Privacy Policy

1. Who we are

RocketCampaign ("RocketCampaign", "we", "us") operates a client-work hub at https://rocketcampaign.net where individuals and teams organize projects, notes, tasks, documents (records), client contacts and correspondence in private workspaces, with optional AI assistance and optional email integrations.

For the purposes of applicable data-protection law, the account holder (the individual or organization that created a workspace) may act as a data controller for the content their team stores; we act as a processor/service provider for that content and as a controller for the account and usage data described below.

2. What the service does

RocketCampaign gives every user private workspaces containing:

• Projects with chronological timelines;
• Notes (meeting notes, call summaries, knowledge);
• Tasks with assignees and due dates;
• Records — a private document vault (contracts, invoices, receipts);
• Clients — a contact directory;
• Mail Hub — optional connection of your own Gmail and/or Outlook/Office mailbox to read, send and file correspondence onto project timelines;
• AI assistant — optional, powered by your own API key (see §7);
• Search, activity feeds and exports of your own workspace data.

3. Data we collect

We do not collect payment details, advertising identifiers, precise location, contacts from your devices, or browsing history from other websites.

4. What we access and why

4.1 Your workspace content

Content you and your teammates create is stored to display it back to authorized members of that workspace. Workspace data is isolated: one workspace's members cannot see another workspace's content. Platform staff do not browse your content except to resolve a support ticket you open or to respond to a verified security incident.

4.2 Your identity provider

If you sign up with Google or Microsoft, we receive your name, email address and profile identifier from that provider, solely to create/authenticate your account. We never post, send, or access anything else through your identity login.

5. Your documents & uploads (Records)

• Uploads are stored with randomized names outside public web-accessible paths; downloads are streamed through permission-checked code only to workspace members.
• Files are never publicly reachable by URL guessing or search engines.
• You can delete any record; deleting removes the stored file.
• Optional AI extraction (§7) sends text content you choose to process to the AI provider you configured — nothing is sent anywhere without that configuration.

6. Email connections (Gmail & Outlook / Office)

The Mail Hub is entirely optional. The whole product — projects, notes, tasks, records, clients, search, AI chat — works without connecting any mailbox.

6.1 What we request

• Gmail: access to read, send, archive and label messages in the Gmail account you select, plus your basic profile (name, email).
• Outlook / Office: equivalent mail permissions (read, send) on the Microsoft account you select, granted through Microsoft's device-code flow.

6.2 What we do with it

• Display your inbox/threads inside the Mail Hub for you to read and search.
• Let you compose and send email as yourself.
• Let you file a message onto a project timeline — storing that message's subject, sender, snippet and ID in your workspace.
• Optionally (if you enable AI, §7) suggest a project for an email — classification only.

6.3 What we never do with your mailbox

• We do not use your email content for advertising or profiling.
• We do not sell, rent or share it with third parties.
• We do not let AI providers train on it.
• We do not access mailboxes of accounts other than the ones you explicitly connect.
• We do not send email on your behalf without your explicit compose action.

6.4 Revocation

Disconnect a mailbox any time from Settings → Mailbox connections, or revoke access from your provider at Google — Third-party access or Microsoft — Privacy. Revocation deletes the stored tokens from our systems within 24 hours.

7. AI features & your API keys

RocketCampaign does not run its own AI models and does not include AI costs in the product. AI is bring-your-own-key:

• You choose a provider (OpenAI, Z.AI, Anthropic), a model, and supply your API key.
• Your key is stored encrypted (AES-256-GCM) and is never displayed again after saving.
• When you use an AI feature, we send the minimum needed context to your chosen provider: your prompt plus a snapshot of the relevant workspace items (e.g. project/task/note titles and short excerpts) so the assistant can answer about your work.
• AI provider usage, logging and retention are governed by your agreement with that provider. We do not control and are not responsible for their processing.
• If no key is configured, no AI calls are ever made — the product remains fully usable.
• You can disconnect AI at any time; the stored key is deleted.

8. What we never do

• No selling or renting of personal data — ever.
• No advertising or ad tracking anywhere in the product.
• No training AI models on your content.
• No reading your mailbox beyond the features above.
• No sharing workspace content between unrelated workspaces.

9. Data sharing

We share data only with:

• Infrastructure providers that host the application and its database (storage/processing on our behalf, bound by contract);
• Your identity & mail providers (Google, Microsoft) — for the authentication and mailbox features you initiate;
• Your chosen AI provider — only when you use an AI feature (§7);
• Law enforcement / regulators — only where legally compelled, and only after scrutiny; we publish transparency details on request.

10. Data retention & deletion

• Account deletion: request via Support — we delete your account, workspaces you own, and all associated content within 30 days (unless law requires longer). Members of shared workspaces are removed from them.
• Individual items: deleting a note, task, record or filing removes it from the workspace.
• Mail connections: tokens deleted within 24 hours of disconnection/revocation.
• AI chats: clear anytime with one click; automatic workspace-purge on deletion.
• Backups: encrypted backups roll off within 35 days.

11. Security measures

• All traffic over HTTPS/TLS; cookies are Secure, HttpOnly, SameSite.
• Passwords hashed with bcrypt; OAuth state validated with constant-time comparison; CSRF tokens on every state-changing form.
• OAuth tokens and AI keys encrypted at rest (AES-256-GCM).
• Session invalidation on login; least-privilege role model (owner / admin / member / viewer).
• Uploads stored outside public paths with randomized names and MIME allow-lists.
• Security-audit log of authentication and token events.

No system is perfectly secure; we design to make unauthorized access pointless and detectable, and we will notify affected users of any confirmed breach without undue delay.

12. Your rights & choices

Subject to your local law (including GDPR where applicable), you may:

• Access — export your workspace data (per-project export; full export on request);
• Correct — edit any content in place;
• Delete — remove items or your whole account;
• Restrict / object — disconnect mailboxes or AI, at any time, without losing the rest of the product;
• Complain — to your local data-protection authority; and to us first, so we can fix it.

13. Children

RocketCampaign is a professional tool and is not directed at children under 16. We do not knowingly create accounts for children. If you believe a minor registered, contact Support and we will remove it.

14. Changes to this policy

Material changes will be announced in-app (banner) at least 7 days before taking effect, and the "Effective" date above will change. Continued use after that constitutes acceptance.

15. Contact

Privacy questions, data-export or deletion requests: Support. We respond within 30 days.