names, email addresses, free-text notes, and the change history of each record.
- Data subjects: token holders and other contacts you record.
B3. Instructions
We process Customer Data only on your documented instructions, including on transfers to a third country, unless EU or German law requires otherwise; we then tell you before processing, unless that law forbids it. These terms and the settings you choose in the service are your instructions; further instructions may be given by email. If we think an instruction infringes data protection law, we tell you at once.
B4. Confidentiality
Only the operator named in section 1 has access to Customer Data. Anyone we give access in future will be bound to confidentiality first.
B5. Security
We take the technical and organisational measures Art. 32 GDPR requires. They are listed in Annex 1.
B6. Sub-processors
You authorise us in general to use sub-processors. The current ones are listed in Annex 2. We tell you by email at least 30 days before we add or replace one. You may object in that time; if we go ahead anyway, you may end the contract at once. We bind each sub-processor to the same data protection obligations as this part, and remain liable to you for it.
B7. Rights of data subjects
We help you, as far as we can, to answer requests from data subjects exercising their rights under Chapter III GDPR. A request sent to us about Customer Data is passed to you without delay.
B8. Security incidents and other assistance
We tell you without undue delay after we become aware of a breach of the security of Customer Data, with the information Art. 33(3) GDPR asks for as far as we have it. We help you with your obligations under Art. 32 to 36 GDPR, as far as the nature of the processing and the information available to us allow.
B9. When the contract ends
When the contract ends we delete the Customer Data, unless the law requires us to keep it, within 30 days. You can ask us by email to delete it earlier. Copies in our nightly backups are replaced normally within 14 days. Before deletion you can ask for the data to be returned to you under section 8.
B10. Information and audits
We give you the information you need to show that this part is complied with. We allow and contribute to audits by you or an auditor you appoint who is bound to confidentiality, announced at least 30 days ahead, at most once a year unless there has been an incident, and at your cost.
B11. Liability
Section 9 applies to this part too. Art. 82 GDPR is not affected.
Annex 1. Technical and organisational measures
- Every connection from the internet to the service is encrypted with TLS; the certificates are issued and renewed automatically.
- The database cannot be reached from the internet: only the service's own containers on the server can connect to it.
- Every database query for workspace data is limited to that workspace, and automated tests check that one workspace cannot read another's data.
- Passwords are stored only as one-way hashes. Sign-in sessions are stored only as hashes of a random token, held in a cookie that page scripts cannot read. Sign-in and similar endpoints are rate-limited.
- The bot tokens and webhook addresses you enter for alerts are stored encrypted.
- The server is administered over SSH with a key, by the operator only.
- The database is backed up every night. Each backup is checked by reading it back before it is kept; the newest 7 stay on the server, and copies are pulled to a separate computer, where the newest 14 are kept. The backup files are not encrypted; both places are reachable only by the operator.
- Error reports are stripped of request bodies, cookies, headers, IP addresses and wallet addresses before they leave the server.
Annex 2. Sub-processors
- netcup GmbH (Germany)It hosts the server and the database this service runs on.Receives: all Customer Data, because it is stored on that server.Safeguard: a data processing agreement with us, signed on 29 September 2026.
- Functional Software, Inc. d/b/a Sentry (USA)It records server errors so we can fix them.Receives: technical error reports; request bodies, cookies, headers, IP addresses and wallet addresses are removed before a report is sent.Safeguard: its data processing agreement with us, including the EU Standard Contractual Clauses; certified under the EU-U.S. Data Privacy Framework; data stored in its EU region.