Privacy Policy
How Sprocket Rocket collects, uses and protects your personal information.
Effective date: November 6, 2026
This policy explains what personal data Sprocket Rocket collects, why, who we share it with, how long we keep it, and the choices you have. It covers the Sprocket Rocket app at app.sprocketrocket.co, the documentation site at docs.sprocketrocket.co and its assistant, the Sprocket Rocket app for HubSpot, Sprocket Rocket AI, and the Sprocket Rocket MCP server.
Who we are
Sprocket Rocket is a HubSpot CMS product for agencies and in-house teams. It connects to your HubSpot portals, installs and updates Sprocket Rocket themes and modules, and edits pages and modules with Page Builder, Module Builder and Sprocket Rocket AI.
Sprocket Rocket is operated by Brandvious, Inc., a United States company. In this policy, "Sprocket Rocket", "we" and "us" mean that company. You can reach us about privacy at team@sprocketrocket.co.
Our marketing website, www.sprocketrocket.co, is hosted on HubSpot and uses its own cookies and analytics and advertising tools, including HubSpot, Google Analytics, Meta and LinkedIn. This policy does not cover that site; its own privacy policy does.
When an organization uses Sprocket Rocket, the organization owns its business data: its portals, installations, pages, layouts and AI chats. We decide how account, billing and support data is used. For content in your HubSpot portals and the work you do in Sprocket Rocket for your organization, we process data to provide the service to your organization. If your organization needs a data processing agreement, email us and we will provide one.
What we collect
Information you give us
- Account details. Your email address, name (first and last), and password. We store a one-way hash of your password, never the password itself. If you add a passkey or two-factor authentication, we store the passkey's public key and your authenticator secret and backup codes.
- Profile questionnaire. If you answer it during onboarding: your business type, industry, role, what you plan to use Sprocket Rocket for, and why you chose it. You can skip it.
- Profile image and organization logo, if you upload them.
- Organization details. The organization's name, website domain and logo, its members and their roles, and the email addresses of people you invite.
- Content you create. Your messages to Sprocket Rocket AI, files and images you attach to chats, saved layouts, and the modules and pages you build.
- Questions to the docs assistant. See The docs assistant.
- Support. What you write in the support ticket form, along with your name and email.
- Billing. When you buy a license, credits or a Sprocket Rocket AI subscription, Stripe collects your payment details. We never see or store your full card number.
Information from your HubSpot portals
When you connect a portal, we receive access to its CMS content. HubSpot data explains exactly what we access and why.
Information collected automatically
- Sessions. When you sign in, we record the session's IP address and browser (user agent). You can see your active sessions in your account settings.
- Security and activity log. We keep an audit log of important actions, such as sign-ins, failed sign-in attempts, portal connections, installs, purchases and admin actions. Each entry records who acted (with their email and name at that moment), the IP address, the browser, the approximate country, the page the request came from, and your language setting.
- AI usage. For each Sprocket Rocket AI turn, we record who ran it, in which organization and portal, the model, the number of tokens used and the estimated cost. This is how AI budgets and usage limits work.
- Error reports. When something breaks, we send an error report to our error tracking provider. Reports are stripped of request details, user identity, breadcrumbs and secrets before they leave our servers.
- Visits to our website. We count page loads on www.sprocketrocket.co, and on the app's sign-up page when a visit starts there, by where they came from: the campaign tags on the link, the other site that sent you, or a direct visit. To count each visitor once a day without cookies, our server combines your IP address and browser with a random value that changes every day, and keeps only the resulting code. We never store the IP address, and we delete each day's codes and random value the next day so they can't be traced back. If you create an account that day from the same browser, we use the same code to record where your visit came from as part of your sign-up (see Understand which marketing works). Otherwise these counts are never linked to you.
- Cookies and local storage. See Cookies.
The app and the docs site do not use third-party analytics or advertising trackers.
Information from HubSpot and other sources
- HubSpot Marketplace installs and HubSpot features. When you install Sprocket Rocket from the HubSpot Marketplace, open Sprocket Rocket inside HubSpot, or use Sprocket Rocket's tools from HubSpot's AI agents, HubSpot tells us your portal ID and your HubSpot user email. We use the email to match you to your Sprocket Rocket account.
- The previous Sprocket Rocket app. If you used the previous version of Sprocket Rocket, we moved your account, your agency (as an organization), its memberships, your portal connections and your password hash into the current app.
How we use your information
We use personal data to:
- Provide Sprocket Rocket. Create and secure your account, run your organization, connect your portals, install and update packages, and run Page Builder and Sprocket Rocket AI.
- Bill you. Process purchases and subscriptions, apply licenses and credits, and enforce AI budgets.
- Keep the service secure. Verify email addresses, detect and prevent abuse, limit request rates, investigate incidents and keep an audit trail.
- Support you. Answer questions and fix problems. With your request or when needed to resolve an issue, our support team can view your organization's AI chats and can sign in as you. Every support sign-in is recorded in the audit log.
- Communicate with you. Send account emails (verification, sign-in links, password resets, invitations) and notifications about your installs, module builds and purchases.
- Manage our customer relationships. We add each user to our own HubSpot CRM as a contact, with name, email, questionnaire answers, the highest license their organizations bought, whether they have a Sprocket Rocket AI subscription, where they came from before signing up, when they last signed in, and when they and their organizations first reached the steps below. Organizations with a website domain become companies, and purchases become deals.
- Understand which marketing works. We record where you came from before you signed up or bought: the campaign tags on the link you followed (such as
utm_sourceor a promotion code) or the other site that sent you, never the full address of that site. We also record when you and your organization first did things that show you are getting started, such as verifying your email, connecting a portal, installing a theme, using Sprocket Rocket AI, publishing a page or subscribing. We use these to see which campaigns lead to sign-ups and purchases, and may later use them to offer AI credit for completing steps. Our sales and support teams work from this CRM, and we may send you product news from it. Every marketing email has an unsubscribe link. - Improve Sprocket Rocket. Review docs assistant conversations to improve its answers.
- Meet legal obligations and enforce our Terms of Service.
We do not sell personal data, and we do not use it for advertising. Sprocket Rocket does not train AI models on your data.
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you (providing the service), our legitimate interests (security, support, improving the product and managing customer relationships), your consent where we ask for it, and compliance with legal obligations.
HubSpot data
Sprocket Rocket connects to HubSpot through OAuth. You choose the portal and approve access on HubSpot's own authorization screen.
What we ask for and why
| Scope | Why Sprocket Rocket needs it |
|---|---|
oauth | Required for the OAuth connection itself. |
content | Read and edit website pages, landing pages, themes, templates and modules, install and update Sprocket Rocket packages, and manage domains and URL redirects. |
files.read, files.write | Find and upload images in the File Manager, such as images Sprocket Rocket AI places on a page and chat attachments you put on a page. |
hubdb.tables.read, hubdb.tables.write, hubdb.rows.read, hubdb.rows.write, hubdb.tables.publish | Let Sprocket Rocket AI read and edit HubDB tables when you ask it to. Optional. |
business-intelligence | Read page-level traffic totals (views, entrances, bounce rate, time on page) so Sprocket Rocket AI can explain how a page performs. Optional. |
The File Manager, HubDB and analytics scopes are optional on HubSpot's authorization screen. Features that need a scope stay off until it is granted. HubSpot permissions has more detail.
What we do not access
Sprocket Rocket does not request any CRM scope for your portal. We do not read your contacts, companies, deals, form submissions or other CRM records, and the analytics we read are page totals, not data about individual visitors.
What we read and write
- Read: website and landing pages (published and draft), themes, templates, modules and their source code, File Manager files, HubDB tables you work with, domains, URL redirects, site search results, page traffic totals, and the portal's HubSpot address. When you connect, HubSpot also tells us the portal ID, its domain, the scopes granted, and the email of the HubSpot user who approved the connection.
- Write: Sprocket Rocket installs and updates theme and module files, creates and edits draft pages, publishes changes when you ask, uploads images, and edits HubDB tables and URL redirects when you ask. To read a theme's settings it briefly creates a page named "SR Theme Capture" and deletes it right after. To preview modules it may add a page named "SR Module Preview", set to noindex so search engines skip it. That page stays in your portal until you delete it in HubSpot.
What we store
- Access tokens. HubSpot access and refresh tokens are encrypted with AES-256-GCM before they are stored, and are only decrypted on our servers when Sprocket Rocket calls HubSpot. They are never sent to your browser or into the Module Builder sandbox.
- Portal details: portal ID, name, domain, granted scopes and connection status.
- Installation records: which packages are installed, their versions and the theme settings we read.
- Backups: copies of theme and module source files taken when you adopt a theme and before updates, so you can roll back.
- Page history: a copy of a page's layout before each Sprocket Rocket edit, so you can restore earlier versions.
- Previews and screenshots: module thumbnails, and screenshots of pages and drafts taken while Sprocket Rocket AI works.
- AI chats, which may quote page content.
Module drafts and previews
While you or the AI work on a module, a template or a coded email, unfinished files are saved as drafts on your own HubSpot portal, and HubSpot renders the previews from those drafts. We keep a copy of your theme's files so the AI can search them.
How we use HubSpot data
We use HubSpot data only to provide the features you use: installing and updating packages, editing and previewing pages and modules, backups and rollback, and Sprocket Rocket AI. We share it only with the service providers listed below that help us do that, for example sending page content to an AI provider when you ask Sprocket Rocket AI for a change.
Disconnecting and uninstalling
- Delete the portal in Sprocket Rocket. Owners and admins can select Delete portal under Portal settings. This deletes the stored tokens, the portal's installations, its AI chats and the other app data we keep for it. If no other organization connects that HubSpot account, Sprocket Rocket is also uninstalled from it in HubSpot. Portals brought over from the previous Sprocket Rocket app keep the app installed in HubSpot; uninstall it there if you no longer need it.
- Uninstall in HubSpot. In HubSpot, go to Settings, Integrations, Connected Apps, find Sprocket Rocket and choose Uninstall. HubSpot then stops accepting our tokens, and we delete our stored tokens for that portal the next time Sprocket Rocket tries to use them. The portal shows as needing a reconnection. Your other Sprocket Rocket data for that portal stays until you delete the portal in Sprocket Rocket or ask us to delete it.
- Themes, modules, pages and files already in HubSpot stay there either way.
Disconnect Sprocket Rocket from HubSpot walks through both.
AI processing
Sprocket Rocket AI works in Page Builder and on your site's modules, emails, blogs and templates.
What is sent to AI providers
- Page Builder: your messages, the page's layout, modules, field content and theme settings, the page's traffic totals, HubDB rows, redirects and domains when relevant, images you attach (the three most recent are re-sent with each turn), images on the page, screenshots of the draft, and web pages you link to.
- Modules: your messages, the theme and module source code it works on, images you attach and screenshots of the preview.
- Emails, blogs and templates: your messages, the content and source code of the email, blog or template it works on, and images you attach.
- Theme preparation: when you bring your own theme, its source files are sent to an AI model to set up previews.
- Chat titles: the first message of a chat and the start of the reply, to write a short title.
AI providers
| Feature | AI provider |
|---|---|
| Page Builder, modules, emails, blogs, templates, theme preparation and chat titles | Anthropic |
| Docs assistant | OpenAI |
Zero data retention is turned on for our AI requests: the providers process the content only to return a response and do not keep it afterward. They do not train their models on it, and neither do we.
Other services the AI uses
- Screenshots. To see a draft, a module preview or a page you link to, Sprocket Rocket sends its address to ApiFlash, which renders a screenshot. For HubSpot drafts that address includes HubSpot's preview key, which lets ApiFlash open that one draft. Some screenshots are taken with a browser we run on Trigger.dev instead.
- Stock photos. When you ask for a placeholder photo, the search words go to Unsplash. Photos you use are loaded from Unsplash's servers and credit the photographer.
- Page speed. Speed checks send the published page address to Google PageSpeed Insights. Drafts are never sent.
Chats and attachments
Chats, including the messages and AI replies, are stored so you and your team can return to them. Any member of the organization can see its chats and attachments. You can delete a chat at any time.
AI apps connected through MCP
You can connect AI apps such as Claude and ChatGPT to Sprocket Rocket through our MCP server. When you do, you choose the organizations and permissions the app gets, and the app's own AI reads the results of its requests: portal, page and module details, draft screenshots and draft preview links. That AI app's own privacy policy governs what it does with the data. Access tokens for connected apps are stored hashed and expire after 15 minutes, and a connection lapses after 30 days without use. You can disconnect an app at any time under Account settings, MCP.
The docs assistant
The documentation site, and the help panel in the app, include an assistant called "Ask Sprocket Rocket".
- What we keep. Every conversation is saved: your questions, the answers, and the docs page you asked from. A notice under the assistant says so: "Chats are saved to improve our answers."
- Linking to your account. If you are signed in to Sprocket Rocket, the conversation is linked to your name, email, organization and browser so our support team can help you. Untick Link chat to my account to keep it anonymous. Unticking also removes your details from the current conversation. Your choice is remembered in your browser. Conversations you had before unticking stay linked.
- No IP addresses. We do not store IP addresses with docs assistant conversations. To limit abuse, a hashed request key is kept for about two minutes.
- AI provider. Your questions and the docs pages that answer them are sent to OpenAI.
- Retention. Conversations are kept to improve the assistant. When you delete your account, we remove your name, email, organization and browser from your conversations and keep the text without them. Email us to have your conversations deleted entirely.
Service providers
We share personal data with these providers only so they can run parts of Sprocket Rocket for us.
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Hosts the app and the docs site | All app data in transit |
| Neon | PostgreSQL database | Account, organization, portal, chat, billing and log data |
| Cloudflare | File storage (R2) | Avatars, logos, chat attachments, backups, screenshots, thumbnails |
| Trigger.dev | Background jobs, such as installs, updates, screenshots and CRM sync | Job data, including portal content being processed |
| Anthropic | AI models for Page Builder, modules, emails, blogs, templates, theme preparation and chat titles | Prompts, page, module, email, blog and template content, images |
| OpenAI | AI model for the docs assistant | Docs assistant questions |
| HubSpot | Your connected portals; our CRM; support forms | Portal content; contact, company and deal data; support requests |
| Stripe | Payments, invoices and subscriptions | Billing details, email, organization and user IDs |
| Resend | Sending email | Email address, name, message content |
| Sentry | Error reporting | Error messages and stack traces, with user data removed |
| Slack | Internal team notifications | Purchase notices (organization, buyer email, amount) |
| ApiFlash | Screenshots of pages and previews | Page and draft preview addresses |
| Unsplash | Stock photo search | Search words |
| PageSpeed Insights | Published page addresses |
We may also disclose personal data when the law requires it, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of assets, in which case we will tell you before your data falls under a different policy.
Cookies
The app and the docs site use only the cookies and browser storage they need to work, plus one attribution cookie that is set only when you accept analytics cookies on our website. There are no advertising cookies.
| Name | Purpose | Duration |
|---|---|---|
better-auth.session_token | Keeps you signed in. Marked HttpOnly and Secure | Up to 30 days |
better-auth.last_used_login_method | Remembers how you last signed in, to highlight that option | About 30 days |
better-auth.two_factor | Completes a two-factor sign-in | During sign-in |
better-auth.dont_remember | Ends your session when the browser closes, if you choose not to stay signed in | Browser session |
better-auth.admin_session | Lets our support team return to their own account after signing in as you | During support sign-in |
better-auth-passkey | Completes passkey registration or sign-in | A few minutes |
locale | Remembers your language | 1 year |
sr_welcome_dialog_seen_v1, sr_welcome_bar_dismissed_v1 | Remember that you have seen the welcome message | 1 year |
sr_attribution | Set only with your analytics consent on www.sprocketrocket.co: remembers the first and latest campaign or site that brought you, so a later sign-up or purchase can be credited to it. Readable only by our servers. Cleared when you decline or withdraw consent | 90 days |
In browser local storage, we keep preferences such as your light or dark theme, your docs assistant linking choice, the pages you last opened in the editor and messages you have dismissed. Some of these keys include your user ID. A prompt you start typing before you are taken to the editor is held in session storage until the tab closes.
You can block or delete cookies in your browser settings, but you will not be able to sign in without the session cookie.
Retention
We keep personal data for as long as we need it to provide Sprocket Rocket, then delete it, unless the law requires us to keep it longer.
| Data | How long we keep it |
|---|---|
| Account and profile | Until you delete your account |
| Sessions | Up to 30 days |
| Organization data, portals, installations, layouts and AI chats | Until you delete them, the portal, or the organization |
| HubSpot tokens | Until the portal or organization is deleted |
| Page history | Until the installation it belongs to is deleted |
| Page screenshots | 60 days |
| Reference material copied from web pages you link | 30 days |
| Chat attachments | As long as the chat |
| Docs assistant conversations | Indefinitely, or until you ask us to delete them. Your details are removed when you delete your account |
| Audit log | 24 months. Entries are kept after the account they describe is deleted |
| Passwords carried over from the previous Sprocket Rocket app | Replaced the first time you sign in with it. If it is not used within 12 months, it is deleted, and you sign in with an email link or reset your password |
| AI usage records and payment records | Kept for accounting after the account is deleted, without a link to it |
| Our CRM contact for you | Until you ask us to delete it |
| Where you came from before signing up or buying | 24 months, then the campaign details are cleared |
| When you and your organizations first reached each step | Until you delete your account, or the organization is deleted |
What happens when you delete your account. Select Delete account in your account settings. We delete your profile, sessions, passkeys, two-factor settings, connected AI apps, questionnaire answers and notifications, and cancel subscriptions you started. We also delete your API keys and your profile image, and remove your details from your docs assistant conversations. Records your organizations need, such as chats and installs, stay with the organization without your name on them. Audit log entries, AI usage records and payment records are kept as described above. Your contact in our HubSpot CRM is not removed automatically; email us and we will delete it.
What happens when an organization is deleted. We delete its portals and their tokens, members, invitations, chats, layouts, licenses and credits, and uninstall Sprocket Rocket from its HubSpot portals that no other organization connects, except portals brought over from the previous Sprocket Rocket app.
When an account, organization, portal, installation or chat is deleted, we also delete its stored files, such as profile images, logos, chat attachments, backups, screenshots and thumbnails, shortly afterward. Files that another organization still uses are kept.
Security
- Data is encrypted in transit with HTTPS.
- HubSpot tokens are encrypted at rest with AES-256-GCM. Passwords, API keys and access tokens for connected AI apps are stored only as hashes.
- Sign-in requires a verified email address. You can add passkeys and two-factor authentication.
- Authentication, organization membership and permissions are checked on our servers for every request.
- Profile images and logos are shown only to signed-in people who share an organization with their owner. Stored files are private and are shared through links that expire, after one hour for profile images and logos and 15 minutes for chat attachments.
- The AI never receives your HubSpot credentials. Our servers make HubSpot calls for it.
- Error reports have user data and secrets removed before they are sent.
- Admin access is limited to Sprocket Rocket platform admins, and support sign-ins are recorded in the audit log.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.
Your rights and choices
Depending on where you live, including under the GDPR, the UK GDPR and US state privacy laws such as the CCPA, you may have the right to:
- Access the personal data we hold about you and get a copy of it.
- Correct it. You can change your name, email and profile image in your account settings.
- Delete it. You can delete your account yourself, or ask us to delete data that self-service deletion does not remove.
- Port it to another service in a common format.
- Object to or restrict how we use it, including for our own customer relationship management.
- Withdraw consent where we rely on it.
- Opt out of marketing email with the unsubscribe link in any marketing email.
- Not be discriminated against for using these rights.
We do not sell or share personal data for cross-context behavioral advertising.
There is no self-service data export yet; to get a copy of your data, email us and we will send it. To make any request, email team@sprocketrocket.co from the address on your account. We may need to verify your identity, and we will respond within the time the law requires. If your request concerns data your organization controls, such as its chats or portal content, we may refer you to your organization's owner. You also have the right to complain to your local data protection authority.
Children
Sprocket Rocket is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.
International transfers
Sprocket Rocket is run from the United States. Our app servers, database and file storage are in the United States (US East). Our service providers may process data in the United States and other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the safeguards our service providers offer for those transfers, such as the European Commission's standard contractual clauses.
Changes to this policy
We will update this policy when our practices change and change the effective date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.
Contact
Email team@sprocketrocket.co with any question or request about your personal data.
- Company: Brandvious, Inc.