01
Who is responsible for what.
RocketMail is operated by MARTECHSOL LTD, registered in England and Wales under company number 16554162, at 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom. We are the data controller for the personal data described in section 02.
There are two kinds of personal data here and they are governed differently, so it is worth separating them at the start.
Data about our customers. The name, work email, and billing details of the people who sign up for and administer a RocketMail account. We decide how that is used, so for it we are the controller and this policy applies.
Data inside a customer's mailbox and CRM. The messages, contacts, and deals RocketMail reads on a customer's behalf, which contain personal data about the people they correspond with. The customer decides why that is processed. They are the controller and we are their processor, acting on their instructions under our Data Processing Agreement. If you are wondering why a company holds an email you sent them, that company is who to ask.
02
What we collect as controller.
Account data. Your name, work email address, the organisation you belong to, and your authentication identifiers from Google or Microsoft. We receive these when you sign in; we never see or store your mail password.
Billing data. Billing contact, address, and the payment method reference our payment provider gives us. We do not store full card numbers.
Usage data. Which features you use and when, errors, and performance measurements. This is about the application, not about the contents of your mail.
Support correspondence. What you write to us, and our replies.
We do not use tracking cookies for advertising, and we do not sell personal data to anyone, ever.
03
Why we are allowed to process it.
Performance of a contract. Account data and billing data, because without them we cannot give you the service you are paying for.
Legitimate interests. Usage data and support correspondence, so we can keep the product working, find and fix faults, and protect it from abuse. We have considered whether this overrides your interests and concluded it does not, because the data is about how the software is used rather than about you personally, and you can object at any time.
Legal obligation. Records we are required to keep, such as for tax.
Consent. Marketing email, if you ask for it. You can withdraw at any time and every message carries an unsubscribe link.
04
What RocketMail reads in your mailbox.
This section is here because it is the question everyone asks, and it is a fair one.
When you connect Gmail, RocketMail requests gmail.modify. That allows it to read messages and change labels. It deliberately does not include a scope to send. When you connect Microsoft, it requests Mail.ReadWrite.
With that access the product reads message headers, bodies, and recipients, and stores them so it can rank the inbox, summarise a thread, and answer a question about it. It reads mail you have sent in order to measure how you write, and stores those messages and numeric representations of them so a draft can imitate real examples rather than an adjective.
Message text is sent to a language model provider at the moment a summary, ranking, or draft is produced. Those providers are contracted not to retain it and not to train on it.
Nobody at MARTECHSOL LTD reads your mail. Our staff cannot query customer content in the course of normal work; access for support requires a specific reason, is granted for a limited period, and is logged.
05
Who else sees it.
We use a small number of service providers, and each one sees only what it needs. They are listed with their purpose, region, and data category in section 09 of our security page, which is the canonical list and is updated with 30 days' notice before anything is added.
We also disclose personal data where we are legally required to. If we receive a request from a public authority for a customer's data, we will tell that customer unless the law forbids it.
If the business is sold or merged, data may transfer to the buyer. You will be told before that happens, and the buyer will be bound by terms no weaker than these.
06
Where the data goes.
RocketMail is operated from the United Kingdom. Data is stored in the United States by default, in AWS us-east-1, and enterprise customers can pin storage to a single region.
Where personal data leaves the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy regulations where they apply. A copy of the transfer mechanism we use with any given provider is available on request.
07
How long we keep it.
Account data: for as long as you have an account, and for one year after it closes so we can answer questions about it.
Mailbox and CRM content: for as long as your organisation's retention setting says, which defaults to keeping it while the account is open. It is deleted within 30 days of the account closing.
Billing records: six years, because UK tax law requires it.
Usage data: 13 months.
Backups are on a rolling window and are overwritten. A deletion request is applied to live systems immediately and works through backups as they cycle.
08
Your rights.
Under UK data protection law you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict what we do with it, or send it to someone else in a portable format. You can object to processing we do on the basis of legitimate interests, and withdraw consent where consent is what we relied on.
Write to hello@rocketmail.ai and we will answer within one month. We will not charge you, and we will not make it difficult.
If the data you are asking about is inside a customer's mailbox or CRM, that customer is the controller. Tell us anyway and we will point you to them and help them respond.
If you think we have got it wrong you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but it is your right either way.
09
How it is protected.
OAuth tokens are encrypted with a key that is itself encrypted by a key management service, under a scheme that binds each token to the organisation, user, and purpose it belongs to, so a credential copied into another tenant will not decrypt.
Every tenant's rows are separated in the database by row level security, enforced by the database rather than by application code remembering to filter.
Traffic is encrypted in transit, data is encrypted at rest, and access to production is restricted and logged. The security page describes this in detail, including what we have not done yet.
10
Children.
RocketMail is a tool for businesses. It is not directed at children and we do not knowingly collect data about anyone under 18. If you believe we have, tell us and we will delete it.
11
Changes to this policy.
We update this policy when what we do changes. The date at the top is the date of the current version. If a change is material we will tell you by email or in the product before it takes effect rather than quietly reposting the page.
Questions go to hello@rocketmail.ai, or write to MARTECHSOL LTD, 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom.