Rockhopper Privacy Policy

This Privacy Policy explains how Rockhopper Inc. (“Rockhopper,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects information when you visit our websites (including rockhopper.co and docs.rockhopper.co, the “Site”), use our software platform, APIs, and related services (the “Rockhopper Services”), or use Rockhopper through a third-party AI platform, such as the Rockhopper app in ChatGPT, the Rockhopper connector in Claude, or another Model Context Protocol (“MCP”) connector (each, an “AI Integration”).

It also explains the choices and rights you have regarding your information. Please read this Privacy Policy together with our Terms of Use and, for business customers, any Data Processing Addendum (“DPA”) or other written agreement with Rockhopper (together, the “Agreements”). If this Privacy Policy conflicts with a signed Agreement, the Agreement controls with respect to the data it covers.

What’s yours is yours. You own the content and business data you put into Rockhopper. We use it to provide the Rockhopper Services to you, as described in this Privacy Policy. We do not sell your Personal Data, and we do not use your Customer Content to train generative AI models.

Contents

1. Key Definitions
2. Our Role: Controller and Processor
3. Information We Collect
4. Rockhopper in ChatGPT, Claude, and Other AI Integrations
5. How We Use Information
6. Legal Bases for Processing (EEA, UK, and Switzerland)
7. How We Disclose Information
8. Artificial Intelligence and Model Training
9. Data Retention
10. Data Security
11. Your Rights and Choices
12. Additional Disclosures for U.S. State Residents
13. International Data Transfers
14. Children’s Privacy
15. Third-Party Websites and Services
16. User Testimonials and Feedback
17. Changes to This Privacy Policy
18. Contact Us

1. Key Definitions

“Personal Data” means information that identifies, relates to, describes, or can reasonably be linked to an identified or identifiable individual, such as a name, postal address, telephone number, email address, or online identifier, along with any non-public information associated with or linked to that information. “Personal Data” includes “personal information” and “personally identifiable information” as defined under applicable law.

“Anonymous Data” means information that does not identify you and cannot reasonably be used to identify you. If Anonymous Data is linked to your Personal Data, we treat it as Personal Data.

“Customer Content” means the data, files, financial and business information, prompts, queries, and other content that you or your organization submit to, connect to, or generate within the Rockhopper Services, including through an AI Integration.

“Customer” means the business or organization that holds a Rockhopper account and authorizes individual users (“Authorized Users”) to access the Rockhopper Services.

2. Our Role: Controller and Processor

Rockhopper as a controller. Rockhopper acts as a controller (or “business”) for Personal Data we collect for our own purposes, such as account registration, billing, Site visits, marketing communications, security, and product analytics.

Rockhopper as a processor. When we process Customer Content on behalf of a Customer, we act as a processor (or “service provider”) and process that data only on the Customer’s documented instructions, as set out in our Agreements. The Customer is responsible for its own privacy practices, including providing any required notices and obtaining any required consents from the individuals whose Personal Data it submits to Rockhopper. If you are an Authorized User or an individual whose data was submitted by a Customer, please direct privacy requests to that Customer. We will assist the Customer in responding as required by our Agreements and applicable law.

3. Information We Collect

3.1 Information You Provide to Us

• Account and profile information: name, business email address, phone number, job title, company name, password or authentication credentials, and account preferences.
• Billing and transaction information: billing contact details, billing address, and payment information. Payment card details are collected and processed by our third-party payment processor [e.g., Stripe]; Rockhopper does not store full payment card numbers.
• Customer Content: the data and content you upload, enter, connect, or generate in the Rockhopper Services, including, for example, financial data, forecasts, models, reports, and documents.
• Communications: information you provide when you contact support, request a demo, respond to surveys, participate in user research, or otherwise communicate with us, including recordings of calls where permitted and disclosed.
• Prompts and queries: questions, instructions, and other inputs you submit to Rockhopper’s in-product features or through an AI Integration (see Section 4).

3.2 Information Collected from Connected Third-Party Services

If you choose to connect Rockhopper to a third-party service, such as Microsoft Excel, Microsoft PowerPoint, Microsoft Word, Microsoft OneDrive, Microsoft SharePoint, Google Drive, or Google Sheets, we receive the information you authorize that service to share, consistent with the permissions (scopes) you grant. A complete list of our current integrations is available at https://www.rockhopper.co/integrations/. We access only the data needed to provide the features you request. You can revoke this access at any time within Rockhopper or within the third-party service.

3.3 Information Collected Automatically

• Usage data: pages and features accessed, actions taken, timestamps, referring URLs, and session information.
• Device and log data: IP address, browser type and version, operating system, device identifiers, language settings, and approximate location derived from IP address.
• Cookies and similar technologies: we use cookies, pixels, local storage, and similar technologies to keep you signed in, remember preferences, secure the Services, and understand usage.

3.4 Information from Other Sources

We may receive information from single sign-on providers (e.g., Google or Microsoft) when you use them to sign in, from your organization’s administrator when they invite you, from resellers or partners, and from publicly available business sources for sales and marketing purposes, where permitted by law.

4. Rockhopper in ChatGPT, Claude, and Other AI Integrations

This section describes how data flows when you use Rockhopper inside a third-party AI platform, such as the Rockhopper app in ChatGPT (provided by OpenAI), the Rockhopper connector in Claude (provided by Anthropic), or another MCP-compatible AI client. The data practices described in this section apply in the same way regardless of which AI platform you use.

4.1 Connecting Your Account

To use an AI Integration, you must authenticate with your Rockhopper account (for example, through OAuth). Rockhopper receives an access token that allows the AI platform to call Rockhopper’s tools on your behalf, limited to the permissions of your Rockhopper account. Rockhopper does not receive your password for the AI platform.

4.2 Information We Receive (Tool Inputs)

When you, or the AI assistant acting at your request, invoke a Rockhopper tool, we receive:

• Tool call parameters: the specific inputs the AI platform sends to the tool, which may include text derived from your prompt, such as search terms, entity or record names, date ranges, metrics, filters, and instructions to create or update content [list the actual parameters for each tool exposed by the Rockhopper app/MCP server].
• Authentication and request metadata: your Rockhopper account identifier, access token, timestamp, tool name, and technical request data (such as IP address and client identifier).

Rockhopper does not receive your full conversation history with the AI assistant, other files you share with the AI assistant, or information about your use of other apps on the AI platform, unless that information is included in the parameters of a Rockhopper tool call.

4.3 Information We Return (Tool Outputs)

In response to a tool call, Rockhopper returns data from your Rockhopper account that is relevant to the request, such as file status, uncommitted changes, changes from the last version, comments, reviews, summaries of reviews, and confirmations of actions taken. Tool outputs are limited to data your Rockhopper account is permitted to access. Once returned, tool outputs become part of your conversation on the AI platform.

4.4 Actions Taken on Your Behalf

Some Rockhopper tools can create, update, or remove content in your Rockhopper account, including creating reviews, adding comments, creating new versions of files, and discarding files. These actions are performed only on your instruction through the AI platform. Whether an action requires your confirmation before it is carried out depends on the settings configured in the AI platform’s MCP connection or by your system administrator.

4.5 How We Use AI Integration Data

We use tool inputs, outputs, and metadata only to (a) authenticate you and execute the requested tool call, (b) maintain security, prevent abuse, and troubleshoot errors, (c) maintain audit logs, and (d) generate aggregated, de-identified metrics about tool usage and performance. We do not use AI Integration data for advertising, we do not sell it, and we do not use it to train generative AI models.

4.6 The AI Platform’s Own Practices

The AI platform you use (for example, OpenAI for ChatGPT or Anthropic for Claude) independently collects and processes your prompts, conversations, and the tool outputs Rockhopper returns, under its own privacy policy and terms. Rockhopper does not control and is not responsible for the AI platform’s data practices. We encourage you to review the privacy policy of any AI platform you use, such as OpenAI’s Privacy Policy and Anthropic’s Privacy Policy.

4.7 Disconnecting

You can disconnect the Rockhopper app at any time from the AI platform’s settings (for example, the Apps settings in ChatGPT or the Connectors settings in Claude), or revoke access from within your Rockhopper account at [Settings > Connected Apps — confirm path]. Disconnecting stops future data flows. Logs related to past tool calls are retained as described in Section 9.

5. How We Use Information

We use information for the following purposes:

• To provide the Rockhopper Services: creating and managing accounts, authenticating users, processing Customer Content, executing integrations and AI Integration tool calls, and delivering the features you request.
• To provide support and communicate with you: responding to inquiries, sending service-related notices (such as security alerts, billing notices, and changes to our terms), and administering surveys.
• To process payments: billing, invoicing, collections, and fraud prevention.
• To maintain safety and security: monitoring for and preventing fraud, abuse, unauthorized access, and security incidents; enforcing our Agreements; and protecting the rights, property, and safety of Rockhopper, our users, and others.
• To improve the Rockhopper Services: analyzing usage trends, debugging, and developing new features, primarily using aggregated or de-identified data. We do not review Customer Content for these purposes except as needed to provide support at your request, maintain security, or comply with law.
• For marketing: sending information about Rockhopper products, events, and offers to business contacts, where permitted by law. You may opt out at any time (see Section 11).
• For legal and compliance purposes: complying with legal obligations, responding to lawful requests, establishing or defending legal claims, and maintaining records.
• With your consent or at your direction: for any other purpose disclosed to you at the time of collection.

Creation of Anonymous Data

We may create Anonymous Data from Personal Data by removing information that makes the data personally identifiable to you (such as your name and email address). We use Anonymous Data to analyze usage patterns, improve Site navigation, and enhance the Rockhopper Services. Rockhopper may use and disclose Anonymous Data for any lawful purpose, and we will not attempt to re-identify it except as permitted by law.

6. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process Personal Data as a controller on the following legal bases:

• Performance of a contract: to provide the Rockhopper Services under our Terms of Use and other Agreements.
• Legitimate interests: to secure and improve the Services, prevent fraud, communicate with business contacts, and operate our business, where those interests are not overridden by your rights.
• Consent: for certain marketing communications and non-essential cookies, and where otherwise required. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation: to comply with applicable laws, such as tax and accounting requirements.

Where we act as a processor, the Customer is responsible for establishing the legal basis for processing.

7. How We Disclose Information

We disclose information only as described below. We do not sell Personal Data, and we do not “share” Personal Data for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.

• Service providers and subprocessors: vendors who process data on our behalf under contractual confidentiality and data protection obligations, including cloud hosting [e.g., AWS / Google Cloud], payment processing, customer support tools, email delivery, analytics, error monitoring, and AI model providers that power in-product features. Customers may request additional information about our subprocessors by contacting privacy@rockhopper.co.
• Third-party services you connect: when you connect an integration or AI Integration, we exchange data with that service at your direction.
• AI platforms: when you use an AI Integration, we return tool outputs to the AI platform at your request (see Section 4).
• Your organization: if you use Rockhopper through a Customer account, your account administrator can access information about your use and your content.
• Corporate transactions: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, subject to standard confidentiality protections. Any successor will be bound by obligations consistent with this Privacy Policy for the transferred data.
• Legal requirements and protection of rights: when we believe in good faith that disclosure is necessary to comply with law, regulation, legal process, or a governmental request; enforce our Agreements; detect or prevent fraud or security issues; or protect the rights, property, or safety of Rockhopper, our users, or the public. Where legally permitted, we will make reasonable efforts to notify the affected Customer before disclosing Customer Content in response to a legal demand.
• With your consent: for any other purpose with your consent.

8. Artificial Intelligence and Model Training

Rockhopper may use AI features, including large language models provided by third-party subprocessors, to deliver functionality within the Rockhopper Services. With respect to these features:

• No training on Customer Content: Rockhopper does not use Customer Content, prompts, or AI Integration tool inputs and outputs to train or fine-tune generative AI models, and we contractually prohibit our AI subprocessors from doing so.
• Limited retention by AI providers: our AI subprocessors may retain data only for as long as reasonably necessary to provide their services, maintain safety and security, and comply with legal obligations, in accordance with their agreements with Rockhopper.
• Accuracy: AI-generated outputs may be inaccurate or incomplete. You are responsible for reviewing outputs before relying on them, particularly for financial, legal, or business decisions.

9. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. General retention periods are:

Category	Retention Period
Account and profile information	Life of the account, plus up to [90] days after account closure
Customer Content	Life of the Customer’s subscription; deleted within [30–90] days after termination or a verified deletion request, subject to backups
AI Integration tool call logs (inputs, outputs, metadata)	[30] days, unless needed longer for security investigation or legal obligation
Security and audit logs	Up to [12] months
Billing and transaction records	Up to [7] years, as required for tax and accounting purposes
Support communications	Up to [3] years after the issue is closed
Marketing contact data	Until you opt out or [24] months of inactivity
Backups	Overwritten on a rolling cycle of up to [35] days

When retention periods expire, we delete or de-identify the information. We may retain information longer where necessary to comply with legal obligations, resolve disputes, enforce our Agreements, or as part of a legal hold. Anonymous Data may be retained indefinitely.

10. Data Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit (TLS 1.2 or higher) and at rest, role-based access controls, least-privilege access for personnel, multi-factor authentication, logging and monitoring, vendor security reviews, and employee confidentiality obligations.

Rockhopper has completed a SOC 2 Type 2 examination, in which an independent third-party auditor evaluated the design and operating effectiveness of our controls relevant to security [and availability and confidentiality — confirm the Trust Services Criteria in scope] over a period of time. To learn more about our security program and to request a copy of our most recent SOC 2 Type 2 report, please visit our Trust Center at https://trust.rockhopper.co/. Access to the report may be subject to a nondisclosure agreement.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for activity under your account. If we become aware of a security incident affecting your Personal Data, we will notify you and the relevant authorities as required by applicable law and our Agreements. Please report suspected security issues to security@rockhopper.co.

11. Your Rights and Choices

11.1 Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your Personal Data:

• Access: to confirm whether we process your Personal Data and obtain a copy.
• Correction: to correct inaccurate or incomplete Personal Data.
• Deletion: to request deletion of your Personal Data.
• Portability: to receive your Personal Data in a structured, commonly used, machine-readable format.
• Restriction and objection: to restrict or object to certain processing, including processing based on legitimate interests and direct marketing.
• Withdraw consent: where processing is based on consent.
• Opt out: of targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable. (Rockhopper does not sell Personal Data or engage in such profiling.)
• Non-discrimination: we will not discriminate against you for exercising your rights.

These rights are subject to limitations and exceptions under applicable law, for example where fulfilling a request would infringe the rights of others, where we must retain data for legal reasons, or where the request is manifestly unfounded or excessive.

11.2 How to Exercise Your Rights

You may submit a request by emailing privacy@rockhopper.co or through [web form link]. You can also access and update much of your account information directly in your account settings. We will verify your identity before fulfilling a request, which may require you to confirm information associated with your account. You may designate an authorized agent to submit a request on your behalf, and we may require proof of the agent’s authority. We will respond within the time required by applicable law (generally 30 to 45 days).

If we deny your request, you may appeal by emailing privacy@rockhopper.co with the subject line “Privacy Request Appeal.” If you are in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

If your data was submitted by a Customer (your employer or organization), please contact that Customer first. See Section 2.

11.3 Account and Integration Controls

• Disconnect integrations and AI Integrations: revoke access at any time in your Rockhopper settings or in the third-party service.
• Export your data: to request an export of your Rockhopper data, contact us at support@rockhopper.co.
• Delete your account: contact support@rockhopper.co or your account administrator.

11.4 Communications and Browser Signals

• Marketing emails: unsubscribe using the link in any marketing email or by contacting us. We will still send service-related messages.
• Global Privacy Control: where required by law, we honor Global Privacy Control browser signals as a request to opt out of sale or sharing.
• Do Not Track: because there is no common industry standard, our Site does not currently respond to Do Not Track signals.

12. Additional Disclosures for U.S. State Residents

This section supplements this Privacy Policy for residents of California and other U.S. states with comprehensive privacy laws.

Categories of Personal Data collected in the past 12 months: identifiers (such as name, email, IP address); commercial information (such as subscription and billing history); internet or electronic network activity (such as usage and log data); professional or employment-related information (such as job title and company); inferences limited to product usage preferences; and sensitive personal information limited to account login credentials, which we use only to provide and secure the Services.

Sources: directly from you, automatically from your devices, from connected services you authorize, and from the other sources in Section 3.4.

Purposes: the business and commercial purposes described in Section 5.

Recipients: the categories of recipients described in Section 7. We disclose these categories of Personal Data to service providers and contractors for business purposes.

Sale and sharing: we have not sold or shared Personal Data, including that of consumers under 16, in the preceding 12 months.

Retention: see Section 9.

13. International Data Transfers

Rockhopper is based in the United States, and we and our subprocessors may process information in the United States and other countries whose data protection laws may differ from those in your country. When we transfer Personal Data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, along with supplementary measures where appropriate.

Rockhopper Enterprise customers may elect to have their instance hosted in a supported region, where a compatible cloud hosting center is available.

14. Children’s Privacy

The Rockhopper Services are designed for businesses and are not directed to individuals under 18. We do not knowingly collect Personal Data from children under 16 (or under 13 in the United States). If you believe a child has provided us with Personal Data, please contact us at privacy@rockhopper.co, and we will delete it.

15. Third-Party Websites and Services

Our Site and Services may contain links to, or integrations with, third-party websites, services, and AI platforms. When you leave our Site or use a third-party service, that third party may collect information from you under its own privacy policy. We do not control, review, or assume responsibility for third-party websites, services, or their content or privacy practices, and this Privacy Policy does not apply to them. Links and integrations are provided for your convenience and do not signify our endorsement. We encourage you to read the privacy policies of every third-party service you use.

16. User Testimonials and Feedback

We may post user testimonials and feedback on our Site. We will display feedback with your first name and last initial only, unless we have obtained your consent to display your full name. To request removal of a testimonial, contact support@rockhopper.co.

If you provide suggestions or feedback about the Rockhopper Services, Rockhopper may use that feedback without restriction or obligation to you, as further described in our Terms of Use.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date above. If we make material changes to how we use or disclose Personal Data, we will notify you by email to the most recent address associated with your account and/or by prominently posting notice on our Site, and, where required by law, obtain your consent.

Material changes take effect thirty (30) calendar days after we send email notice or post notice on our Site, whichever is earlier, unless a shorter period is required by law or the change is needed to address a legal requirement or security issue. Changes take effect immediately for new users. You are responsible for keeping your email address current. If the email address you provided is invalid or cannot receive notices, our sending of the notice will still constitute effective notice. Your continued use of the Rockhopper Services after a change takes effect indicates your acknowledgment of the updated Privacy Policy. If you do not agree with a change, you should stop using the Services and may request deletion of your account.

18. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or wish to report a concern, please contact us:

Rockhopper Inc.
Attn: Privacy
175 Varick Street
New York, NY 10014
United States

Email: privacy@rockhopper.co
General support: support@rockhopper.co