Rocket Factory.ai

Version 2026-09 · September 2026

Privacy Notice.

Draft: not yet reviewed

This notice explains what personal data A Rocket Company AB (trading as Rocket Factory) collects on rocketfactory.ai and in the customer portal, why, who else sees it, how long we keep it and what your rights are. We sell only to businesses, so most of the data is about people at those businesses.

01Who is responsible

  1. 1.1The controller is A Rocket Company AB, organisation number 556525-4058, Stockholm, Sweden, trading as Rocket Factory. The company is changing its name from Mobilitas Sweden AB.
  2. 1.2Questions about this notice or your data go to [email protected].

02What we collect, and why

  1. 2.1When you write to us through the contact form: your name, email, company, the stage of your business, the mission and crew mix you choose, how you would like to pay, and your message. We use it to answer you and to shape a proposal. We also keep the address so that you can sign in to your page.
  2. 2.2When you follow our journey: your email address. We send a link to confirm it before you are added, and every email has an unsubscribe link.
  3. 2.3When you sign in: your email address, a one-time sign-in link (stored only as a hash and valid for 15 minutes) and a session that keeps you signed in for 30 days.
  4. 2.4In your company details: the company name, address, VAT number and country. If you give a VAT number we look it up in the EU's VIES register to fill in the rest. That register is public.
  5. 2.5In the dialogue: the questions, answers, proposals, requested changes and suggested meeting times that pass between us.
  6. 2.6When you sign a proposal: your full name, your confirmation that you may sign for the company, the time, the IP address it came from, and a fingerprint of the proposal as it was shown. We keep this as a record of what was agreed.
  7. 2.7When a meeting is booked: your name and email go into a calendar invitation, which Google sends to you, with a video meeting link.
  8. 2.8When you visit the site: our host and security providers process technical data such as your IP address and browser details to serve the pages, keep the site secure and tell people from bots. We do not use the site for advertising or profiling.

03Our legal bases

  1. 3.1To answer your request, make an agreement and carry it out, we rely on steps taken at your request before a contract, and on the contract itself.
  2. 3.2To run the portal, keep the site and its records secure, and keep a proof of what was signed, we rely on our legitimate interest in doing business safely with our business contacts.
  3. 3.3For the newsletter, we rely on your consent, which you can withdraw at any time.
  4. 3.4For invoices and accounting records, we rely on our legal obligations, such as the Swedish Bookkeeping Act.

04Who else sees it

  1. 4.1We use providers who handle data for us, on our instructions: Cloudflare for hosting, the database and the bot check, Resend for sending email, and Google for calendar invitations and meetings.
  2. 4.2The EU's VIES register is consulted when you give a VAT number, and receives that number.
  3. 4.3We share data with our advisers, such as accountants and lawyers, when needed, and with authorities when the law requires it. We do not sell personal data.

05Transfers outside the EU and EEA

  1. 5.1Some of our providers are based in, or reach data from, countries outside the EU and EEA, such as the United States. Where that happens we rely on a lawful transfer basis, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses, and on the provider's own safeguards.

06How long we keep it

  1. 6.1Requests that do not lead to an agreement are deleted after 24 months without contact.
  2. 6.2Agreements, signatures, proposals and invoices are kept as long as the agreement runs and for seven years after the financial year in which it ended, as the accounting rules require.
  3. 6.3Sign-in links expire after 15 minutes and are removed after a day. Sessions end after 30 days or when you sign out.
  4. 6.4Newsletter addresses are kept until you unsubscribe.
  5. 6.5We may keep data for longer when we need it for a legal claim, or when the law requires it.

07Cookies and similar storage

  1. 7.1We set one cookie, a sign-in cookie called rf_session, and only when you sign in. It is strictly necessary for the portal and is not used for tracking.
  2. 7.2Your browser also stores your choice of light or dark theme and, briefly, the page you were going to when you signed in. Neither leaves your device.
  3. 7.3The bot check from Cloudflare may use technical signals and its own storage to tell people from bots. We do not use advertising, analytics or profiling cookies.

08Your rights

  1. 8.1You can ask us for a copy of your data, to have it corrected, deleted or restricted, to object to how we use it, and to receive it in a common format.
  2. 8.2You can withdraw a consent at any time, and unsubscribe from the newsletter with the link in any email. Withdrawing does not affect what was done before.
  3. 8.3We answer within one month. Some data we must keep by law, for example accounting records, and then we tell you why.
  4. 8.4If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

09Security

  1. 9.1The site runs over HTTPS. Sign-in links and sessions are stored only as hashes, access to the admin side is limited to named people, and signed agreements carry a fingerprint that shows whether they have been changed.
  2. 9.2No system is perfectly secure. If a breach puts your rights at risk we tell you and the authority as the law requires.

10Changes

  1. 10.1We update this notice when what we do changes. The version and date are at the top, and we tell people with a portal account about material changes.

A Rocket Company AB · org. no. 556525-4058 · SE556525405801

Standard Terms & ConditionsPrivacy Notice