Privacy policy and personal data processing notice
Updated 21 Oct 2026
This notice explains how RocketKey processes your personal data under Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP. The data controller is the seller listed on the Legal information page.
Plainly: where your requests go
- Requests from your tool go through RocketKey's servers to the model provider. Models are routed through providers, so request content is processed by that provider under its own policy.
- RocketKey does not store prompts or completions.
- RocketKey records: time, model, token counts, cost, the key used, a short error and the IP address (against abuse).
- Keys can be blocked when abuse is detected (see the Terms).
Data we process
| Type | Examples | Purpose |
|---|---|---|
| Account | email, name, Google link | sign-in, service messages |
| Orders, payments | plan, amount, transaction code, payer name, last 4 digits and a hash of the account number | recording payments, refunds, accounting duties |
| Usage | time, model, tokens, cost, key, short error | enforcing the cap, usage views, support |
| Technical | IP address, sessions | security, abuse prevention |
RocketKey does not store the payer's full bank account number.
Legal basis
- Performance of a contract for providing the service.
- Consent for product emails (optional, withdraw any time in the Dashboard).
- Legal obligation for accounting records.
Recipients
Model providers (in the US), the email service (Resend), Google (Sign in with Google), hosting (Singapore) and the payOS payment gateway. Some recipients are outside Vietnam.
Retention
| Data | Kept for | Then |
|---|---|---|
| Raw payment webhook events | 90 days | deleted; only the transaction code, amount and time stay in the payment record |
| Orders, payments, balance ledger, referral commissions, withdrawal requests | 10 years | personal data anonymized when you delete your account |
| Per-request details | 90 days | aggregated into daily statistics |
| Per-request, per-key spend logs at the gateway | 90 days | deleted (not aggregated) |
| Daily usage statistics | 24 months | deleted |
| Sessions (including IP addresses) | 30 days of inactivity | deleted daily |
| Rate-limit data (including IP addresses) | 24 hours | deleted |
| Admin action log | 2 years (data breach records: 5 years) | moved to archive storage |
| Deleted accounts | anonymized as soon as the 7-day grace period ends, completed within 20 days of the request | backups expire as they rotate |
Your rights
You can ask to know, access, correct or delete your data, withdraw consent and restrict processing. Send requests from Dashboard → Settings or by support email. Deadlines:
- acknowledgement: within 2 working days;
- access or correction: within 10 days;
- withdrawal of consent or restriction: within 15 days;
- deletion: within 20 days.
Data breaches
If a personal data breach occurs, RocketKey notifies the authority (A05) within 72 hours and informs the people affected.
Contact
Questions about personal data: see Contact.
Draft pending legal review.