Privacy Policy
Last updated: 28 September 2026
This policy explains what personal data Rocketbox collects, why, and what you can do about it. Rocketbox is operated by TADAAA! LTD, a company registered in England and Wales, 415 Wick Lane, Hackney Wick, London E3 2JG, United Kingdom ("we", "us"). We are the data controller for the personal data described here.
Questions or requests: hello@rocketbox.plus.
What we collect
Account details. Your WhatsApp phone number, and your email address and name if you give them to us. If you sign up through WhatsApp, we create your account from your phone number.
Messages and media you send us. Photos, videos, text and voice notes you send to our WhatsApp or Telegram accounts, plus the metadata those platforms attach (sender ID, timestamps, message IDs).
Business information. Your business name, address, phone, opening hours, description, website and logo. We collect some of this from you directly and some from public sources you point us to, such as your website, Google Maps listing, booking pages and social profiles.
Instagram connection. When you connect Instagram we receive an access token, your Instagram account ID and basic profile details, and we keep records of the posts we publish for you.
Billing. Your subscription plan, status and Stripe customer ID. Card details go directly to Stripe. We never see or store your full card number.
Technical data. For each signed-in device we store the IP address and browser user agent, so you can see and sign out of your active sessions.
We do not knowingly collect special category data. Please don't send us media that reveals health, religion or similar sensitive details unless you want it posted publicly.
Why we use it
| Purpose | Lawful basis |
|---|---|
| Creating your account, receiving your media, and making and publishing posts to your Instagram | Performance of our contract with you |
| Sign-in codes, account messages and support | Performance of contract |
| Billing and keeping tax and accounting records | Contract and legal obligation |
| Researching your business from public sources to write better posts | Legitimate interests (providing a useful service you asked for) |
| Security, fraud prevention and fixing problems | Legitimate interests |
We do not sell your personal data and we do not use it for advertising.
Who we share it with
We use these providers to run Rocketbox. Each one handles data only as needed to provide its service.
- Meta Platforms (WhatsApp Business Platform and Instagram Graph API): receiving your messages and publishing to your Instagram.
- Telegram: receiving messages if you use our Telegram bot.
- Stripe: payments and subscriptions.
- xAI: AI processing of your media and business details to generate captions, images and video.
- Firecrawl: fetching public web pages about your business.
- Amazon Web Services (S3, Ireland region): storing media files.
- Postmark (ActiveCampaign): sending sign-in and account emails.
- Google Fonts: serving web fonts. Your browser requests them from Google, which receives your IP address.
- Our hosting provider: running the application servers and database.
We may also disclose data where the law requires it, or to a buyer if our business is sold.
International transfers
Some of these providers are based in, or process data in, the United States and other countries outside the UK. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep it
We keep your account data, media and posts while your account is open. If you ask us to close your account, we delete your personal data within 30 days. The exceptions are billing records, which we keep for 6 years to meet UK tax law, and backups, which expire on their normal cycle. Posts already published to Instagram stay on Instagram until you or we delete them there.
Cookies
We use one strictly necessary cookie that keeps you signed in. We do not use analytics or advertising cookies, so we don't ask for cookie consent.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data,
- correct it,
- delete it,
- restrict or object to how we use it,
- send it to you or another provider in a portable format.
Email hello@rocketbox.plus and we'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to sort it out first.
Children
Rocketbox is a service for businesses and is not intended for anyone under 18.
Changes
If we make material changes to this policy we'll tell you by WhatsApp or email before they take effect. The date at the top shows when it was last updated.