Legal

Privacy policy

Draft — pending legal review

What we collect

Information you give us directly, such as your email address when you join a waitlist or newsletter, and any details you type into a form, a booking or a portal.

How we use it

To respond to you and to send what you signed up for.

Who processes it

These services handle data on our behalf. Each is listed for what it receives.

  • Supabase: our database and sign-in. Stores what you submit (form entries, bookings) and portal account data.
  • Vercel: hosts the site and runs scheduled jobs. Handles ordinary request data such as your IP address and browser details.
  • Resend: sends our email. Receives the recipient email address and the message content.
  • Cloudflare Turnstile: the bot check on forms. Receives a challenge token from your browser and may receive your IP address.
  • Stripe: payments inside portals. Receives the payment details you enter and the amounts charged. The public pages do not take payments.
  • Cloudflare Stream and R2: video and file storage for portals. Receive the files uploaded there.
  • Google Calendar: booking events. Receives the booking time and details so the event appears on Rocky's calendar.
  • Twilio: text messages, only when texting is switched on. Receives the phone number and the message text.
  • OpenAI: transcribes voice notes uploaded in portals. Receives the audio.
  • Browser push services (such as Apple, Google and Mozilla): only if you turn on notifications in a portal. Receive the notification and your browser's push address.

Analytics

No analytics or advertising tracker is active on this site today.

Retention

When a signed-in user asks to delete their account, the account is anonymized after 30 days.

Contact

Privacy questions: rocky@haestus.dev.