Rock8Cloud

Privacy Policy#

Last updated: October 9, 2026

1. Data controller#

1.1 The controller of your personal data is ProRocketeers s.r.o., Company ID: 07279531, with its registered office at Bohumínská 410/135, Ostrava-Muglinov, 712 00, Czech Republic, registered in the Commercial Register kept by the Regional Court in Ostrava, Section C, Insert 75209 (the “controller”, “we”).

1.2 We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the processing of personal data.

1.3 This policy applies to the Rock8Cloud platform and the website at https://rock8.cloud (together the “Service”).

2. What data we process and why#

2.1 Account data. When you sign in with GitHub we receive your GitHub username, display name, email address and avatar. We process this data to create and operate your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.2 Billing data. When you subscribe to a paid plan, payments are processed by Stripe. We receive your subscription status, invoicing details and partial payment information (such as card brand and last four digits). We do not store full card numbers. Legal basis: performance of a contract and compliance with accounting and tax obligations (Art. 6(1)(b) and (c) GDPR). Invoicing data is retained for the periods required by Czech accounting and tax law (up to 10 years).

2.3 Technical and log data. When you use the Service we process IP addresses, request logs, build and deployment logs and similar technical records. We use them to provide the Service, secure it, prevent abuse and diagnose issues. Legal basis: performance of a contract and our legitimate interest in the security and reliability of the Service (Art. 6(1)(b) and (f) GDPR). Technical logs are retained for 30 days. Audit logs of actions in your organization are retained for 90 days.

2.4 Product analytics. With your consent we collect usage analytics through PostHog (pages visited, features used, device and browser type) to understand how the Service is used and improve it. Legal basis: consent (Art. 6(1)(a) GDPR). You can give or withdraw consent at any time via the cookie preferences on our website.

2.5 Communication. If you contact us, we process the content of the communication and your contact details to handle your request. Legal basis: performance of a contract or our legitimate interest in responding to inquiries (Art. 6(1)(b) and (f) GDPR).

2.6 Service emails. We may send you transactional emails related to your account, billing or the operation of the Service. These are not marketing messages. Commercial communications are sent only with your consent or under the conditions of Act No. 480/2004 Coll., and you can opt out at any time.

2.7 AI assistant connections. You can connect an AI assistant, such as ChatGPT, Codex or Claude, to the Service through our MCP server after you sign in and approve the connection. We then receive the requests the assistant makes on your behalf, for example which service to deploy or the files of a page to publish. We never receive your conversation with the assistant. We return only the data a request asks for, such as service status, build and runtime logs or vulnerability findings. Once returned, that data is processed by the assistant’s provider under its own privacy policy. For each connection we keep the assistant’s OAuth registration and its access tokens. An access token expires after 7 days, and the assistant can renew it until you disconnect. You can end a connection at any time by disconnecting Rock8Cloud in the assistant or by contacting us. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.8 AI features. When you use an AI feature, such as code review, agent sessions or custom agents, we send the code, diffs and instructions the feature needs to the AI model provider you choose for it. You choose from the models we offer or use your own provider key where your plan allows it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

3. Data in your deployed applications#

3.1 For personal data contained in the applications, databases and content you deploy through the Service, you are the controller and we act as a processor on your behalf. We process such data only to the extent necessary to host and operate your workloads.

3.2 Your workloads are hosted in data centers located in the European Union, operated by an ISO/IEC 27001 certified infrastructure provider acting as our sub-processor.

4. Recipients and sub-processors#

4.1 We share personal data only with service providers we need to operate the Service:

4.2 We may also disclose personal data to public authorities where required by law.

5. International transfers#

5.1 Your workloads and the data they contain are hosted in the European Union. Some of our providers (Stripe, GitHub, PostHog) may process limited personal data in the United States. Such transfers are safeguarded by the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses. The AI model provider you choose for an AI feature may process the data you send it outside the EU, including in the United States.

6. Retention#

6.1 We keep personal data only as long as necessary for the purposes described above: account data for the duration of your account, billing records for statutory retention periods (up to 10 years), technical logs for 30 days, audit logs for the period set in your organization (90 days by default), and analytics data for the period stated in our cookie settings. After your account is deleted, we erase or anonymize your personal data unless we are legally required to keep it, or need it to establish, exercise or defend legal claims.

7. Cookies#

7.1 We use strictly necessary cookies to operate the Service (session and authentication cookies, your cookie consent choice). These do not require consent.

7.2 Analytics cookies (PostHog) are set only after you accept them in the cookie banner. Your choice is stored in a consent cookie for one year. You can change your choice at any time via the “Cookie preferences” link in the footer.

7.3 You can also manage or delete cookies in your browser settings. Blocking necessary cookies may break parts of the Service.

8. Your rights#

8.1 Under the GDPR you have the right to:

8.2 To exercise any of these rights, contact us at support@rock8.cloud. We will respond without undue delay, at the latest within one month.

9. Contact#

9.1 Questions about this policy or our data processing: support@rock8.cloud