Privacy Policy

Rocketly — How we collect, use, and protect your personal data.

1. Introduction

Rocketly ("we") is a B2B CRM SaaS platform. This policy explains how your data is processed through our website (gorocketly.com) and mobile app (Rocketly). This policy and the related data-protection documents describe our approach to processing personal data, your rights and how to make a request.

2. Data We Collect

CRM Data (You Provide)

Name, email, phone, company, address, notes, tasks/appointments, files, quotes, opportunities.

Account Data

Email, hashed password, organization, role, permissions.

Technical Data (Automatic)

Device type, OS, app version, IP, crash reports (Sentry), push tokens.

Communication Channel Data

Message content from integrated channels (WhatsApp Business, Instagram DM, Email IMAP, Telegram, SMS) — per your explicit configuration.

3. How We Use Data

• Providing and improving CRM services.

• Authentication and security.

• Push and email notifications.

• Crash and performance monitoring (Sentry).

• AI features: lead scoring, analysis (only with your explicit consent).

• Legal obligations (KVKK/GDPR requests, tax records).

4. AI Data Processing

Requires Explicit Consent

AI features may use third-party AI providers according to your selected configuration. Before enabling them, assess which data will be processed and review the terms that apply to the provider, region and use case. Available options are shown in your account settings.

5. Third-Party Services

Service	Purpose	Data Shared
Sentry	Crash reports	Device info, error details
AI service providers	Run enabled AI features	Content and context required for the selected feature
Expo / FCM	Push notifications	Device token
Polar.sh	Subscription billing	Email, payment (web only)
DigitalOcean	File storage	Uploaded files
Google OAuth	Gmail/Calendar sync	Data you authorize

We do NOT sell your data.

6. Data Security

• TLS 1.3 encryption (in transit).

• AES-256 encryption (at rest).

• DigitalOcean Frankfurt/Amsterdam (EU) servers.

• bcrypt password hashing.

• Biometric lock support (mobile).

• Rate limiting + brute-force protection.

• Role-based access control (RBAC) + optional two-factor authentication (2FA).

7. Data Retention and Deletion

• Activity logs: auto-purged after 90 days.

• Form submissions: anonymised after the period set on the form (default 30 days).

• Account deletion: Settings → Delete My Account (full removal within 30 days).

• Backup retention: 30-day rolling + cold storage.

8. KVKK Compliance (Turkey)

Under Law No. 6698 (KVKK), your rights include: information, correction, deletion, objection. Data Controller: Rocketly. Contact: [email protected]

9. Rights under GDPR (EU)

Where GDPR applies, you may have rights including access, rectification, erasure, restriction of processing, portability and objection. When international data transfers are necessary, they are assessed under applicable data-protection requirements and appropriate safeguards. Contact us at [email protected] to make a request.

10. Children's Privacy

Rocketly is not intended for individuals under 18. We do not knowingly collect data from children under 18. If we learn we have collected data from a minor, we will delete it promptly.

11. Changes

Material changes are communicated via email and in-app notification. We provide at least 30 days notice before changes take effect.

12. Contact

Rocketly — Privacy Officer
[email protected]
Data Protection Officer (DPO): [email protected]

Last updated: April 2026 · Version 3.0