This notice explains what personal data Rocket Technologies processes, why, who it is shared with and how you can exercise your rights. It is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). The Spanish version governs. This translation is provided for convenience.
1. Who is the controller
Carlos Daniel Medellín Cavazos, owner of Rocket Technologies ("Rocket"), located at Carretera Nacional #102, Allende, Nuevo León, Mexico, is the controller of the personal data collected through rockettagency.com, its forms and the individual accounts of our products.
Privacy contact and rights requests: RocketMarketing@rockettagency.com · Customer Service: +52 811 227 9026
2. Two different roles: when we are the controller and when we are the processor
- We are the controller of data from people who visit the site, fill in a form, subscribe to the brief or open an individual account (Phoenix Legal Access and Pro).
- We are the processor, not the controller, of information that a firm, company or institution loads into a private deployment (Private Practice, Enterprise, Sovereign Local, Rocket CRM). In that case our client is the controller, we process data only under its instructions and the signed contract, and data subject requests are handled through the client.
We never use our clients' case files, documents or data to train models or to improve the product. If a real case were ever needed to measure quality, it would happen only with express written authorization.
3. What we collect
| Source | Data |
|---|---|
| Contact form | Name, email, phone or WhatsApp, organization, type of request, budget range if you choose to give it, and your message |
| Brief subscription | Email address |
| Business diagnostic | Name, email, company, industry and your answers. The account is created with Firebase Authentication |
| Phoenix Legal Access and Pro accounts | Name, email, encrypted credentials, plan, usage history, queries, spaces and the documents you upload |
| Payments | Processed by Stripe. Rocket does not receive or store your full card details. We receive payment status, plan, last four digits and the billing details you provide |
| Invoicing | Tax ID, legal name, regime and fiscal address, only if you request an invoice |
| Technical data | IP address, browser type, date and time, and the access logs needed for security and abuse prevention |
Sensitive data. We do not request sensitive personal data. Access and Pro run on shared cloud and are not built for case files containing personal, privileged or confidential information about third parties. That information belongs in a private deployment under a signed scope. If you upload third party data, you represent that you have the right to do so.
4. Why we use it
Primary purposes, necessary to provide the service:
- Answer your request and route it to the right division.
- Create and manage your account, plan and usage limits.
- Deliver the service: research, analysis, spaces and exports.
- Bill, invoice and prevent fraud.
- Maintain security, access logs and service continuity.
- Comply with legal obligations.
Secondary purposes, which you can decline at any time by writing to RocketMarketing@rockettagency.com without affecting the service:
- Send you the Rocket Intelligence Brief and product news.
- Measure in aggregate how the product is used in order to improve it. This uses usage telemetry, never the content of your documents.
5. Automated processing and artificial intelligence
Our products use language models to retrieve, organize and propose. AI assists; people decide. No decision with legal or significant effects on you is taken solely by automated means. You may object to automated processing and request human review by writing to the contact address.
To generate answers, the text of your query may be sent to a language model provider acting as our processor, under terms that prohibit using that content to train its models. In private deployments that require it, inference runs on dedicated infrastructure or inside the client's perimeter.
6. Who we share data with
We do not sell personal data. We share it only with processors that provide services to us and are bound to protect it:
| Processor | Purpose |
|---|---|
| Google Firebase | Site hosting and diagnostic authentication |
| Railway | Hosting of Rocket CRM and Phoenix Legal |
| Stripe | Payments and subscriptions |
| Electronic invoicing provider | Issuing tax invoices when you request one |
| Language model providers | Inference for AI features |
| Cloudflare, GitHub and Amazon Web Services | Infrastructure, security and backup |
Some of these providers are outside Mexico. Transfers rely on the cases the LFPDPPP allows without additional consent when they are necessary to perform the service you contracted. Beyond that, we share data only on a lawful request from a competent authority.
7. How we protect it
Encryption in transit, passwords stored only as salted hashes, one database per client in multi-tenant products, roles and permissions, an access log with a brute force brake, and backups. No system is infallible. If a breach significantly affects your rights, we will inform you without delay along with the measures taken.
8. How long we keep it
- Contact requests: for the duration of the commercial conversation and up to 24 months after.
- Accounts: while your account is active. On cancellation you can export your information and request deletion. We delete or anonymize within 30 days, except for what the law requires us to keep.
- Tax and payment data: the period required by tax law.
- Brief subscription: until you unsubscribe.
9. Your rights and how to exercise them
You may access, rectify, cancel or object to the processing of your data (ARCO rights), revoke your consent and limit its use or disclosure.
Email RocketMarketing@rockettagency.com with the subject "ARCO rights" and include: your full name, a way to reply to you, an official ID or the email you registered with, and a clear description of your request. We will reply within twenty business days and, where applicable, make it effective within the following fifteen business days. If you believe your right was not honoured, you may go to the competent data protection authority.
10. Local storage and cookies
The site stores your language preference in your browser. We do not use advertising cookies or sell browsing profiles. If we add analytics in the future, we will state it here before turning it on.
11. Minors
Our products are intended for people over 18. We do not knowingly collect data from minors.
12. Changes to this notice
We will publish any change on this page with its update date. If the change affects purposes or transfers, we will notify you by email when we have your address.