Last updated: 27 October 2026
This privacy policy explains which personal data we process when you visit our website rocketbatch.com, contact us, receive our newsletter or use the rocketbatch app. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). The German version is authoritative.
1. Controller
rocketbatch, sole proprietorship of Timo Reichen
Güterbahnhofstrasse 7, 9000 St. Gallen, Switzerland
Email: info@rocketbatch.com
Write to this address with any question about data protection, or to exercise your rights.
2. In short
- The website loads nothing from third parties: no advertising trackers, no social media plugins, no externally hosted fonts.
- We count visits with our own statistics script: anonymously and without cookies, or with one cookie if you allow it.
- Our servers and data are with Amazon Web Services in the Ireland region (EU).
- We do not sell data and do not use your content to train AI models.
3. Visiting the website and server logs
When you open a page, your browser sends technically necessary information to our server: IP address, date and time, the address requested, referrer, browser and operating system. Our web server and the proxy in front of it keep this in log files, to deliver the website, find errors and fend off attacks.
The legal basis is our legitimate interest in running the site safely and reliably (Art. 6(1)(f) GDPR). Log files are deleted after 30 days, unless an incident needs to be investigated for longer.
Fonts and scripts are served from our own server. No data goes to third parties in the process.
4. Statistics
We count visits with our own statistics script (analytics.js). It runs solely on our own servers; no third parties are involved. It has two levels.
4a. Anonymous counting (no consent needed)
By default, and when you choose “Anonymous only” in the bar at the bottom of the screen, the script counts visits without storing anything on your device: no cookie, no sessionStorage, no visitor or session ID.
Sent to our server:
- page views, page changes and leaving a page, each with path, referrer and time;
- time on page, maximum scroll depth in per cent and number of clicks, measured only in the memory of the open page;
- clicks on external links, downloads and
mailto:/tel:links, each with the target address; - the campaign parameter
m(the source, such as “newsletter”), if present; - the size class of your screen (phone, tablet, laptop or large screen), not its exact size.
The server derives the device type from the user agent your browser sends anyway, the language from the language setting your browser sends with every request (only the language, such as “de”), and the country from your IP address. For the country it uses the database “IP to Country Lite” by DB-IP (CC BY 4.0), which lies on our own server: your IP address is not passed on to anyone, only the country is kept. To group the page views of one day into a visit, it forms a hash from IP address, user agent and a random key that it changes and discards every day. The next day, the same visitor can no longer be recognised. The IP address itself is not stored. This data is never linked to contacts, campaign recipients or scores.
The purpose is to understand which content is read, and to improve the website. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). If your browser sends “Do Not Track” or “Global Privacy Control”, we only ever count your visit in this anonymous way — a cookie is set only if you explicitly choose “Allow” in the bar.
Objection: you can object to this counting at any time
(Art. 21 GDPR): Don’t count my visits.
Your objection is kept as a small entry rb-analytics-optout
in your browser’s localStorage, so that we can respect it.
4b. Extended statistics (with your consent)
If you choose “Allow”, the script may also recognise a returning browser. For that it stores on your device:
- Cookie
rocketbatch_unique_uid: a random visitor ID; first-party, SameSite=Lax, kept for 2 years; - sessionStorage
session_id,session_start: the current session, deleted when you close the browser.
In addition to 4a it then sends these IDs, the browser window size, the
user agent and, if you arrive through a personal campaign link, the
identifier cid (see section 7). Visits can thus be linked
to one browser over several days and, where applicable, to a contact.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time under “Privacy settings” in the footer; the script then deletes the cookie and counts anonymously only.
We keep your choice in the bar as rb-consent in
localStorage; this is strictly necessary. Statistics data is deleted or
anonymised after 24 months.
5. Demo requests
When you request a demo, we process your email address and, if given, first name, last name and phone number. We first send you a confirmation email, and only get in touch once you have confirmed your address.
We use these details only to arrange and hold the demo. The legal basis is steps taken at your request before a contract (Art. 6(1)(b) GDPR). Unconfirmed requests are deleted after 30 days. If no collaboration follows, confirmed requests are deleted 12 months after the last contact.
6. Newsletter
For the newsletter we need your email address; your first name is optional. We use double opt-in: you receive the newsletter only after clicking the link in our confirmation email. We store when you signed up and when you confirmed, so that we can show your consent.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, through the unsubscribe link in every newsletter or by email. Unconfirmed sign-ups are deleted after 30 days. When you unsubscribe, we remove your address from the list. The record of your earlier consent is kept for up to three years.
7. Campaign mails and landing pages
rocketbatch can send mail campaigns that lead to a landing page under
rocketbatch.com/landing/…. We use this for our own
campaigns, and our customers use it for theirs.
Who is responsible
- For our own campaigns, we are the controller.
- For our customers’ campaigns, the customer is the controller. We process the data on their behalf as a processor (Art. 28 GDPR) under a data processing agreement. For these campaigns, please contact the sender of the mail.
What is processed
- Open pixel: campaign mails may contain an invisible image (
/open/…gif). When it loads, we record that the mail was opened, and when. - Click tracking: links in the mail pass through our server, so we record which link was clicked, and when.
- Personal campaign link (
cid): the link carries an identifier tied to one recipient. It lets the landing page greet you personally, for example by first name. Visits through such a link are therefore not anonymous but linked to the recipient’s contact: mail, open, click and visit belong together. - Forms on landing pages: when you send a form, we take your email, name, phone and company, as far as given, and create a contact or add to an existing one, noting the campaign. The purpose is to answer your request and contact you about the offer.
- Lead and relationship score: opens, clicks and visits feed into a measure of how active a contact is. This is profiling within the meaning of the GDPR. It leads to no automated decision with legal effect; it helps the sender decide whom to contact first.
Legal bases: open pixel, click tracking and the link via cid
require the recipient’s consent (Art. 6(1)(a) GDPR, § 25 TDDDG), which
the sender of the campaign obtains. Statistics on the landing page send
cid only if you choose “Allow” in the bar; otherwise they
count anonymously (section 4a). Forms rely on Art. 6(1)(b)
GDPR (your request) or on your consent.
You can object to the profiling and evaluation at any time (Art. 21 GDPR); for our own campaigns, an email to us is enough. Data from our own campaigns is deleted 24 months after the last interaction, or earlier if you object.
8. The rocketbatch app
rocketbatch is a desktop app for macOS and Windows with a hybrid approach:
- Private mail stays on your device. Only headers and a short preview are synchronised with our servers.
- Shared content: mails, notes, tasks or contacts that you deliberately make public or share with others are stored on our servers, so that your team can reach them.
- AI features run with a model of your choice: locally on your device, on a server you specify, or with a hosted provider you connect yourself. In the last case, what you give to the AI goes to that provider, under its terms. We do not use your content to train AI models.
For your account, subscription and billing we process name, email address, company details and payment details. The legal basis is the contract (Art. 6(1)(b) GDPR). The content of your accounts we process on your behalf (see section 13). When the contract ends we delete the content, except records we must keep by law (accounting: 10 years).
9. Recipients and processors
Our servers and files run with Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (servers: Amazon EC2, file storage: Amazon S3), in the AWS Europe (Ireland) region. AWS processes the data only on our behalf and on our instructions, under a data processing agreement (AWS Data Processing Addendum). Beyond that, we pass on personal data only where the law requires it, or to a provider you choose yourself (such as an AI provider, see section 8).
10. Transfers abroad
Your data is stored in Ireland, that is, in the EU. Switzerland and the EU recognise each other’s level of data protection as adequate.
AWS belongs to the US group Amazon.com, Inc., so access from the US, for maintenance, support or on an order from the authorities, cannot be ruled out entirely. For that case the data is protected by Amazon’s certification under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, and by the European Commission’s standard contractual clauses in our contract with AWS (Art. 45 and 46 GDPR, Art. 16 FADP).
If you connect an AI provider based outside Switzerland and the EU/EEA in the app, that transfer happens at your instruction.
11. Your rights
You have the right
- to access the data we hold about you (Art. 15 GDPR, Art. 25 FADP);
- to have incorrect data corrected (Art. 16 GDPR);
- to have your data erased (Art. 17 GDPR);
- to have processing restricted (Art. 18 GDPR);
- to receive your data in a common format (Art. 20 GDPR, Art. 28 FADP);
- to object to processing based on legitimate interests, and to profiling (Art. 21 GDPR);
- to withdraw consent at any time, with effect for the future (Art. 7(3) GDPR).
An email to info@rocketbatch.com is enough. You may also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), in the EU the authority where you live or work.
12. Retention at a glance
| Data | Kept for |
|---|---|
| Server logs | 30 days |
| Statistics cookie in the browser (4b only) | 2 years, or until you withdraw consent |
| Daily key of anonymous counting (4a) | 1 day |
| Statistics data on the server | 24 months, then deleted or anonymised |
| Unconfirmed demo and newsletter sign-ups | 30 days |
| Demo requests without collaboration | 12 months after the last contact |
| Newsletter address | until you unsubscribe; record of consent up to 3 years after |
| Data from our own campaigns | 24 months after the last interaction, or until you object |
| Account and contract data | for the contract; accounting records 10 years |
13. For customers: data processing under the GDPR
When you use rocketbatch to process other people’s personal data, such as contacts, mails or campaign recipients, you are the controller and rocketbatch is your processor. We sign a data processing agreement with you for this. It includes the technical and organisational measures.
- Download the agreement: processing-contract.pdf
- Fill it in and sign it, digitally or printed and scanned.
- Send it to info@rocketbatch.com.
- You receive it back, countersigned digitally. From then on it is valid.
As the controller, you inform the people concerned in your own privacy policy. If you send campaigns with open and click tracking, you obtain the recipients’ consent for it.
14. Security
Connections between the app, the website and our servers are encrypted with TLS. Passwords are stored only salted and hashed. Access to data is limited to the people who need it for their work.
15. Changes
We update this policy when our services or the law change. The version published here applies. We inform customers of significant changes by email.