Privacy Policy

Who We Are

RockettAI provides AI tools for teachers, school leaders, MAT leaders and school staff. For account, billing, support, website and platform administration data, RockettAI normally acts as the data controller.

Where a school, trust, MAT or other organisation asks its staff to use RockettAI with school records, pupil work or pupil information, that organisation is normally the controller for that school data and RockettAI acts as a processor, handling the information only to provide the service and follow authorised instructions.

Information We Collect

• Account details, such as name, email address, role, school or organisation, country or region, year group, subjects and profile image.
• Organisation and licence details, such as school, MAT, membership, invitation and billing status.
• AI tool inputs, including prompts, settings, selected curriculum context, reference materials and optional uploaded files.
• Generated outputs saved to the Library, edits to those outputs, feedback votes and usage history.
• Pupil-related information entered by authorised users, which may include names, pupil work, attendance context, SEND or inclusion information, behaviour details, report comments, support needs, medical notes or safeguarding-adjacent context.
• Technical and security data, such as IP address, device/browser information, authentication events, approximate usage times, pages visited, error logs and audit logs.
• Payment and subscription information processed through Stripe.
• Free resource request details, including your email address, the resource requested and, if you choose to provide them, your school or MAT and role. We also record delivery and download status and any separately confirmed marketing choice.

How We Use Information

• Provide accounts, authentication, dashboards and AI tools.
• Generate, display, save, edit, export and delete outputs.
• Support school and MAT administration, licences and invites.
• Protect the service, prevent misuse and investigate faults.
• Respond to support, privacy and billing requests.
• Deliver requested editable resources and understand, in aggregate and within our restricted administration area, which resources are useful to schools and MATs.
• Improve reliability, quality and user experience.
• Send service messages and, where permitted, relevant product or marketing communications.

Lawful Bases

Depending on the context, we rely on contract, legitimate interests, legal obligation and consent. For optional analytics cookies and marketing communications, we ask for consent. Sending a free resource you request is a transactional service and does not add you to marketing. Marketing requires a separate, unticked choice followed by confirmation from your email. For school-controlled pupil data, the school or MAT is responsible for identifying its lawful basis and for giving appropriate information to pupils, parents, carers and staff.

AI Processing and Uploaded Files

RockettAI uses GDPR Safe Mode by default for text sent to AI providers. Before an external AI request is made, RockettAI uses local pattern and language analysis to detect likely identifiers, such as names, email addresses, phone numbers, postcodes and reference numbers, and replaces them with request-specific placeholders. Where needed, the original wording may be restored inside RockettAI after the AI response returns. The temporary mapping is kept only for that RockettAI generation request and is not sent to the AI provider.

This reduces the amount of identifiable personal information sent for AI processing, but detection may produce false positives or miss unusual or context-dependent identifiers. It supports GDPR-conscious use and does not guarantee GDPR compliance. Schools and MATs remain responsible for their lawful basis, policies, contracts, notices and user guidance. Users should still avoid entering unnecessary personal, safeguarding, medical or other special-category information.

Supported document uploads are converted to text and masked before AI processing. Files whose text cannot be extracted safely are blocked. Images are re-encoded to remove embedded metadata where practical, but text masking cannot hide faces, handwriting, school logos, uniforms, badges or other visual identifiers. Users must check images and have the appropriate permission before uploading them.

We disable provider-side response storage where the provider API supports that control. Temporary provider-side user data files are deleted after generation and given an automatic expiry where the provider supports it. Generated outputs may be saved to the user's Library when the tool provides saving, editing or restore behaviour.

Children and Pupil Data

RockettAI is designed for adults working in education, not for unsupervised pupil accounts. However, teachers and school staff may enter pupil-related information when using tools such as pupil report writers, attendance planning, SEND support, social stories, behaviour reflection or pupil work analysis.

Users should enter the minimum pupil data needed, avoid unnecessary identifiers where possible, and avoid uploading highly sensitive information unless it is necessary for the school purpose and authorised by their organisation.

Sharing and Processors

We use trusted providers to operate RockettAI. These may include Supabase for authentication, database and storage; OpenAI for AI generation and file processing; Stripe for payments; Vercel for hosting and performance monitoring; Google Analytics where users consent to optional analytics; and Resend for transactional email.

Providers are given access only where needed to deliver the service. We may also disclose information where required by law, to protect rights or safety, or as part of a business transfer with appropriate safeguards.

International Transfers

Some providers may process data outside the UK or EEA. Where this happens, RockettAI relies on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK addendum to EU Standard Contractual Clauses or equivalent contractual protections.

Retention

• Account and organisation data is kept while the account or licence is active and for a reasonable period afterwards.
• Unpinned Library outputs are retained for 60 days from the date they are created and are then deleted during Library cleanup. Pinned outputs are exempt from this 60-day deletion while they remain pinned. If an older pinned output is unpinned after its 60-day period has passed, it becomes eligible for deletion immediately. Users can also delete outputs themselves at any time.
• Uploaded files used for generation are not intentionally stored in the RockettAI Library unless a feature clearly says so.
• Billing, audit and security records may be kept where needed for legal, accounting, fraud prevention, security or dispute purposes. Billing events and administrator audit records are normally retained for up to seven years.
• Tool performance logs are normally retained for 90 days. Activity records are normally retained for 12 months. Detailed usage events, feedback, contact requests and support records are normally retained for up to 24 months.
• Organisation import row results are normally retained for six months and import batch summaries for up to 24 months.
• Free resource request details are normally deleted after 30 days when marketing consent has not been confirmed. Where you separately confirm marketing consent, we may keep those details for up to 24 months or until you withdraw consent or ask us to delete them. Resource download links expire after seven days.

Your Rights

Depending on your role and the data involved, you may have rights to access, correct, delete, restrict, object to processing, move your data, withdraw consent and complain to the ICO. Some requests about pupil or staff data controlled by a school, trust or MAT may need to be handled by that organisation.

To make a request, contact privacy@rockettai.com. We may need to verify your identity and clarify whether the request relates to RockettAI-controlled data or school-controlled data.

Cookies

Essential cookies support login, security and service operation. Optional analytics cookies are used only after consent. See our Cookie Policy for more detail and to manage preferences.

Security

We use technical and organisational measures designed to protect personal information, including authentication, access controls, transport security, role-based admin access and audit logging for sensitive admin actions. No online service can be guaranteed completely secure, so schools should use RockettAI in line with their own data protection, safeguarding and information governance policies.

Changes to This Policy

We may update this policy as RockettAI develops or legal requirements change. Material changes will be highlighted where appropriate.

Contact

Privacy enquiries can be sent to privacy@rockettai.com.

RockettAI is operated by Rockett AI Ltd. Rockett AI Ltd is registered with the Information Commissioner's Office under registration reference ZB599675. You can view our entry on the ICO register.