Effective [DATE] · Version 1.0
Rally is run by [COMPANY LEGAL NAME], company number [COMPANY NUMBER], [REGISTERED ADDRESS]. We are the controller of the personal information described in this policy, which means we decide how and why it is used. We are registered with the UK Information Commissioner's Office under number [ICO REGISTRATION NUMBER].
You can contact us about privacy at [PRIVACY EMAIL] or by post at the address above. [If a data protection officer is appointed, add their contact details here.]
This policy covers the Rally website and app. It applies to everyone who uses Rally, including people who only browse events or join our waiting list.
| Type | What it includes |
|---|---|
| Account | Email address, phone number, password (stored only in scrambled, hashed form), first and last name, date of birth, gender, city and country. |
| Optional profile | Profile photo, display name and username. |
| Verification | Whether you have verified your email address and phone number, using one-time codes we send you. |
| Interests | The types of event, music genres, sports, artists and teams you choose. |
| Tickets | The events you join, and the kind of ticket you tell us you have (standing, seated or other) with any area, block or section you add. We do not ask for screenshots or order numbers, and we do not check tickets. |
| Group activity | Chat messages, meeting-spot votes, polls to add a member, whether you leave a group, and feedback and ratings after the event, including whether group mates say you did not turn up. Events you mark as interested. Messages you send with the Feedback button. |
| Safety | Reports you make or that are made about you (including the reason and details given), and the people you block. |
| Payments | A record of each fee: the amount, currency, date, the event, and the payment reference and status from Stripe. Stripe collects your card details and billing name and email; we receive only limited information such as the payment result. |
| Invites | Your invite link, who joined using it, and any free groupings you have earned. |
| Waiting list | If your city is not open yet: your email address and city, so we can tell you when we launch there. |
| Contact with us | What you tell us when you email us, complain or ask about your rights. |
| Settings | Your notification choices and your saved events (watchlist). |
We do not collect your precise location. Rally does not ask your device for your location, camera or microphone.
UK data protection law requires a lawful basis for each use of personal information. Ours are set out below.
| What we do | Lawful basis |
|---|---|
| Create and run your account, verify your email and phone, and sign you in | Contract: we need it to provide Rally |
| Check that you are 18 or over | Contract, and legitimate interests in keeping under-18s off the service |
| Match you into groups using the event, your age, interests and gender (section 4) | Contract: matching is the service you ask for |
| Use the kind of ticket you tell us, and any area or section, to put you with people sitting or standing near you | Contract |
| Run your group: chat, votes, polls and meeting spot | Contract |
| Take payments, issue refunds and keep financial records | Contract, and legal obligation (tax and accounting) |
| Send you messages about your account, group and events | Contract |
| Filter chat messages, review reports, act on blocks, and prevent fraud, fake accounts and abuse | Legitimate interests in keeping members safe, and legal obligation under online safety law |
| Run the invite scheme and free groupings | Contract |
| Tell you when Rally opens in your city (waiting list) | Consent, which you can withdraw at any time |
| Keep groups reliable: when two group mates say someone did not turn up, we record a missed night on that account for 180 days. Two missed nights means we only place them in a group with a Rally host; three means they cannot join new groups for 180 days | Legitimate interests in groups where people turn up, and in the safety and experience of other members |
| Use your feedback and how Rally is used to improve matching and the service | Legitimate interests in improving Rally. Where we can, we use information that does not identify you |
| Keep Rally secure, using logs and rate limits | Legitimate interests in protecting Rally and its members |
| Respond to legal requests, enforce our terms, and bring or defend legal claims | Legal obligation, and legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights, and you can object (see section 12). You can ask us for more detail about that assessment.
We do not use your information for advertising, and we do not sell it.
Matching you into a group is a form of profiling. To build a group for an event, our system looks at:
We also show you how well events suit your interests, and how many people are going to an event (as a total, without names).
Matching decides who is in your group. It does not have a legal effect on you or a similarly significant effect, and we do not use it to decide anything else about you. Decisions to remove someone from a group, or to suspend or close an account, are made by people on our team. If you disagree with a decision, you can ask us to review it.
We do not ask for information about your health, religion, ethnicity, sexual orientation, political views or other sensitive matters. We do ask for your gender. We treat it carefully and use it only for matching as described above.
Some of your choices could suggest something sensitive about you, for example saving or joining LGBTQ+ events or events linked to a faith. We use that information only to show you events and match you for them, and not to make any assumption about you. If you would rather we did not hold it, do not add it as an interest, and you can remove it at any time.
Please do not share sensitive information about yourself or anyone else in group chats.
| Members of your group can see | Members can never see |
|---|---|
| Your first name or display name Your profile photo, if you add one Your age (not your date of birth) Whether you have added your ticket Your chat messages, votes and polls When you join or leave the group |
Your email address and phone number Your last name [confirm] Your date of birth Your payment details Who you have blocked or reported |
If someone asks to join a group, the group sees their first name or display name and age. Remember that anything you write in a group chat can be read, and could be copied, by the other members.
Some of our service providers store or access information outside the UK, mainly in the United States. When we transfer personal information from the UK, we make sure it is protected, by using a country the UK has found to have adequate protection, by relying on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or by using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards we use.
We keep information only as long as we need it for the purposes above, and then delete it or make it anonymous.
| Information | How long |
|---|---|
| Account and profile | While your account is open, then deleted within [30 days] of closing it |
| Your ticket type and area | Kept with your ticket record while your account is open. Closing your account deletes them. Screenshots and order numbers collected before 14 October 2026 have been deleted |
| Group chats, votes and polls | [90 days] after the event |
| Reports and messages that were reported or blocked | [2 years] after the report is closed, or longer if needed for a legal claim or police investigation |
| Blocks | While both accounts exist, so you are never grouped with that person again |
| Records of suspended or removed accounts | Up to [5 years], limited to what we need to stop that person creating a new account |
| Payment and refund records | 6 years after the end of the financial year, as required for tax and accounting |
| Feedback | [2 years], then kept only in anonymous form |
| Waiting list | Until we tell you we have launched in your city, or [24 months], whichever is sooner |
| Server logs | [30 days] |
| Backups | Deleted information may stay in encrypted backups for up to [35 days] before it is overwritten |
We only use cookies and storage that are strictly necessary to provide the service you have asked for, so we do not ask for cookie consent. We do not use analytics, advertising or tracking cookies. If we ever want to, we will ask for your consent first.
| Name | Set by | Purpose | How long |
|---|---|---|---|
rally_sid (cookie) | Rally | Keeps you signed in securely. It cannot be read by scripts on the page. | 30 days, or until you log out |
rally1 (local storage) | Rally | Remembers your settings, saved events, notifications and a copy of your tickets on your device so the app works quickly. It does not contain your password or sign-in token. | Until you log out or clear your browser data |
Stripe cookies (such as __stripe_mid and __stripe_sid) | Stripe | Prevent payment fraud and keep payments secure | Up to 1 year |
If you turn on notifications, your browser stores that permission. You can turn it off in your browser settings or in Account at any time. You can delete cookies and storage in your browser settings, but you will then be signed out.
We use encryption in transit (HTTPS), secure sign-in cookies, protections against cross-site attacks, limits on repeated sign-in attempts, and access controls so only staff who need information can see it. Passwords are stored in hashed form. Payment card data is handled by Stripe, which is certified to the PCI DSS standard.
No system is completely secure. If a security breach affects your personal information and puts you at risk, we will tell you and the relevant regulators as the law requires.
Under UK data protection law you have the right to:
To use any of these rights, email [PRIVACY EMAIL] from the address on your account. It is free. We may ask you to confirm who you are. We will reply within one month, or tell you within that time if we need longer (up to two further months for complex requests). Some rights have exceptions, for example we may need to keep safety reports or payment records, and we will explain if one applies.
If you are unhappy with how we have used your information, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
We send messages that are part of the service: verification codes, payment receipts, when your group is ready, chat messages, your meeting spot, changes to your event, and safety or account notices. We will only message you when it matters. You can choose push and email notifications in Account, but some account and safety messages will still be sent by email.
We do not send marketing messages unless you have agreed to receive them, and every marketing message will include a way to unsubscribe.
Rally is only for people aged 18 and over. We ask for your date of birth at sign-up and do not let anyone under 18 create an account. If we learn that someone under 18 has an account, we will close it and delete their information. If you think a child is using Rally, please tell us at [SAFETY EMAIL].
We may update this policy, for example when we add features or change service providers. If the changes are significant, we will tell you by email or in the app before they take effect. The date at the top shows when it was last changed.
Privacy questions and requests: [PRIVACY EMAIL]
Post: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]