Privacy Notice

Last updated: June 2026

This Privacy Notice explains how Rally Getaway ("Rally Getaway", "we", "us") collects, uses, stores, and shares personal data when you use our website and services (the "Service"). Rally Getaway is the seller's legal business name for the Service and our public-facing seller name.

1. Who we are

Rally Getaway is the seller of the Service and acts as the data controller of personal data we collect from you. References to "Rally" elsewhere on the site refer to the legal seller Rally Getaway. You can contact us at hello@rallygetaway.com.

2. Personal data we collect

• Account data: name, email address, login credentials, chapter name, school.
• Trip planning data: destinations, headcounts, dates, vendor selections, notes, and outreach messages you send through the Service.
• Communications: support messages, the name and reply-to address used when we send outreach emails to vendors on your behalf.
• Technical data: device, browser, IP address, log data, and usage telemetry needed to operate and secure the Service.
• Cookies / local storage: essential cookies and browser localStorage entries used to keep you signed in and to save trip planning progress.

Payment card details are collected directly by Paddle (see Section 5) and are not stored on our systems.

3. Purposes and legal bases

• To provide the Service (account creation, planning tools, vendor outreach) — performance of our contract with you.
• To process subscriptions and payments — performance of our contract with you, executed through Paddle as Merchant of Record.
• To secure the Service and prevent fraud or abuse — our legitimate interests in protecting the Service and our users.
• To improve the Service (aggregate usage analysis, debugging) — our legitimate interests in operating and improving the Service.
• To send service-related communications (transactional email about your account, receipts, security notices) — performance of our contract with you and our legitimate interests.
• To comply with legal obligations (tax, accounting, responding to lawful requests) — legal obligation.

4. Email communications you send

When you use Rally Getaway' vendor outreach feature, emails are sent to vendors on your behalf using your name and reply-to email address. Vendors will see your name and can reply directly to you. You are responsible for the content of those messages.

5. Sharing personal data

We share personal data with the following categories of recipients:

• Paddle.com Market Limited ("Paddle") — our payment provider and Merchant of Record for all orders. Paddle handles checkout, subscription management, billing, tax compliance, invoicing, returns, and customer service inquiries related to purchases. Paddle's privacy policy is available at paddle.com/legal/privacy.
• Service providers / subprocessors: hosting, database, authentication, email delivery, and similar tooling needed to operate the Service.
• Vendors you contact: when you send an outreach email, your name, reply-to address, and message contents are shared with the vendor you selected.
• Professional advisers: legal, accounting, and similar advisers, under duties of confidentiality.
• Authorities: where required by law, court order, or to protect our rights or the rights of others.

We do not sell your personal data.

6. International transfers

Some of our service providers, including Paddle, operate outside your country of residence. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

7. Data retention

We keep personal data only as long as needed for the purposes described above:

• Account and profile data: while your account is active and for up to 24 months after deletion, to handle disputes and meet our legal obligations.
• Trip planning data and outreach messages: while your account is active; deleted on request unless we are required to retain it.
• Billing and tax records (held by us or by Paddle as MoR): up to 7 years, as required by tax and accounting law.
• Support and security logs: typically up to 24 months.

When data is no longer needed we delete or anonymise it.

8. Your rights

Subject to applicable law (including, where relevant, GDPR and the UK GDPR), you have the right to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. You can also lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@rallygetaway.com. We will respond within one month.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), encryption at rest for our database, role-based access controls, row-level security, audit logging, and limiting access to personal data to staff who need it. No system is perfectly secure, but we work to keep risks as low as reasonably possible.

10. Cookies

We use only essential cookies and localStorage entries needed to keep you signed in and to save your trip planning progress. We do not use advertising or cross-site tracking cookies. You can clear cookies and local storage in your browser settings at any time; doing so may sign you out and clear unsaved planning data.

11. Changes to this notice

We may update this Privacy Notice from time to time. The "Last updated" date at the top shows when it was last changed. Material changes will be communicated through the Service.

12. Contact

Questions about this notice or your personal data? Email Rally Getaway at hello@rallygetaway.com.