Your privacy is important to us. It is our policy to respect your privacy and comply with any applicable law and regulation regarding any personal information we may collect about you, including across our website, runonrally.com, getonrally.com, and any subdomains or related domains owned and operated by RALLY BOOKING LLC.
Personal information is any information about you which can be used to identify you. This includes information about you as a person (such as name, address, and date of birth), your devices, payment details, and even information about how you use a website or online service.
In the event our site contains links to third-party sites and services, please be aware that those sites and services have their own privacy policies. After following a link to any third-party content, you should read their posted privacy policy information about how they collect and use personal information. This Privacy Policy does not apply to any of your activities after you leave our site.
This policy is effective as of April 30, 2026. Last updated: July 12, 2026.
Information We Collect
Information we collect falls into one of two categories: "voluntarily provided" information and "automatically collected" information.
"Voluntarily provided" information refers to any information you knowingly and actively provide us when using or participating in any of our services and promotions.
"Automatically collected" information refers to any information automatically sent by your devices in the course of accessing our products and services.
Log Data
When you visit our website, our servers may automatically log the standard data provided by your web browser. It may include your device's Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details about your visit.
Additionally, if you encounter certain errors while using the site, we may automatically collect data about the error and the circumstances surrounding its occurrence. This data may include technical details about your device, what you were trying to do when the error happened, and other technical information relating to the problem. You may or may not receive notice of such errors, even in the moment they occur, that they have occurred, or what the nature of the error is.
Please be aware that while this information may not be personally identifying by itself, it may be possible to combine it with other data to personally identify individual persons.
Device Data
When you visit our website or interact with our services, we may automatically collect data about your device, such as device type, operating system, unique device identifiers, and geo-location data.
Data we collect can depend on the individual settings of your device and software. We recommend checking the policies of your device manufacturer or software provider to learn what information they make available to us.
Personal Information
We may ask for personal information — for example when you submit content to us, when you register an account, or when you contact us — which may include one or more of the following:
- Name
- Phone or mobile number
- Home or mailing address
- Business information (for operators: business name, address, tax information)
- Electronic signatures collected via document signing links
- Staff and crew information provided by operators (name, email, phone, availability)
- Free-text notes operators write about their clients (which may be processed by AI features as described below)
- Message thread content (SMS and email) between operators, clients, and crew, sent through the platform
- Support tickets and bug reports you submit through the platform, including any content you choose to include in them
User-Generated Content
We consider "user-generated content" to be materials (text, image, and/or video content) voluntarily supplied to us by our users for the purpose of publication on our website or re-publishing on our social media channels. All user-generated content is associated with the account or email address used to submit the materials.
Please be aware that any content you submit for the purpose of publication will be public after posting (and subsequent review or vetting process). Once published, it may be accessible to third parties not covered under this privacy policy.
Collection and Use of Information
We only collect and use your personal information when we have a legitimate reason for doing so. In which instance, we only collect personal information that is reasonably necessary to provide our services to you.
We may collect, hold, use, and disclose information for the following purposes, and personal information will not be further processed in a manner that is incompatible with these purposes:
- to provide you with our platform's core features and services;
- to enable you to customise or personalise your experience of our website;
- to deliver products and/or services to you;
- to contact and communicate with you;
- for analytics, market research, and business development, including to operate and improve our website, associated applications, and associated social media platforms;
- to send you marketing and promotional communications, where you have opted in;
- to deliver you personalized and targeted advertising tailored to your interests;
- for internal record keeping and administrative purposes;
- to comply with our legal obligations and resolve any disputes that we may have;
- for security and fraud prevention, and to ensure that our sites and apps are safe, secure, and used in line with our terms of use;
- for technical assessment, including to operate and improve our app and associated services.
We may combine voluntarily provided and automatically collected personal information with general information or research data we receive from other trusted sources.
Payment Processing
We use Stripe to process payments on our platform. When you submit payment information, it is transmitted directly to Stripe and is subject to their privacy policy. We do not store full card numbers; saved payment methods are tokenized and managed by Stripe, and Rally only receives non-sensitive metadata such as card brand and the last four digits. Operators using Rally Payments authorize Stripe Connect, which involves sharing business and identity information with Stripe for compliance purposes.
AI Features (Sidekick)
Rally provides AI-powered features under the brand name "Sidekick." Sidekick assists operators with day-to-day work — drafting emails and SMS replies, surfacing scheduling conflicts and proactive nudges, generating proposals, providing business insights, powering natural-language search, and guiding onboarding and feature discovery.
Data Sidekick may access
To deliver these features, Sidekick may access and process content stored in your operator account, including:
- Contact information for your clients (name, email, phone, address);
- Booking details (event date, location, guest count, services chosen, special requests);
- Free-text notes you write about clients;
- Message threads between you, your clients, and your crew (SMS and email);
- Aggregated payment and revenue data, used only to generate business insights for the operator;
- Catalog content and brand voice data, used to generate proposals;
- Account configuration and usage patterns, used for onboarding and feature discovery.
Each Sidekick module accesses only the data it needs to perform its task, and all access is scoped to the operator's own account.
Our default AI subprocessor
By default, Sidekick features are powered by Anthropic's Claude API. When you use a Sidekick feature under Rally's default configuration, the relevant context — which may include client personal information such as names, contact details, booking content, and message content — is transmitted from Rally's backend to Anthropic's API for processing, and the response is returned to Rally.
Under Anthropic's commercial API terms, API inputs and outputs are not used to train Anthropic's models. Anthropic retains API inputs and outputs for a limited period for abuse monitoring and trust-and-safety purposes, in accordance with its own published policies, and we do not direct or control that retention beyond our agreement with them.
Operator-supplied AI providers (BYO API key)
Operators may, at their option, configure their own API keys to power Sidekick features. To preserve the no-training posture that applies to Rally's default configuration, BYO is restricted to a curated allowlist of providers whose API-tier or commercial terms contractually exclude customer data from model training.
The approved allowlist is:
- Anthropic API — standard Anthropic API keys. API inputs and outputs are not used to train Anthropic models. Currently accepted.
- OpenAI API — standard OpenAI API keys. Under OpenAI's API terms, API inputs and outputs are not used to train OpenAI models. Approved but not yet enabled; these keys are rejected until platform support ships.
- Google Vertex AI — service account credentials only. Under Vertex AI's commercial terms, customer data is not used to train Google's foundation models. Approved but not yet enabled; these credentials are rejected until platform support ships.
Other providers and tiers — including Google AI Studio (Gemini Developer API) keys, free-tier credentials from any provider, and consumer chat-app credentials — are not accepted, because their terms either permit or do not contractually exclude the use of submitted data for model improvement. Rally validates each BYO key against the allowlist when it is saved, and re-validates on any subsequent edit.
When an operator enables a BYO API key, Sidekick may transmit data — which may include client personal information — to that provider instead of, or in addition to, Rally's default Anthropic subprocessor. The operator's relationship with the chosen provider is governed by the operator's own agreement with that provider; Rally is not a party to that agreement and does not access the operator's account with the provider. Retention windows vary by provider and are governed by that agreement.
Rally reviews the allowlist on a regular basis. If a provider materially changes its API-tier training or retention policy, Rally may remove that provider from the allowlist on a forward-looking basis, which will prevent new BYO keys for that provider from being saved.
No training on your data
Rally does not train any AI model on operator or client data, and does not authorize its default AI subprocessor or any BYO provider on the allowlist to do so. For Rally's default subprocessor (Anthropic), and for every provider on the allowlist, the no-training posture is enforced through that provider's published API-tier or commercial terms.
What Rally logs about AI usage
Rally records usage metadata for each AI call — the account, the user, the feature invoked, the model used, token counts, response latency, and the computed cost of the call. This applies to every AI feature, not only the Sidekick assistant. Rally does not store the prompt content or the model's response content in its AI usage logs. This metadata is used for cost accounting, billing (which applies only to the Sidekick assistant — see our Terms of Service), quota enforcement, abuse prevention, and quality monitoring.
Human review and no automated decision-making
Sidekick assists operators; it does not act autonomously. AI-generated drafts (emails, SMS, proposals, insights) are presented for operator review before any action is taken on a client's behalf. Rally does not use AI to make automated decisions that produce legal or similarly significant effects regarding any individual.
MCP and third-party AI client connections
Operators may opt in to connect third-party AI clients (such as Claude.ai, or other Model Context Protocol clients) to their Rally account. Once connected, these clients can read account data and perform certain actions on the operator's behalf; actions that send messages, create bookings, or process refunds require an explicit confirmation step. Operators are responsible for managing these connections and for any actions taken through them. Once data leaves Rally through a connected third-party AI client, it is governed by the terms and privacy policies of that client, which Rally does not control.
AI accuracy
AI-generated content may be inaccurate, incomplete, or unsuitable for a particular situation. Operators are solely responsible for reviewing AI output before sending it to a client or relying on it. See our Terms of Service for additional limitations.
Tenant Isolation and Access Model
Rally is a strictly multi-tenant platform. Every database query is scoped to the authenticated operator's account, derived from the user's session and never from user-supplied input. Operators cannot access data belonging to other operators' accounts.
Within an operator account, role-based permissions limit what owners, admins, staff, and crew can see and do. Clients of an operator can access only their own bookings and portal data, via emailed magic links tied to a specific booking; they do not have cross-client visibility.
Ad Conversion Tracking (Operator-Enabled)
Rally offers an optional integration that lets an operator connect their own advertising accounts — currently Meta (Facebook and Instagram), Google Ads, and TikTok — so the operator can measure which of their ads produced real bookings.
When an operator enables this integration, Rally sends server-side conversion events to the ad platform using the operator's own credentials and on the operator's behalf. These events may include a client's email address and phone number in hashed form, which is how ad platforms match a conversion to a user without receiving the raw value.
This integration is off unless the operator turns it on. The operator chooses the platforms, supplies the credentials, and is responsible for having an appropriate legal basis and any required disclosures or consent for sharing client data with those platforms. Rally does not use the operator's client data to build audiences for its own advertising.
Rally's Own Advertising and Audience Targeting
Separately from the operator integration above, and in connection with marketing Rally itself:
We may use customer information — including name, email address, and phone number — in hashed, anonymized form to create and target advertising audiences through platforms such as Meta (Facebook and Instagram) and TikTok. This process allows these platforms to match hashed data against their own user profiles for the purpose of building lookalike audiences and delivering relevant advertising.
We may monetize aggregated, anonymized audience data through advertising products and services. This data does not contain personally identifiable information and cannot be used to identify individual users.
We do not sell raw personal information — such as your name, email, or phone number — directly to advertisers or third parties for their independent use.
Cookies and Tracking Technologies
We use cookies and similar technologies to collect information about how you interact with our website and services. This currently includes:
- Essential cookies — required for the platform to function, including authentication and session management;
- Product analytics — PostHog, to understand usage patterns within the application;
- Error monitoring — Sentry, to capture and diagnose application errors.
We may also deploy advertising and conversion-measurement technologies (such as the Meta or TikTok pixel) on our marketing pages in connection with Rally's own advertising, as described in the section above. Where we do so, those technologies are covered by this policy.
You can control cookie preferences through your browser settings. Note that disabling certain cookies may affect platform functionality.
Electronic Signatures
When you sign a document through a Rally signing link (such as a service agreement or waiver), your signature, name, and timestamp are recorded and stored as part of the document record. This information is retained for the duration of the associated business relationship.
Client Portal
Clients of Rally operators may access a self-service portal to view bookings, make payments, sign documents, and communicate with operators. Access is granted via magic link sent to the client's email and tied to a specific booking. Portal activity — including page views, payments made, and documents signed — is logged and visible to the operator.
Crew and Staff
Staff members added to the platform by operators have a limited-access crew portal. Operators provide staff names, emails, and phone numbers. Staff members may submit availability, view assigned events, and log event activity through the crew portal.
Security of Your Personal Information
When we collect and process personal information, and while we retain this information, we will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use, or modification.
Although we will do our best to protect the personal information you provide to us, we advise that no method of electronic transmission or storage is 100% secure and no one can guarantee absolute data security.
You are responsible for selecting any password and its overall security strength, and for the security of your own account credentials.
How Long We Keep Your Personal Information
We keep your personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it to meet a legal, accounting, tax, or reporting obligation. When information is no longer required for a purpose, we will delete it or make it anonymous by removing the details that identify you.
Retention practices
The periods below describe how long we intend to keep each category of data. They reflect our legal obligations and business need. Deletion of expired records is currently performed on request and through periodic review rather than by an automatic schedule, so records may persist beyond the stated period until they are reviewed. You may request deletion at any time as described below, and we will honor that request subject to any legal retention obligations.
- Account and profile data — kept for the life of the account; removed within 30 days of an account deletion request, subject to legal retention obligations.
- Booking and event records — kept for approximately 3 years after the event date.
- Payment and transaction records — kept for 7 years, to comply with IRS and accounting requirements.
- Signed documents and waivers — kept for 7 years, or as required by applicable law.
- Communication and message records (SMS and email threads) — kept for approximately 2 years.
- AI usage logs — metadata only (feature, model, token counts, latency, computed cost). No prompt or response content is stored. Kept for operational and billing history.
- Analytics and error-monitoring data — kept according to the retention settings of our analytics and error-monitoring providers.
- Aggregated and anonymized data — may be kept indefinitely, as it cannot be used to identify individuals.
Children's Privacy
We do not aim any of our products or services directly at children under the age of 13 and we do not knowingly collect personal information about children under 13.
Where clients provide information about minors in connection with event bookings, such information is submitted by the adult client and is used solely for event coordination purposes.
Disclosure of Personal Information to Third Parties
We may disclose personal information to:
- a parent, subsidiary, or affiliate of our company;
- third-party service providers, including IT and hosting providers, data storage, error loggers, analytics providers, marketing or advertising providers, professional advisors, and payment systems operators;
- our employees, contractors, and related entities;
- our existing or potential agents or business partners;
- courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or to establish, exercise, or defend our legal rights;
- an entity that buys, or to which we transfer, all or substantially all of our assets and business.
Third parties we currently use are listed in the Sub-Processors section below.
Text Message Communications
Most SMS on the platform is sent by an operator, from the operator's own connected phone number (through a provider such as OpenPhone or Twilio), to that operator's own clients and crew. These messages relate to bookings, scheduling, and event coordination. Message frequency varies. Reply STOP to opt out; opt-out requests are honored by the underlying messaging provider and by the mobile carriers.
When you contact us by text message (SMS), we may collect your personal information, including your mobile phone number and the content of your message. We use this information solely to communicate with you regarding our services and respond to related inquiries.
We do not share mobile phone numbers, text messaging originator data, or text messaging consent data with third parties or affiliates, excluding aggregators and providers of the text message services.
Your Rights and Controlling Your Personal Information
Your choice. By providing personal information to us, you understand we will collect, hold, use, and disclose your personal information in accordance with this privacy policy. You do not have to provide personal information to us; however, doing so may affect your use of our website or services.
Information from third parties. If we receive personal information about you from a third party, we will protect it as set out in this privacy policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person's consent to provide the personal information to us.
Marketing permission. If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by contacting us using the details below.
Access. You may request details of the personal information that we hold about you.
Correction. If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, please contact us using the details provided in this privacy policy.
Non-discrimination. We will not discriminate against you for exercising any of your rights over your personal information.
Notification of data breaches. We will comply with laws applicable to us in respect of any data breach.
Complaints. If you believe that we have breached a relevant data protection law and wish to make a complaint, please contact us using the details below.
Opt out of communications. You may opt out of receiving marketing communications from us at any time, by clicking the "unsubscribe" link in any marketing email, replying "STOP" to any SMS message, or contacting us directly.
Operator Responsibility for Client Data
Rally provides a platform that operators use to manage their own clients and business operations. In this context:
Operators are data controllers. Operators who use Rally to collect, store, and process their clients' personal information are responsible for ensuring they have the appropriate legal basis for doing so, and that their own privacy practices comply with applicable law.
Rally is a data processor. We process client data on behalf of operators as directed by their use of the platform. We do not use operator client data for our own purposes beyond what is necessary to provide the service, except where data is aggregated and anonymized.
AI processing of client data. When operators use Sidekick features, client personal information (including names, contact details, booking content, and message content) may be transmitted to Rally's default AI subprocessor (Anthropic) for processing, or, if the operator has configured a BYO API key, to the operator's selected third-party AI provider, as described in the AI Features section. Operators are responsible for informing their own clients that AI may be used to process their information in connection with the operator's business, to the extent required by applicable law.
Ad conversion tracking. If an operator enables the ad conversion tracking integration, hashed client contact data is transmitted to the operator's own ad platforms under the operator's credentials. The operator is responsible for any disclosure or consent this requires.
Client requests. Clients should direct any data access, correction, or deletion requests to the operator. Rally will support operators in fulfilling these requests for data stored in the operator's tenant.
If you are a client of a Rally operator and have questions about how your data is used by that operator, please contact the operator directly.
Sub-Processors
We use third-party sub-processors to help deliver our services. These companies process personal data on our behalf and are bound by data processing agreements or by their standard terms, which require them to protect your data in accordance with applicable law.
Current sub-processors include:
- Vercel — application hosting and infrastructure (United States).
- Neon — PostgreSQL database hosting (United States).
- Upstash / Vercel KV — Redis used for event delivery and rate limiting (United States).
- Stripe — payment processing and identity verification (United States). Operators using Rally Payments transact through Stripe Connect.
- Anthropic — Rally's default AI provider for Sidekick features (United States). Under Anthropic's commercial API terms, API inputs and outputs are not used to train Anthropic models.
- Resend — transactional email delivery (United States).
- OpenPhone — SMS messaging delivery (United States), where an operator connects an OpenPhone number.
- Twilio — SMS messaging delivery (United States), where Twilio is used as the messaging provider.
- Cloudflare R2 — file and document storage (United States).
- Google Maps — address autocomplete and routing (United States).
- Google OAuth — optional sign-in with a Google account (United States).
- GitHub — support tickets and bug reports submitted through the platform are synchronized to a private issue tracker (United States).
- Sentry — error monitoring (United States). Optional; PII is scrubbed where feasible.
- PostHog — product analytics (United States). Optional.
We will update this list when sub-processors are added or removed. Continued use of Rally after such updates constitutes acceptance of the revised list.
Operator-supplied AI providers (BYO API key). Operators may configure their own API key for a curated allowlist of approved third-party AI providers (Anthropic API, OpenAI API, and Google Vertex AI; currently only Anthropic keys are accepted, and Vertex requires service account credentials). When BYO is used, the operator's chosen provider is not a Rally sub-processor; the operator's relationship with the provider is governed by the operator's own terms with that provider, and Rally transmits data to that provider only as directed by the operator's configuration. Keys from outside the allowlist are rejected at registration.
Operator-supplied ad platforms. Where an operator enables ad conversion tracking, the ad platforms they connect (Meta, Google Ads, TikTok) receive data under the operator's own credentials and are not Rally sub-processors for that purpose.
International Data Transfers
Rally is operated from the United States. Our infrastructure, including hosting and database services, is located in the United States. If you are accessing our platform from outside the United States, please be aware that your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.
By using our platform, you consent to the transfer of your personal information to the United States. We take steps to ensure that any such transfers are handled securely and in accordance with this privacy policy.
Account Deletion
Operators may request deletion of their account at any time by contacting us at support@runonrally.com. Upon deletion:
- Your account profile and settings will be permanently removed;
- Client and booking data associated with your account will be deleted, subject to any legal retention obligations;
- Payment and transaction records may be retained for up to 7 years to comply with tax and accounting requirements;
- Signed documents and agreements may be retained for the duration required by applicable law.
Please allow up to 30 days for deletion to be fully processed across all systems. Certain anonymized or aggregated data may be retained indefinitely as it cannot be used to identify you.
Business Transfers
If we or our assets are acquired, or in the unlikely event that we go out of business or enter bankruptcy, we would include data, including your personal information, among the assets transferred to any parties who acquire us. You acknowledge that such transfers may occur, and that any parties who acquire us may, to the extent permitted by applicable law, continue to use your personal information according to this policy.
Limits of Our Policy
Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.
Changes to This Policy
At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or legislative or regulatory changes. If we decide to change this privacy policy, we will post the changes here at the same link by which you are accessing this privacy policy.
If the changes are significant, or if required by applicable law, we will contact you with the new details and links to the updated or changed policy.
Additional Disclosures for U.S. State Privacy Law Compliance
The following provisions comply with the privacy laws of California, Colorado, Delaware, Florida, Virginia, and Utah and apply only to residents of those states. Specific references to a particular state apply only to that state's residents. Non-state-specific language applies to all of the states listed.
Do Not Track
Some browsers have a "Do Not Track" feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not respond to browser "Do Not Track" signals.
California Notice of Collection
In the past 12 months, we have collected the following categories of personal information enumerated in the CCPA:
- Identifiers, such as name, email address, phone number, account name, IP address, and an ID or number assigned to your account;
- Customer records, such as billing address and payment card metadata;
- Commercial information, such as products or services history and purchases;
- Internet activity, such as your interactions with our service;
- Audio or visual data, such as photos or videos you share with us or post on the service;
- Inferences, such as information about your interests, preferences, and favorites.
Right to Know and Delete
You have rights to delete your personal information we collected and to know certain information about our data practices in the preceding 12 months. To exercise any of these rights, please contact us using the details below.
Contact Us
For any questions or concerns regarding your privacy, you may contact us at:
Rally Privacy Team RALLY BOOKING LLC support@runonrally.com