Last updated 24 September 2026
Privacy Policy
ROCKMOUNTAI LTD (company number 17076705), registered office 20 Elveley Drive, West Ella, Hull, England, HU10 7RU, trading as Rockmount AI (“we”, “us”, “our”), is the data controller for personal data collected through rockmountai.com (the “site”). This policy explains what we collect, why, how long we keep it, and the rights you have over it, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who to contact
For any question about this policy or your data, contact sales@rockmountai.com. We aim to respond within one working day and, in any case, within one month as required by law.
2. What we collect and why
| When | What we collect | Why | Legal basis |
|---|---|---|---|
| You submit the “Enquire now” form | Name, email address, phone number (optional), company (optional), the project details and timing you type, which page and button you used to open the form, your preferred learning format if applicable, and an HMAC-hashed fingerprint of your IP address (the raw IP is never stored) | To read, assess and reply to your enquiry, and to stop automated abuse of the form | Taking steps at your request before entering a contract (Art. 6(1)(b)), and our legitimate interest in preventing spam/abuse (Art. 6(1)(f)) |
| You click a call-to-action button | The page and button clicked (no name, email or IP is attached to this record) | To understand which parts of the site generate genuine interest, so we can improve it | Legitimate interest (Art. 6(1)(f)) |
| You email us directly | Whatever you include in that email | To have the conversation you started | Legitimate interest / pre-contractual steps |
| You buy the LinkedIn shortlist course | Verified account reference, Stripe Checkout session reference, purchase status and the timestamp of your immediate-access consent | To process payment, confirm course access, record your express consent and prevent duplicate access grants | Contract (Art. 6(1)(b)) and legal obligations where applicable |
Accounts, scanner and digital course
You can use the App & Website Security Scanner twice without an account. We set a signed, random guest identifier in an HttpOnly cookie and store the associated free-scan count and up to ten recent reports in private Vercel Blob storage. To stop a refresh, another browser or a newly created account on the same connection resetting the allowance, we store an HMAC-hashed network identifier and the times of free scans for a rolling 365 days. This shared limit applies to both guest and signed-in free scans. We do not store the raw IP address in that allowance record. A shared network may reach the free limit sooner; using a different network can be treated as a different guest. Guest records are removed after their one-year lifetime; clearing the browser cookie earlier removes that browser's access to its reports but does not restore its network allowance.
Accounts are optional for free scans but required to buy credits and keep purchased scans across devices. Signing in does not reset the shared network's free allowance. Clerk, our authentication provider, processes sign-in details and email verification; Rockmount does not receive or store your password. For account scans, we keep a pseudonymous account reference, free scans used, remaining paid credits, payment-session references used to prevent duplicate crediting, and up to ten recent reports. A report includes the public URL checked, scan time, grade, score, response status and the six checked response headers and recommendations. For both guest and account scans, we keep a private activity log of completed scans for 12 months, including the public URL, date and time, grade, score, and whether it used a free scan or paid credit. Authorised Rockmount administrators can view this activity to monitor scanner use and support the service. Failed checks are not added to the log. We do not store page bodies, login credentials or Set-Cookie headers. Reports and scan activity are removed after 12 months; account allowances and payment ledgers are retained while the account exists so cleanup cannot restore free scans or duplicate paid credits. You can request account and report deletion by emailing us. Stripe hosts checkout and processes payment details; Rockmount does not receive or store card numbers. We also use a short-lived HMAC-hashed network identifier for hourly abuse limits. Only submit public URLs you own or have permission to check. The requested website receives a request from our server. We use this information to provide the scanner and protect it against abuse.
The LinkedIn to a Useful Shortlist course also requires a verified account. If you buy it, we store a pseudonymous account reference, Stripe Checkout session ID, access status, purchase time and the time you confirmed that you wanted immediate digital access. We use those records to grant access to the purchasing account and prevent duplicate grants. The course itself stores lesson progress and worksheet entries in local browser storage when available; those entries stay on your device and are not sent to Rockmount. Reset your course progress in the course or clear your browser storage to remove them. Course access records are retained while the account is active; you can request account deletion by emailing us. Transaction records may be kept longer where required for accounting or legal obligations.
3. Cookies and website measurement
Public browsing does not set advertising or analytics cookies. Using the scanner without signing in sets a signed guest cookie to associate your free scans and reports with this browser. Signing in or creating an account uses essential authentication cookies managed by Clerk to maintain your session and protect account actions. Their names and lifetimes can vary with the authentication configuration and environment; see the Clerk cookie documentation. Successful admin login sets an essential first-party session cookie for up to 12 hours, cleared on sign-out. We do not load Google Analytics, advertising pixels or third-party marketing trackers. Enquiry-button clicks are recorded on our own server without an analytics cookie, as described above. See our Cookie Policy for the cookie inventory and browser controls. If we introduce optional tracking that requires consent, we will provide controls before it is activated and update these policies.
4. Where your data is stored
Enquiry, click, scanner and course-access records are stored in private Vercel Blob storage in London and are not publicly accessible. Account sign-in and email verification are processed by Clerk. Payment details are processed on Stripe-hosted checkout. Our server-side code stores course access, immediate-access consent time, scanner allowance, credit references and reports; authorised Rockmount administrators can access scanner activity, support and enquiry records when needed. The website is hosted on Vercel; request processing may involve infrastructure outside the UK.
5. Who we share it with
We do not sell, rent or share your data with third parties for their own marketing. We do not use a mailing list or CRM. The organisations that process data for our services include:
- Vercel Inc. — website hosting, private data storage and delivery (processor)
- Clerk Inc. — account authentication, sign-in and email verification (processor)
- Stripe Payments UK / Stripe, Inc. — hosted checkout and payment processing for scanner credits and digital course purchases (processor)
- Rockmount AI staff/founders who need it to reply to your enquiry
We may also disclose data where required by law, for example to a court, regulator or law enforcement body.
6. How long we keep it
Enquiry records (name, email, optional phone number, company, message and related metadata) are retained for 12 months from the date of submission, then deleted by a daily automatic retention job. Security rate-limit fingerprints are kept for up to 48 hours plus the daily cleanup interval. CTA click records, which do not identify you, are retained for 12 months for the same reason. Scanner reports are removed after 12 months. Pseudonymous scanner allowances, course access and payment-session references are retained while the account exists to enforce access and prevent duplicate crediting; you may request deletion by contacting us. Authentication records are retained by Clerk while the account remains active, subject to Clerk's retention terms. Transaction records may be retained for accounting and legal periods. If we begin a paid engagement with you, information relevant to that contract is kept for as long as needed for accounting, tax and legal purposes (normally 6 years), under separate contractual documentation. You can ask us to delete your enquiry data sooner at any time — see Section 8.
7. Automated decisions
We do not use profiling or any automated system to make decisions about you. Every enquiry is read and actioned by a person.
8. Your rights
Under UK GDPR, you have the right to:
- Ask what personal data we hold about you and get a copy (access)
- Ask us to correct inaccurate data (rectification)
- Ask us to delete your data (erasure)
- Ask us to restrict how we use it (restriction)
- Ask us to hand it to you in a portable format (portability)
- Object to processing based on our legitimate interest (objection)
- Withdraw consent at any point where consent is the basis for processing
To exercise any of these, email sales@rockmountai.com. If you are unhappy with how we have handled your data, you can complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), though we’d appreciate the chance to put it right first.
9. Children
This site and its services are aimed at businesses, not children. We do not knowingly collect data from anyone under 18.
10. Changes to this policy
We will update this page if what we collect or why changes, and update the date at the top. Significant changes will be highlighted on the site.