Legal

Privacy Policy

Last updated: October 14, 2026 · Aligned to RA 10173 (Data Privacy Act of 2012)

1. Our two roles

When you use Revenue Rocket for your business, you are the personal information controller of your customers' contact details, and Revenue Rocket processes that data on your documented instructions as your processor. For our own website visitors, accounts, and product analytics, Revenue Rocket is the controller. This policy covers both.

2. What we collect

  • Account info: your name, business name, email, mobile number, and billing records.
  • Customer lists you import: names, mobile numbers, and the consent source you attest to.
  • Review and reply content flowing through the Service.
  • Usage logs, device data, and cookie-based product analytics.

3. Why we process it (purposes)

  • Sending the review requests you schedule, and reminders in your sequence.
  • Monitoring your Google & Facebook reviews and drafting replies for your approval.
  • Billing, receipts, dunning, and account security.
  • Support, product improvement, and abuse prevention.

4. Consent and opt-out

Your customers' consent is collected by you: at import, you attest that each contact agreed to receive messages from your business. We honor STOP, UNSUB, and similar opt-out keywords immediately and permanently, and you can suppress any contact in-app at any time.

5. Your rights under RA 10173

As a data subject, you may demand access, correction, deletion, and portability of your personal data, object to processing, or withdraw consent. You may also lodge a complaint with the National Privacy Commission (NPC). To exercise any right, see our Data Subject Rights page — we respond within 30 days.

6. Cookies & third parties

We use PostHog for product analytics (routed through our own domain), Cloudflare Turnstile for bot protection on public forms, and the sub-processors listed in our Terms DPA schedule (Supabase, Semaphore, Twilio, Resend, PayMongo, Stripe, OpenAI, Hugging Face, Upstash). No advertising trackers, ever. Analytics are disabled on public review pages — we never record what your customers type.

7. Security & retention

Data is encrypted in transit and at rest, with role-based access inside our team. Customer contact lists are purged 24 months after a contact's last activity (12 months after a subscription is cancelled), or sooner on request — Settings → Export lets you take everything with you first. We notify affected organizations of personal data breaches within 72 hours.

8. Contact the Data Protection Officer

Reach our DPO at privacy@revenuerocket.ph. You may also file a complaint with the National Privacy Commission at npc.gov.ph.