Privacy Policy
Last updated September 29, 2026
1. Who we are
Rocale is operated by Chaosync Enterprises (“we”, “us”). We are the controller of the personal data described here for people who use rocale.xyz and have a Rocale account.
For the visitors to a site built on Rocale, the site’s owner decides what to collect through their contact form, and we process it on their behalf. If you contacted someone through their Rocale site, they are the best person to ask about your message; you can also write to us.
2. What we collect
When you create an account
- Account details: email address, password (stored only as a secure hash by our sign-in provider), username.
- Site content: everything you add to your site, such as your name, headline, bio, photos, work, services, testimonials, links and social profiles.
- Interview answers: what you tell Bi Xi during onboarding, used to draft your site.
- Settings: theme, custom domain, and the email-service keys or webhook addresses you connect (for Mailchimp, Kit, beehiiv or others).
- Plan and billing status: your plan, trial and renewal dates, and a reference to your subscription. Card details go to Paddle and never reach us.
- Support: help-chat messages, and the conversation plus your email if you choose “Email a human”.
When someone visits a Rocale site
- Visit counts: a daily total per site and the referring website or campaign tag (for example “instagram.com”). We do not use cookies for this and do not store IP addresses or build visitor profiles.
- Contact messages: the name, email address and message a visitor sends through a site’s contact form.
Automatically, for security
- IP address and browser type, held briefly in memory to stop abuse (rate limits, duplicate visit counts) and in our hosting provider’s short-lived request logs.
3. How we use it, and why we’re allowed to
- To provide Rocale (build, host and publish your site, deliver contact messages, run your plan): because it is necessary for our contract with you.
- To draft your copy with AI: to provide the feature you asked for. You can skip AI drafting by writing your own copy in the editor.
- To keep Rocale secure and prevent spam, fraud and abuse: our legitimate interest in a safe service.
- To count visits for site owners: the owner’s and our legitimate interest in basic, privacy-friendly statistics.
- To email you about your account, security, billing and important changes: contract and legitimate interest. We do not send marketing email unless you opt in, and every such email has an unsubscribe link.
- To meet legal duties, such as tax records and lawful requests: legal obligation.
4. What we never do
- We do not sell or rent personal data, or share it for advertising.
- We do not run advertising or cross-site tracking on rocale.xyz or on sites built with Rocale.
- We do not use your content or your visitors’ messages to train AI models. Only your interview answers and help-chat questions go to our AI provider, and visitors’ contact messages never do.
6. International transfers
Our main database is in the European Union, but some providers above are in other countries, including the United States, the United Kingdom and China. Where data leaves the country it was collected in, we rely on safeguards recognised by the applicable law, such as the European Commission’s Standard Contractual Clauses and the transfer rules of the Nigeria Data Protection Act 2023. You can ask us for a copy of these safeguards.
7. How long we keep it
- Account and site content: while your account is open. After you delete your account we delete it within 30 days; encrypted backups roll off within a further 30 days.
- Contact messages: until the site owner deletes them or closes their account.
- Visit counts: daily totals, for as long as the site’s account exists.
- Support emails: up to 24 months after the conversation ends.
- Billing records: as long as tax and accounting law requires, usually six years. Paddle keeps its own records as Merchant of Record.
- Security logs: a few days to a few weeks, then deleted automatically.
9. Your rights
Depending on where you live (for example under the GDPR, UK GDPR, the Nigeria Data Protection Act or Californian law), you can:
- get a copy of your personal data, in a portable format;
- correct it, most of which you can do yourself in the dashboard;
- delete it, or close your account;
- object to or restrict how we use it;
- withdraw consent where we relied on it.
Email support@rocale.xyz from your account address. We reply within 30 days and do not charge for reasonable requests. If you are unhappy with our answer, you can complain to your data protection authority, such as the Nigeria Data Protection Commission, the authority in your EU country or the UK Information Commissioner’s Office.
10. Security
Data travels over HTTPS and is encrypted at rest by our providers. Each account can only read and change its own data, enforced in the database itself, and billing and admin settings can only be changed by our servers. No system is perfectly secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.
11. Children
Rocale is not for children. You must be at least 16 to create an account. If you believe a child has given us personal data, email support@rocale.xyz and we will delete it.
12. Changes to this policy
We will update this page when our practices change, and email account holders before any material change takes effect. The date at the top shows the latest version. Also see our Terms of Service.
13. Contact
Chaosync Enterprises, operator of Rocale. Privacy questions and requests: support@rocale.xyz.