Privacy Policy

This Privacy Policy explains how Dream Rocket Design (“we”, “us”) collects, uses and protects personal information when you visit our website or use RocketStore Autopilot (the “Service”). We collect only what we need to run the Service, we don’t sell personal information, and we don’t use it for cross-site advertising.

1. Information we collect

Information you give us

Account details: your name, username, email address and password (stored only as a one-way hash).
Business details: business name, website, industry, brand notes, billing email and billing address.
Content you upload: product photos, price and stock sheets, and notes. Photos and sheets can contain personal information if you include it, so please don’t.
Connection keys: access keys for your store and Meta accounts, which we store encrypted.
Messages: what you send through our contact form or by email.
Store audit requests: your name, email, store address and platform, and anything else you choose to tell us on the Free Store Audit form (phone, business name, catalog size, what takes your time). We never ask for store passwords or payment details there.
Marketing choices: whether you agreed to marketing emails or text messages, the exact wording you agreed to, when, and the IP address it came from, so we can prove and respect your choice.

Information from your connected accounts

Store data: product, price, inventory and category information from your Shopify, Wix or WooCommerce store. We don’t need or request your customers’ order or contact details to provide the Service.
Meta data: ad account, campaign and performance figures, and Meta Pixel event counts. These are aggregated figures, not information about individual people.

Information collected automatically

Technical data: IP address, browser type and pages requested, kept in server logs for security and troubleshooting. Contact form submissions store a one-way hash of your IP address to limit spam.
How you found us: when you send a form, we record the campaign tags in the link you followed (such as utm_source or utm_campaign), any ad click ID added by Google, Meta or TikTok, the site that referred you, and the page you arrived on. We use this to understand which advertising works. We don’t currently send it back to those ad platforms.
Cookies: see our Cookie Policy. We do not use analytics or advertising cookies.

Payment information

Payments are handled by Stripe. Your card details go directly to Stripe and are never stored on our servers. Stripe shares with us your billing name, email, address, the last four digits and expiry date of your card, and your payment history.

2. How we use it

To provide the Service: create and update your listings, check your website, monitor tracking and run ads you approve.
To bill you and keep records we are required to keep.
To answer your store audit request or message, and, only if you opted in, to send you marketing emails or text messages. You can opt out at any time.
To communicate with you, including security notices (such as when your email or password changes) and replies to your messages.
To keep the Service secure, prevent abuse and fix problems.
To improve the Service, using aggregated information that doesn’t identify you.

If you are in the European Economic Area or United Kingdom, our legal bases are: performing our contract with you, our legitimate interests in running and securing the Service, complying with legal obligations, and your consent (for optional cookies).

We share personal information only with service providers that help us run the Service, under contracts that limit their use of it, and with the platforms you ask us to connect:

Provider	What for
Stripe	Subscription payments and invoices
Anthropic (AI provider)	Reading photos and price sheets and drafting listings and ad text. Data sent through its commercial API is not used to train its models.
Meta Platforms	Running ads and checking tracking on your own ad account
Shopify, Wix or WooCommerce	Updating the store you connect
Our hosting and email providers	Storing data and sending account and security emails

We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a merger or sale of our business, in which case this policy will continue to apply. We do not sell personal information or share it for cross-context behavioural advertising.

4. How long we keep it

Account and portal data: while your account is active, then deleted or anonymised within 90 days after it closes, unless you ask for earlier deletion.
Uploaded photos and sheets: while your account is active, so you can see your change history.
Billing records: as long as tax and accounting laws require (usually seven years).
Contact form messages: up to two years.
Store audit requests and sales records: up to three years after our last contact with you, unless you ask us to delete them sooner. A record of your marketing consent choices is kept while we hold your details, so we can show we respected them.
Server logs: up to 90 days.

5. Security

We use HTTPS everywhere, encrypt connection keys at rest, store passwords as one-way hashes, and limit access to the people who need it. No system is perfectly secure; if a breach affects your personal information, we will tell you as the law requires. More detail is on our Security page.

6. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict some uses, and to withdraw consent. Residents of California and other US states with privacy laws have the right to know, delete and correct personal information, and to opt out of sale or sharing (we do neither). We will not treat you differently for using these rights.

How to make a request: use our privacy request form, or, if you’re a client, Settings → Your data in the portal. You can also email autopilot@rsap.dreamrocketdesign.com. We confirm receipt straight away and verify requests by sending a link to your email address; we never ask for ID documents. Copies of your data are sent as soon as you confirm. Account deletions run automatically after a 7-day period in which you can cancel. Every request is answered within 30 days, and we keep a record of each request for 24 months. You can use an authorised agent, and you may appeal a decision by replying to our response. EEA and UK residents may also complain to their local data protection authority.

We treat the Global Privacy Control browser signal as a request to opt out of optional cookies.

7. Your customers’ information

If our Service handles information about your own customers through your store, you are responsible for giving them notice and getting any consent required, and we process that information only on your instructions to provide the Service.

8. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

9. Where data is processed

We are based in the United States, and our service providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses.

10. Changes to this policy

We will post any changes here and update the effective date. If a change is material, we will tell clients by email or in the portal before it takes effect.

11. Contact

Dream Rocket Design
730 Peachtree Street NE
#570
Privacy questions: autopilot@rsap.dreamrocketdesign.com