Privacy Policy

This Privacy Policy explains what personal information ralli collects, why we collect it, and the choices you have. We are the data controller for personal data processed through the platform.

1. Information we collect

• Account data: name, email, password hash, profile photo, role.
• Athlete data: bio, sport, location, evidence of milestones, KYC verification status.
• Payment data: handled by Stripe; we receive transaction metadata only, never full card numbers.
• Usage data: pages visited, allocations made, device and browser info, IP address.

2. How we use it

To operate memberships, route contributions to athletes, send transactional emails, prevent fraud, satisfy legal obligations, and improve the platform.

3. Sharing

We share data with service providers under contract: Stripe (payments & KYC), Supabase (database & auth), Mailgun (email delivery), and Cloudflare (hosting). We do not sell personal data.

4. Athlete public profile

When an athlete is approved, their name, photo, bio, sport, and milestones become public. Sensitive fields (bank, KYC documents, payouts) are never published.

5. Retention

We retain account data while your account is active and for up to 7 years after closure to meet accounting and regulatory obligations. You may request earlier deletion subject to those obligations.

6. Your rights

Depending on your jurisdiction you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. Contact us at privacy@rallihq.co to exercise these rights.

7. Cookies

We use essential cookies for authentication and a small number of analytics cookies to understand product usage. You can disable non-essential cookies in your browser.

8. International transfers

Our service providers operate globally. Where data is transferred outside your country, we rely on standard contractual clauses or equivalent safeguards.

9. Children

ralli accounts must be created and managed by people 13 or older. For youth athletes aged 7–17, we collect only the personal data necessary to provide the service, and only with verified consent from a parent or legal guardian. The parent or guardian may access, correct, or request deletion of their child's data at any time by contacting us at privacy@rallihq.co.

10. Contact

Privacy questions can be sent to privacy@rallihq.co.