Privacy Policy

Effective date: September 1, 2026

Last updated: September 1, 2026

This Privacy Policy explains how RocketForge Pay Inc. ("RocketForge," "we," "us," or "our") handles personal information when you visit rocketforgepay.app, join our waitlist, participate in preview access, onboard into a merchant cohort, or use any future services we make available.

RocketForge Pay Inc. is a Canadian company. This policy is written with Canadian privacy principles and CASL email marketing requirements in mind.

Registered address: Toronto, Ontario, Canada

Contact email: contact email TBD

1What we collect and why

RocketForge is pre-launch and currently focused on a private waitlist and limited merchant/preview onboarding. We only collect the information we need for those activities.

Waitlist data

When you join the waitlist on rocketforgepay.app, we collect your email address.

At present, the email address you submit to join the waitlist is the only personal data collected through the public website.

We collect your waitlist email so we can send updates about access, product changes, onboarding availability, and related RocketForge Pay information.

Anonymous visit analytics

We collect basic anonymous analytics about visits to the site.

Our analytics are designed to be privacy-respecting:

• No cookies are required for analytics.
• We do not use advertising cookies.
• We do not build behavioral profiles.
• We do not identify individual visitors.
• We filter obvious bot traffic.
• We use hashed or truncated IP address data where technically needed to distinguish visits and prevent abuse.

This analytics information may include broad location, device type, browser type, referring site, pages viewed, and visit duration. It is used to understand traffic, detect problems, and improve the site.

Preview and merchant cohort data

If you are granted preview access or invited to onboard into a merchant cohort, we may collect additional business and payment-related information needed to provide invoicing services.

Depending on the activity, this may include:

• Business name and contact details
• Merchant address or location information
• Website or business information
• Invoices, customer payment information, and settlement details
• Payment rails configuration
• Destination tags, addresses, or identifiers needed to process invoices
• Support and billing records
• Communications needed to provide the service

We will only collect these details if you participate in preview access, merchant onboarding, invoicing setup, or a related service.

Transactional email records

When we send you transactional or service-related emails, such as waitlist confirmations, merchant onboarding messages, invoice status notices, security notices, or policy updates, we may keep records of those communications.

This helps us provide support, comply with legal obligations, and maintain service quality.

2Legal bases for processing

We rely on the following legal bases for collecting and using personal information:

• Consent for marketing email, consistent with Canada's Anti-Spam Legislation ("CASL"). Marketing email is sent only where you have opted in to receive it.
• Performance of a contract or steps before entering into a contract, where processing is needed to provide the waitlist, preview access, merchant onboarding, invoicing, or related services.
• Legitimate interest for operating, securing, maintaining, and improving rocketforgepay.app and RocketForge Pay services.
• Legal obligations where we are required to retain or process information to comply with applicable law.

For marketing email under CASL, we do not send marketing messages without the required opt-in consent, and each marketing message includes unsubscribe instructions.

3How we use your information

We use collected information only for legitimate operational purposes:

• To provide access to the waitlist and send relevant updates
• To operate and improve rocketforgepay.app
• To understand site usage and detect technical problems
• To onboard preview users and merchant cohort members
• To create, display, track, and support invoices and payment flows
• To process or coordinate settlement-related information through partner rails where applicable
• To respond to support requests
• To send transactional emails, confirmations, notices, and service updates
• To send marketing emails only where consent has been given
• To protect against abuse, fraud, spam, or harmful activity
• To comply with legal, tax, accounting, and regulatory obligations

We do not use personal information to train machine learning models, sell advertising, or create advertising profiles.

4What we do not do

To be direct:

• We do not sell personal information.
• We do not share personal information with advertising networks.
• We do not create advertising profiles.
• We do not use cookies for advertising.
• We do not take custody of funds or private keys.
• We do not need an exchange account to operate non-custodial invoice flows.
• We do not collect the waitlist user's full name, phone number, address, or payment details through the public site unless you separately provide that information for a future service.

RocketForge Pay is intended to be non-custodial. Funds move from a client wallet to a merchant wallet, or through partner payment rails, without RocketForge taking possession of the client's funds or private keys.

5Sharing and service providers

We share personal information only with processors and service providers needed to operate the service.

Currently, the core providers are:

• Hetzner: hosting provider in the European Union
• Resend: email sending service

We may share information with these providers so they can store data, send email, maintain infrastructure, or provide related technical services.

We may also share information if required by law, in response to a valid legal process, to protect safety or rights, to prevent abuse or fraud, or as part of a corporate transaction such as a merger, acquisition, financing, or restructuring. We would seek legal advice where a disclosure is unclear.

We do not share waitlist emails with third-party advertising networks, data brokers, or marketing co-ops.

6Retention

We keep personal information only as long as needed for the purposes described in this policy, or as required by law.

Current retention approach:

• Waitlist emails: retained until you unsubscribe or request deletion, or until we close the waitlist and remove inactive records.
• Transactional email records: retained for a limited period needed for support, audit, security, and legal compliance.
• Anonymous analytics: retained long-term only in aggregated or anonymized form; any short-lived raw analytics data is minimized.
• Merchant and invoice data: retained as long as needed to provide the invoicing service, process payments, resolve disputes, support users, and meet accounting, tax, or regulatory obligations.

We may delete or anonymize older data when it is no longer needed.

7Your rights

Subject to applicable law, you may request:

• Access to the personal information we hold about you
• Correction of inaccurate personal information
• Deletion of personal information where legally permitted
• Confirmation of your marketing email consent status
• Unsubscription from marketing emails

For marketing email, you can unsubscribe using the unsubscribe link included in every marketing message. You can also send an unsubscribe request to contact email TBD.

We may ask you to confirm your identity before handling access, correction, or deletion requests, especially if the request involves merchant, invoicing, or payment-related data. We respond to requests within a reasonable time.

Deletion requests may not apply where we must retain records to comply with law, accounting, tax, fraud prevention, or legitimate dispute resolution obligations.

8Cookies and analytics

The current public waitlist experience does not require cookies for basic analytics.

We may use privacy-respecting analytics methods that can include hashed or truncated IP information to identify unique visits, filter bots, and measure traffic. We do not use advertising cookies, cross-site tracking cookies, or behavioral advertising profiles.

If we later introduce cookies, we will update this policy and, where required by law, ask for consent.

You can usually manage browser settings to block or clear cookies, but that may affect how websites function if we later use necessary cookies.

9Security

We use technical and organizational measures to protect personal information against unauthorized access, disclosure, loss, or abuse. These measures include:

• HTTPS/TLS transport security where technically supported by browser configuration
• Access controls for administrative systems and infrastructure
• Least-privilege access for staff and approved systems
• Monitoring for abuse, unusual traffic, and security issues
• Secure handling of secrets and service provider credentials
• Limited collection of personal data

No system can be guaranteed to be perfectly secure. If a breach occurs that affects personal information, we will take steps to investigate, contain the issue where possible, and notify affected users or authorities as required by applicable law.

10International transfers

RocketForge is a Canadian company, but parts of our infrastructure may be hosted outside Canada.

Current services include:

• Hetzner EU hosting
• Resend email services

This means personal information may be stored or processed in Canada, the European Union, or other locations where our service providers operate. Where data crosses borders, we rely on service providers and contractual protections intended to safeguard personal information.

11Children

RocketForge Pay is a financial and business invoicing product. It is not directed at children.

We do not knowingly collect personal information from children under 18 years old. If you believe a child has provided us with personal information, contact us at contact email TBD and we will take steps to delete it where appropriate.

12Changes to this Privacy Policy

We may update this Privacy Policy as RocketForge Pay evolves, launches new features, onboard merchant cohorts, integrates additional payment rails, or responds to legal or operational changes.

When we make material changes, we will update the effective date and may notify waitlist users or merchants through email, the website, or both.

If we make significant changes to how we use personal information, especially data collected beyond the current waitlist email, we will explain those changes in a revised policy.

13Contact

If you have questions about this Privacy Policy, waitlist data, analytics, deletion requests, correction requests, or marketing email preferences, contact us:

RocketForge Pay Inc.

Address: Toronto, Ontario, Canada

Email: contact email TBD

For unsubscribe requests, you can also use the unsubscribe link included in any marketing email.