Last updated · August 25, 2026
Privacy Policy
Rocket USA Inc., and its affiliates ("Company," "Brandstack," "we," "us," or "our") respect your privacy and are committed to protecting it through our compliance with this policy. Brandstack is a product of Rocket USA Inc.
By using our services, you understand that we will collect and use your personal information as described in this Privacy Policy. Please read this policy carefully. If you do not agree with our policies and practices, you should not continue to access our services. This policy may change from time to time. Your continued use of the services after we make changes is deemed acceptance of those changes.
1. Who We Are
Brandstack is a product operated by Rocket USA Inc. This policy explains what data Brandstack collects, how we use it, and what control you have over it.
If you have any questions about this policy or your data, contact us at brandstacksales@rocket.new
2. Personal Information We Collect and How We Collect It
We collect several types of information from and about users of our services. If you do not provide us with certain personal information, you may not be able to use some parts of our services.
2.1. Information You Provide
You provide us with personal information about yourself when you register for an account, set up or update your profile, connect a data source, contact us via email or any other means, or apply for a position with us.
2.2. Information We Collect Automatically
We collect the following information automatically: your equipment, browsing actions and usage patterns, IP address, geolocation information, and history of your transactions on the services.
2.3. Technologies We Use
The technologies we use for automatic data collection may include cookies and web beacons. You can set your browser to refuse all or some browser cookies. If you do not want us to see your device location, you can turn off location sharing on your device.
2.4. Business Data from Connected Platforms
Brandstack connects to the sales channels, advertising platforms, marketplaces, and logistics tools your business already uses. This includes platforms such as Shopify, Meta Ads, Google Ads, Google Analytics, Amazon, Flipkart, Myntra, Meesho, Nykaa, Shiprocket, Delhivery, Unicommerce, and others. Each connection is authorised by you and can be disconnected at any time.
From these platforms we read reporting and performance data, such as sales figures, orders, revenue, ad spend, impressions, clicks, conversions, inventory levels, shipment status, and return rates. We access only what is necessary to produce the reports and insights shown inside your Brandstack dashboard. Some connected platforms, Shopify and the marketplaces in particular, return order records that contain your own customers' names, email addresses, phone numbers and delivery addresses. Where that happens we store only what the reports and customer views in your dashboard actually need. We never sell it, never share it with anyone else, and never use it for our own marketing. In respect of that information you remain the controller and we act as your processor.
2.5. Information from Third Parties
We may collect personal information about you from third-party sources such as partners, affiliates, service providers, and vendors where they are legally permitted to share your personal information with us.
3. How We Use Your Personal Information
We collect, use, store, and process your personal information to provide our services, to improve them, to fix issues, to develop new features, and to communicate with you about your account and subscription. We normally collect or use personal information only where we have your consent, where we need it to perform a contract with you, or where the processing is in our legitimate interests. We keep your personal information for no longer than necessary for the purpose for which it is processed.
4. AI and Model Training
We do not use your personal data or business data submitted through Brandstack to train external AI or machine learning models, or for any purpose beyond the agreed scope of our services. Any personal data processed by our AI systems is handled in compliance with applicable data protection laws, including GDPR and CCPA where relevant.
5. Third-Party Integrations
Brandstack connects to third-party platforms on your instruction. Each integration is authorised by you through that platform's own permission screen. We access only the data necessary to produce your dashboard. We do not modify, delete, or act on data in any connected account.
5.1. Google: Google Ads and Google Analytics
A note on Google integrations. When you connect Google Ads, Google shows a permission screen stating that Brandstack can "see, edit, create, and delete" your account data. That wording comes from Google and is the only option Google offers. There is no read-only alternative. Brandstack never creates, changes, pauses, or deletes campaigns, budgets, keywords, or ads. We only download reports.
From Google Analytics, we read reporting information about your website, such as: visits and sessions, numbers of visitors and new visitors, page views, how long people stay, which channels and sources brought them to your site, purchases, revenue, transactions, checkouts, product performance, and summary breakdowns by country, city, age group and gender. We do not read or store the identity of any individual visitor to your website.
From Google Ads, we read reporting information about your advertising, such as: campaign and ad group names, whether they are active or paused, amount spent, impressions, clicks, click-through rate, average cost per click, conversions, conversion value, and the same figures broken down by geographic region.
We use this information for one purpose only: to produce the reports, analytics and insights shown to you inside your own Brandstack dashboard. We do not use it for anything else.
Brandstack's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we confirm that your Google data is:
- used only to provide and improve the features you see in Brandstack;
- never passed to anyone else, except where it is necessary to provide those features, where the law requires it, or as part of a merger or sale of the business;
- never sold, and never used for advertising or to build advertising profiles;
- never used to train or develop artificial intelligence or machine learning models;
- never read by a person, unless you specifically ask us to look at something to help with a support issue, or we need to investigate misuse, or we are required to by law.
5.2. Meta: Facebook, Instagram and Meta Ads
If you connect a Meta account, you approve it on Meta's own permission screen before we read anything. What we read is reporting data and nothing more.
From Meta Ads: the names and status of your advertising campaigns, how much you spent, how many people saw your adverts, how many clicked, and how many purchases or other results followed.
From your Facebook Page: the list of Pages you manage, your posts and reels, and how each one performed, including views, reach, reactions, comments, shares and video views, together with overall Page audience figures.
From your Instagram professional account: your posts and reels and how each one performed, including views, reach, likes, comments, saves and shares, together with overall account figures.
Brandstack never publishes a post, never creates or changes an advert, never replies to or deletes a comment, and never spends money on your behalf. We asked Meta only for read permissions and deliberately did not request the ones that would allow any of that.
We do not collect your followers' personal information. Where Meta returns audience figures, they are aggregated counts rather than lists of people.
Our use of information received from Meta's APIs follows the Meta Platform Terms and the Meta Developer Policies. We do not sell it, do not share it with anyone else, do not combine it with other customers' data, and do not use it to train artificial intelligence or machine learning models.
5.3. Shopify
If you connect a Shopify store, we read your orders and their line items, products and variants, inventory levels, refunds and returns, discounts, payouts, and the customer records attached to those orders. This is what makes revenue, margin, repeat-purchase and returns reporting possible.
Some of that is what Shopify calls protected customer data: the names, email addresses, phone numbers and shipping addresses of the people who buy from you. We handle it under Shopify's Protected Customer Data requirements. We request only the fields our reports need, we keep them no longer than the retention periods set out in section 8, we encrypt them at rest and in transit, and we never sell or share them.
Those records belong to you and to your customers, not to us. If one of your customers asks you to delete their information, tell us and we will remove it from your Brandstack data within 30 days.
Brandstack does not create, edit, cancel or fulfil orders, does not change products, prices or inventory, and does not contact your customers. We read your store; we do not run it.
6. Disclosure of Your Personal Information
We do not disclose your personal information to any third party in a manner that would be considered a sale under applicable laws. We may share data with service providers who help us operate Brandstack, such as hosting and infrastructure providers, strictly to the extent necessary to provide those services. We may also share data where required by law or as part of a merger or sale of the business.
7. How We Keep Your Data Safe
We have implemented reasonable administrative, physical, and technical safeguards to secure your personal information from accidental loss and from unauthorised access, use, alteration, and disclosure. Your data is stored on our servers in encrypted form. Connection keys that allow Brandstack to access your linked accounts are encrypted using strong industry-standard encryption and are kept separately from the rest of the database. Information travelling between your browser, our servers, and any connected platform is encrypted in transit. Only authorised members of our engineering team can access our production systems. Unfortunately, the transmission of information via the internet is not completely secure. Any transmission of personal information is at your own risk.
8. How Long We Keep Your Data
- If you disconnect an integration but your Brandstack subscription is still active, we keep the reports we already downloaded for 90 days so that reconnecting restores your history. If you have not reconnected within 90 days, we delete it.
- If you cancel your subscription or close your account, we delete all data linked to your account within 30 days.
- You can ask us to delete your data sooner at any time by emailing brandstacksales@rocket.new . We will do so within 30 days.
9. How to Disconnect an Integration
You can disconnect any connected platform from Brandstack at any time from the Data Sources page inside your dashboard. This deletes the stored connection and stops any further data being collected from that source.
For Google accounts specifically, you can also remove Brandstack's access directly from your Google account at myaccount.google.com/permissions
For Meta accounts, you can also remove Brandstack from your Facebook settings under Settings and Privacy, then Settings, then Business Integrations.
For Shopify, uninstalling the Brandstack app from your Shopify admin disconnects the store and has the same effect.
If you would rather not do it yourself, write to us at brandstacksales@rocket.new and we will disconnect the integration and delete the data for you. Instructions for requesting deletion are also published at usebrandstack.com/data-deletion
10. Your Choices
You can take the following actions to change or limit the collection or use of your personal information:
- You may opt out of marketing messages by writing to us at brandstacksales@rocket.new
- You can set your browser to refuse all or some browser cookies.
- If you do not want us to see your device location, you can turn off location sharing on your device.
- You can close your account and request deletion of your data at any time.
11. Your Privacy Rights
You may have certain rights related to your personal information, subject to local data protection laws. To exercise any of these rights, please contact us at brandstacksales@rocket.new . For users in the European Economic Area (EEA), these rights are provided under the General Data Protection Regulation (GDPR). If you are a California, USA resident, California law may provide you with additional rights regarding our use of your personal information.
Right to Be Informed: You have a right to be informed about the manner in which any of your personal data is collected or used, which we have endeavoured to fulfil through this Privacy Policy.
Right of Access: You can access, review, and modify your personal information by logging into your account. You can also request information about how we collect and use your personal information, the categories of data we hold, and how long we retain it.
Right to Rectification: You have a right to request that we amend or update your personal data if it is inaccurate or incomplete.
Right to Erasure: You have a right to request that we delete your personal data in certain circumstances, such as where the data is no longer necessary for the purpose it was collected, or where you withdraw consent on which processing is based.
Right to Restrict Processing: You have a right to request that we temporarily or permanently stop processing all or some of your personal data in certain circumstances.
Right to Object: You have a right, at any time, to object to our processing of your personal data, including where we are relying on legitimate interests as our legal basis. You have an absolute right to object to us processing your personal data for direct marketing purposes.
Right to Data Portability: You have a right to request that we provide you with a copy of your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another service provider where technically feasible.
Right Not to Be Subject to Automated Decision-Making: You have a right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
You have a right to raise questions or complaints with your local data protection authority at any time. You have a right not to be discriminated against for exercising any of your rights.
12. Children Under the Age of 18
Our services are not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn we have collected personal information from a child under 18 without verification of parental consent, we will delete that information.
13. Data Controller, Data Protection Officer, and EU Representative
We process your personal information as a "controller" as defined under the General Data Protection Regulation (GDPR).
Rocket USA Inc. has a Data Protection Officer who is responsible for matters relating to privacy and data protection. Our Data Protection Officer can be reached at brandstacksales@rocket.new .
For users located in the European Economic Area (EEA), all processing of personal data is performed in accordance with the GDPR. All transfers of data from the EEA are conducted in accordance with applicable transfer mechanisms, including Standard Contractual Clauses where required. Rocket USA Inc. maintains a data processing agreement with its cloud infrastructure provider to support GDPR compliance.
Pursuant to Article 27 of the GDPR, Rocket USA Inc. has appointed an EU Representative to act on its behalf regarding matters related to the processing of personal data within the European Union.
EU Representative (Article 27 GDPR): Rickert Rechtsanwaltsgesellschaft mbH Attn: Rocket USA Inc. Colmantstrasse 15 53115 Bonn Germany Email: art-27-rep-RocketUSA@rickert.law
14. Lawful Basis for Processing (EEA Users)
Where European data protection law applies, our lawful basis for collecting and using personal data described in this Privacy Policy depends on the personal data concerned and the context in which we collect it. We generally rely on the following lawful bases:
- Performance of a contract: where processing is necessary to deliver the services you have requested.
- Legitimate interests: where processing is in our legitimate business interests and not overridden by your data protection rights, such as fraud prevention, security, and service improvement.
- Consent: where you have given us explicit consent to process your personal data for a specific purpose.
- Legal obligation: where processing is necessary to comply with applicable laws.
15. Changes to This Policy
We may update this policy from time to time. When we do, we will update the date at the top of this page. If the changes are significant, we will notify you by email or through a notice inside the platform.
16. Contact
Rocket USA Inc. brandstacksales@rocket.new usebrandstack.com