Privacy policy
Draft, as of 14 October 2026. Temporary text, not legal advice. To be reviewed before go-live. Details in [square brackets] are still missing. This English version is for information; the German version is authoritative.
This policy covers our website and our web app, where you submit requests, receive quotes and run projects. In short: the website uses no cookies and no tracking. In the app we only process what we need for the request, the quote and the project.
1. Controller
Rock IT GmbH
Wissingshof 6, 48712 Gescher, Germany
Represented by its Managing Director Edgar Dyck
Email: dyck@rockit.gmbh
Phone: [phone number]
We have not appointed a data protection officer because the requirements of Art. 37 GDPR and § 38 BDSG are not met. [to be confirmed]
2. Website
Server log files
When you open the website, our server automatically processes: IP address, date and time, requested address, referrer, browser and operating system (user agent), HTTP status and amount of data transferred.
- Purpose: delivering the pages, security and troubleshooting.
- Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and working service.
- Retention: [7] days. After that the log files are deleted, unless a security incident has to be investigated.
No cookies, no tracking
The website sets no cookies, stores nothing in your browser and uses no analytics or marketing services. It embeds no third-party content (no maps, videos or social media plugins).
Fonts
All fonts are served from our own server. No connection is made to Google Fonts or any other font provider.
Contact by email
If you write to us, we process your message and contact details to answer it. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract or steps before one, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering). Our email runs through [email provider].
Appointment booking via Cal.com
For appointments we link to our booking page on Cal.com. Our website loads nothing from Cal.com; only when you click "Book a call" does the Cal.com page open in a new tab. There you enter your name, email address, preferred time and optionally a message. We use this information to hold the appointment and handle your request (Art. 6(1)(b) GDPR, pre-contractual measures).
The provider is Cal.com, Inc., [add address], USA. Cal.com processes the data on our behalf; a data processing agreement is [to be concluded/concluded]. According to its own statements, Cal.com, Inc. is certified under the EU-U.S. Data Privacy Framework [check entry on dataprivacyframework.gov]. Cal.com's own privacy policy also applies to its page: cal.com/privacy.
3. Web app
Sign-in with email and one-time code
You sign in with your email address. We send you a six-digit code that is valid for [10] minutes. We store the code only as a hash. There is no password.
- Data: email address, name if given, time of sign-in.
- Legal basis: Art. 6(1)(b) GDPR (use of the app, steps before and performance of the contract).
Session cookie and language setting
After sign-in the app sets a session cookie (better-auth.session_token). It keeps you signed in and is valid for 7 days; it is extended when you use the app. With the session we store IP address and user agent to detect misuse. The app stores your chosen language in your browser's local storage (entry "rockit.lang").
Both are strictly necessary for the use of the app you asked for and therefore need no consent (§ 25(2) no. 2 TDDDG). The legal basis for further processing is Art. 6(1)(b) and (f) GDPR.
Protection against misuse
We limit how often an IP address can request sign-in codes, and how often the AI may run per person and per request. For this we process IP address, user ID and usage figures (number of AI runs, tokens, cost). The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the app and controlling cost.
Request, quote and project data
We process what you enter or upload in the app, for example:
- company, contact person, title and description of the request, user stories, answers to questions
- Business Central version, SaaS or on-premises, app.json, dependencies
- quote versions, counter-proposals, acceptance with time and person
- access paths: repository address, access token (stored encrypted), address of the BC environment, user name
- delivery status, handover, invoice number
Legal basis: Art. 6(1)(b) GDPR. If you act for a company, we process your data as its contact person on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is performing the contract with your company.
Please only include personal data in stories and files that the request needs. Test data should be anonymised where possible.
Uploaded files
Before your first confidential upload you confirm a confidentiality agreement. We store the version, time and person of that confirmation.
- Files are stored encrypted (AES-256).
- Every access is logged with person, IP address and time.
- We extract the text of story documents (for example .docx) so the AI can analyse it (see below).
- Files are deleted automatically [90] days after handover.
The legal basis is Art. 6(1)(b) GDPR; for the access log Art. 6(1)(f) GDPR (proof of confidential handling).
AI-assisted processing
The app uses a language model. It checks your stories, asks follow-up questions, assigns the request to a price tier and prepares the draft quote. So part of the time you are writing with an AI.
- Sent to the AI provider: title, company name, BC version, deployment type, description, stories with questions and answers, names of third-party dependencies, key data of your target app (name, prefix, ID ranges) and the text of uploaded story documents.
- Not sent to the AI provider: your email address and the contact person's name, unless you write them into stories or documents yourself.
- Provider: [AI provider, see section 5]. The provider processes the data on our behalf (Art. 28 GDPR) and does not use it to train its models.
- No automated decision: the AI makes suggestions. The price tier follows fixed rules, and a person releases the binding quote. No decision within the meaning of Art. 22 GDPR is made.
The legal basis is Art. 6(1)(b) GDPR (handling your request) and Art. 6(1)(f) GDPR (efficient preparation of quotes).
Emails from the app
The app sends sign-in codes and notices about your request (questions, new quote). Delivery runs through [email provider]. In our logs we only keep the subject and the domain of the recipient address. The legal basis is Art. 6(1)(b) GDPR.
App server logs
The app server logs requests with IP address, time, address and status to find errors and fend off attacks. Retention: [7] days. The legal basis is Art. 6(1)(f) GDPR.
4. Access to your systems
If you give us access to your repository (Azure DevOps, GitHub, GitLab) or your Business Central environment, we may see personal data you are responsible for. We then act as your processor under your instructions and conclude a data processing agreement with you (Art. 28 GDPR).
5. Recipients
We only pass on data where the purposes above require it. Our service providers work under a data processing agreement (Art. 28 GDPR):
- Hosting of website and app: [hosting provider: name, address, server location]
- Email: [email provider: name, address]
- AI processing: one of the following, depending on configuration [delete the one not used]:
- OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. OpenAI Ireland is the contracting party for EU customers. Data may be transferred to OpenAI OpCo, LLC in the USA. OpenAI keeps inputs and outputs for abuse monitoring for up to 30 days.
- Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (Azure OpenAI). Processing in the region we selected [region, e.g. EU Data Zone].
- Accounting: [tax adviser] for invoices and bookkeeping; legal basis Art. 6(1)(c) GDPR.
6. Transfers to third countries
Some service providers belong to groups based in the USA. Where data may reach the USA, the transfer is safeguarded:
- OpenAI: standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR) or an adequacy decision (Art. 45 GDPR).
- Microsoft: standard contractual clauses (Art. 46(2)(c) GDPR). Microsoft is also certified under the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795).
You can request a copy of the safeguards.
7. Retention
We delete data once it is no longer needed for its purpose and no retention duty applies:
- sign-in code: 10 minutes
- session: 7 days after the last extension
- website and app server logs: [7] days
- uploaded files: [90] days after handover
- requests that did not lead to an order: [12 months] after the last activity
- user account: until you ask for deletion; inactive accounts after [24 months]
- quotes, contracts and business correspondence: 6 years (§ 257 HGB, § 147 AO)
- invoices and accounting records: 8 years (§ 257 HGB, § 147 AO)
Statutory periods start at the end of the calendar year in which the document was created.
8. Obligation to provide data
To use the app we need your email address. To prepare a quote we need the details of the request. Without this data we cannot provide the app or prepare a quote.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation.
Write to dyck@rockit.gmbh.
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
- Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany, poststelle@ldi.nrw.de, ldi.nrw.de
10. Security
Website and app run over encrypted connections only (HTTPS). Uploaded files and access tokens are stored encrypted. Access to files is logged.
11. Changes
We update this policy when the app or the law changes. The version published here applies.