1. Who this policy covers
This policy describes how RAIA Platforms, Inc. ("we", "us") collects, uses, shares and protects personal data when you visit this website at https://rocketkind.ai, use RocketKind, the hosted platform at https://app.rocketkind.ai (the "Service"), or contact us.
There are two kinds of account, and who is responsible for your data depends on which you use.
Organization accounts. The organization that holds the account (the "Customer") decides what data its people and systems put into the Service, and we process that data on its behalf and on its instructions. For its users' data and the content in its workspaces, the organization is the controller (or the "business" under California law) and we are the processor (or "service provider"). For the account, billing, support and website data described below, we are the controller. If you use the Service through your employer or another organization, that organization's privacy notice also applies, and requests about your data in its workspace should go to it first.
Individual accounts. If you sign up as an individual, for your own personal purposes, you get a personal workspace that belongs to no organization, and we are the controller of the data we collect to run your account: your sign-up details (name and email address), sign-in and security data, usage and audit records, billing records, the payment data Stripe handles for us, what you send us when you contact us, and the website data described below. The content you put into your workspace (your workflows, agents, data objects, files and conversations) is yours: we store and process it only to provide the Service as you direct it, and never for our own purposes such as training models or marketing. If you put other people's personal data into it, you are responsible for having the right to do so. The Data Processing Agreement mentioned below is for business customers and does not apply to an individual account.
2. What we collect
Account and identity data
Your name, your email address (a work address for an organization account), the organization you belong to, if any, your role and permissions, and either a password (stored only as a salted hash), a one-time code we email you, or the identifiers your organization's single sign-on or identity provider sends us when you sign in.
Customer Content
What you or your organization put into the Service: workflows, agent definitions, conversations with agents, prompts, files, data from connected systems, and the outputs the Service generates. Customer Content may contain personal data about you, your colleagues, an organization's own customers or other people; the organization, or you for a personal workspace, decides what goes in.
Billing data
The billing contact (for an individual account, you), billing address, tax identifiers where required, credit balance, purchases, invoices and plan. Card payments are handled by Stripe; we never store your full card number. We hold only the reference Stripe gives us to your customer record and saved payment method.
Usage, audit and technical data
Records of administrative and governed actions in the Service (who did what, and when; sign-in events also carry a masked network address) kept in your organization's or your workspace's audit log; run, approval and spend records; application logs; and performance and error measurements from the Service's own, self-hosted monitoring. The Service uses no third-party advertising or analytics trackers.
Communications
What you send us when you write to [email protected], ask for early access or contact support at [email protected]. The early-access form on this website is provided by the Service: what you enter in it reaches us and is stored in the Service as a request for early access.
This website
This website sets one cookie of its own, which remembers your choice about analytics cookies, and uses no advertising scripts. Google Analytics runs only if you accept analytics cookies in the banner, and you can change your mind at any time under Cookie settings in the footer. If you reject them, or your browser sends a Global Privacy Control signal, Google Analytics does not load. When it runs, it sets cookies holding a random identifier for your browser, and reports the pages you view, the page that referred you, your browser, operating system and device type, your approximate location and how you use each page, such as scrolling and following links. Your IP address reaches Google with the request; Google states that Google Analytics does not log or store it. We have turned off Google signals and advertising personalization, and we do not use Google Analytics to identify you by name or to advertise to you. Cloudflare, which serves the site, processes request logs (IP address, browser, pages requested) to deliver and protect the site, and may set a strictly necessary security cookie when it screens automated traffic, under its own privacy policy. As you scroll near it, whether or not you fill it in, the early-access form loads from the Service. The Service receives your IP address and browser details, runs its own self-hosted performance and error monitoring, and keeps the form's session in your browser's session storage for that tab.
3. Why we use it, and our legal bases
We use personal data for these purposes, each resting on a legal basis under the GDPR and UK GDPR where they apply:
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the Service: accounts, sign-in, running your workflows and agents, support | Account, Customer Content, communications | Performance of a contract (with you or your organization); for an organization's Customer Content, its instructions |
| Billing: metering use, charging top-ups and plans, invoices, tax | Account, billing, usage | Performance of a contract; legal obligation (tax and accounting) |
| Security and audit: detecting abuse, investigating incidents, keeping the audit log you or your organization rely on | Account, usage, audit, technical | Legitimate interests (securing the Service and our customers); performance of a contract |
| Improving the Service: measuring performance and feature use in aggregate | Usage, technical | Legitimate interests (operating and improving the Service) |
| Measuring how this website is used, with analytics cookies if you accept them | Technical | Consent, which you can withdraw at any time under Cookie settings in the website's footer |
| Service messages: invitations, approvals and task assignments, billing and security notices | Account, billing | Performance of a contract; legitimate interests |
| Early-access and product communications you ask for | Communications | Consent, which you can withdraw at any time; legitimate interests for business contacts |
| Legal compliance and enforcing our terms | Any of the above, as needed | Legal obligation; legitimate interests |
For an individual account, the content of your workspace is processed on one basis only: performance of our contract with you, to provide the Service as you direct it. We do not use it for any purpose of our own.
We do not sell personal data, and we do not use it for advertising or profiling with legal effects.
4. AI models and your content
We do not use Customer Content to train AI models. The models the Service provides run on Amazon Bedrock on our account, in the United States; under AWS's published data policy for Amazon Bedrock, the inputs and outputs of those models are not used to train its models.
You or your organization may connect your own model providers, with your own keys, and third-party applications through the Service's connectors. When you do, the Service sends the data your configuration directs to that provider, and the provider's handling of it is governed by its own terms and privacy policy. You or your organization decide which providers and applications to connect and which data reaches them.
Memory an agent keeps about a conversation, and business definitions you or your organization add, are Customer Content and stay in your workspace.
6. How long we keep it
- Customer Content, runs and conversations: for the retention periods your organization configures in the Service (for a personal workspace, the periods the Service applies unless it offers you a choice), and otherwise for as long as the account is open. We delete it within 30 days of a verified deletion request, and within 30 days after the account closes. Database backups are kept for 14 days for point-in-time recovery, so deleted data may persist in a backup for up to 14 days after deletion.
- Audit records: for about 13 months (400 days), so you or your organization can account for what was done in the workspace, then deleted.
- Account data: for as long as the account is open. After closure, Customer Content is deleted within 30 days and its backup copies expire within a further 14 days; billing and transaction records are kept as long as tax and accounting law requires.
- Billing records: for as long as tax and accounting law requires, typically seven years.
- Operational logs and metrics: for 15 days, unless a copy is needed for a security investigation.
- Website analytics: analytics cookies last up to 13 months from your latest visit, unless you withdraw your consent, which deletes them from your browser. Google Analytics keeps user-level and event-level data for 14 months; reports of totals are kept longer. Your cookie choice is remembered for 6 months, after which we ask again.
- Communications: for as long as needed to answer you and keep a record of the relationship.
7. Security
The Service runs on Amazon Web Services in the United States. Data is encrypted in transit with TLS. Customer data is encrypted at rest with AES-256: databases and other persistent volumes on encrypted Amazon EBS storage, files and database backups in Amazon S3 with server-side encryption, and platform secrets in AWS KMS-backed encryption. Credentials you store in the Service (connection secrets, API keys) and other sensitive fields are additionally encrypted at the application layer with AES-256-GCM before they are written, under platform keys or keys the Customer holds in its own key management service, with audited rotation. Access to production is limited to the people who need it, and administrative and governed actions in the Service are recorded in the Customer's audit log. Sign-in uses a password or the Customer's identity provider, which can require multi-factor authentication. Our SOC 2 audit is in progress. No system is perfectly secure; if we learn of a breach affecting your personal data, we notify you, or the affected organization, without undue delay and as the law requires.
8. International transfers
We are in the United States and store and process personal data there. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to the United States, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where it applies, incorporated in our Data Processing Agreement with the organization. You can ask us for a copy at [email protected]. If you use the Service as an individual, you give your data to us directly, so no such transfer by an exporter takes place; the GDPR and UK GDPR still apply to how we handle it, and your rights under Your rights are unchanged. If you accept analytics cookies on this website, Google processes the resulting data in the United States and elsewhere under its data processing terms with us. Google LLC takes part in the EU-U.S. Data Privacy Framework, with its UK Extension and the Swiss-U.S. framework, and those terms provide Standard Contractual Clauses where no such framework applies.
9. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to correct or delete it, to receive a copy in a portable form, to restrict or object to its processing, to withdraw consent where processing rests on consent, and to complain to a supervisory authority.
European Economic Area, United Kingdom and Switzerland
You have the rights the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection give you, including the right to lodge a complaint with your local supervisory authority. Where we process your data as a processor on an organization's behalf, we will refer your request to that organization and help it respond; for an individual account we answer it ourselves.
California
Under the California Consumer Privacy Act you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes other than those the law permits. On this website we treat a Global Privacy Control signal as rejecting analytics cookies. You may use an authorized agent to make a request; we will ask for proof of the authorization.
How to exercise them
Write to [email protected]. We verify requests by confirming that you control the email address on the account, and answer within the time the applicable law allows (one month under the GDPR, 45 days under the CCPA, extendable where the law permits). For an organization account, its administrators can also change or remove your account in the Service. For an individual account, you can ask us at the same address for a copy of the content in your workspace in a portable form, to delete it, or to close the account.
11. Children
The Service and this website are not directed to anyone under 18. A person must be at least 18, or the age of majority where they live if that is higher, to open an account, whether for an organization or as an individual. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it and close the account. If you believe a child has given us personal data, write to [email protected].
12. Changes to this policy
We update this policy as the Service and the law change, and post the new version here with a new "Last updated" date. For a material change we notify organizations' administrators, and individual account holders at their account's email address, by email or in the Service at least 14 days before it takes effect.
13. Contact
RAIA Platforms, Inc., 1111B S Governors Ave, Suite 88189, Dover, DE 19904, US. Privacy requests: [email protected]. Support: [email protected]. General enquiries: [email protected].