Privacy Policy

Rally Business, operated by Wait Watch LLC (“Rally,” “we,” “us,” or “our”), provides the Rally Business mobile application (the “Business App”), which lets venue owners and staff claim, verify, and manage their venue’s presence on Rally. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Business App. It is separate from the privacy policy for the consumer Rally app, which covers a different audience and a different set of data practices.

By using the Business App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Business App.

1. Eligibility

The Business App is intended for venue owners and staff and is limited to users 18 and older. By claiming a venue, you represent that you are an owner, manager, or staff member genuinely authorized to manage that venue’s presence on Rally.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you create an account with an email address and password, we collect that email address and a securely hashed form of your password. When you sign in using Apple Sign-In or Google instead, we receive your name and email address as provided by those services.
• Venue Claim Information: When you claim a venue, we collect your role at the venue (owner, manager, or staff), a contact phone number, and how you heard about Rally.
• Precise Location (Venue Claim Only): When you add or claim a venue, you may use a one-time GPS lookup to drop the venue’s pin on the map and auto-fill its address. This is a single, on-demand location read at the moment you use it — we do not continuously or passively track your location in the Business App.
• Identity and Business Verification: To verify that you are authorized to represent a venue, we route you through a Stripe-hosted verification flow that collects your legal business name, EIN, business address, bank account details, and a representative identity document. This information is collected and stored directly by Stripe; Rally does not receive or store your bank account number or identity document. We may also conduct manual review of new venues before approving a claim.
• Venue Content: The details you manage for a venue — name, type, address, coordinates, hours, phone number, branding, specials, and the wait-time updates you post.
• Venue Photos: Photos you upload for a venue you manage, selected through the iOS system photo picker. We receive only the specific image(s) you choose and do not receive access to your broader photo library.
• Payment Information: If you subscribe to Rally Visibility or bid in Featured Bidding, your payment method is collected and stored directly by Stripe. Rally does not store your card number.

2.2 Information Collected Automatically

• Push Notification Device Token: If you enable push notifications, we collect your device’s push notification token so we can alert you to new low ratings on a venue you manage and when you’ve been outbid in Featured Bidding. The token is removed from our systems when you sign out.
• Consumer Interaction Data for Your Venue: We aggregate consumer activity related to your venue — such as impressions, views, wait-time report volume, and conversions — and show it to you as analytics. See Section 4.2 below for what this does and does not include.

2.3 Information We Do Not Collect

• We do not access your contacts, camera, microphone, or general photo library.
• We do not use an analytics SDK in the Business App and do not collect usage-tracking events beyond the device token described above.
• We do not store full card numbers or bank account numbers — payment and identity-verification data is collected and held directly by Stripe.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Business App and its features
• Verify that you are authorized to claim and manage a venue, including through Stripe-hosted identity verification and manual review
• Publish the venue content you manage (hours, wait times, specials, branding) to the consumer Rally app
• Process subscription billing (Rally Visibility) and Featured Bidding auction charges through Stripe
• Show you aggregated analytics about consumer interactions with your venue
• Maintain the security of the Business App and detect fraudulent venue claims or abuse
• Communicate with you about your account or venue if necessary

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We share your information only in the following limited circumstances:

4.1 Service Providers

• Supabase: Our backend infrastructure provider, which hosts our database, authentication, file storage, and edge-function services on servers located in the United States (US East). See Supabase’s Privacy Policy.
• Stripe: Our payment and identity-verification provider, which processes Rally Visibility subscription billing, Featured Bidding auction charges, and business/identity verification during venue claiming. Stripe collects and stores your payment details, business information, and verification documents directly; Rally receives only a confirmation of your verification and billing status. See Stripe’s Privacy Policy.
• Grovs: When you share or scan a Rally Business team-invite link or venue-claim link, our deferred deep-linking provider Grovs processes technical data (such as device and network information) to connect the install or app open to the correct invite or claim code. See Grovs’s Privacy Policy.
• OpenAI: We use OpenAI’s moderation API to automatically screen uploaded photos and posted text (venue updates, specials) for policy violations before they are shown to consumers. See OpenAI’s Privacy Policy.
• Apple and Google: When you choose to sign in with Apple or Google, they handle authentication and provide us with your name and email; in that case we never receive their account passwords. See Apple’s Privacy Policy and Google’s Privacy Policy.

4.2 Consumer Interaction Data Shown to You

• Individual ratings and written feedback submitted by consumers for a venue you manage are visible to you, including the consumer’s username. Low ratings may trigger a notification to you.
• Beyond ratings and feedback, we show you only aggregated analytics about your venue — such as impressions, views, wait-time report volume, and conversions. We do not show you individual consumers’ identities, precise locations, email addresses, or dates of birth.

4.3 Venue Content

Venue information you manage through the Business App (name, hours, wait times, specials, branding, photos you choose to publish) is shown publicly within the consumer Rally app by design.

4.4 Legal Requirements

We may disclose your information if required to do so by law, or in the good-faith belief that such action is necessary to comply with a legal obligation, protect our rights or safety, or investigate potential violations.

5. Data Retention

• Account Data: We retain your account information for as long as your account is active. If you delete your account, we permanently delete your personal account data (see Section 7).
• Venue Data: Venue content you manage is retained for as long as the venue is claimed and active on Rally.
• Payment and Verification Records: Billing and identity-verification records are retained by Stripe according to their retention policies and applicable financial recordkeeping requirements.
• Push Notification Device Token: Your device token is retained while you are signed in and deleted when you sign out.

6. Data Security

We implement industry-standard security measures to protect your data, including:

• All data transmitted between the Business App and our servers is encrypted using TLS/SSL.
• Database access is protected by Row Level Security (RLS) policies ensuring you can only access venues you manage.
• Payment and identity-verification data is handled directly by Stripe under its industry-standard, PCI-DSS-compliant security controls; we do not store your card number or bank account number.
• Authentication is handled by our authentication provider using industry-standard flows — passwords are stored only as secure hashes, and Apple/Google sign-in uses OpenID Connect with nonce-based replay protection.
• Uploaded images are size- and type-restricted at the storage layer.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

7.1 Account Deletion

You can request deletion of your operator account at any time by contacting us at masonpfitz@gmail.com. Deleting your account removes your personal account data and revokes your management access to any venues. Consumer-generated content about your venue (wait time reports, ratings, and feedback) belongs to the consumers who submitted it and is not affected by your account deletion.

7.2 Push Notifications

You can manage notification preferences through your device’s Settings at any time.

7.3 Billing and Subscriptions

You can manage or cancel your Rally Visibility subscription and view Featured Bidding charges at any time from the Business App or through Stripe. Canceling a subscription stops future renewals but does not refund the current billing period.

7.4 Data Access and Portability

You may request a copy of the personal data we hold about you by contacting us at masonpfitz@gmail.com. We will respond within 30 days.

8. California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose about you
• Request deletion of your personal information
• Opt out of the sale of your personal information (we do not sell your information)
• Not be discriminated against for exercising your privacy rights

To exercise these rights, contact us at masonpfitz@gmail.com.

9. International Users

The Business App is operated from and our servers are located in the United States. If you are accessing the Business App from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. By using the Business App, you consent to this transfer.

10. Third-Party Links

The Business App may contain links to third-party websites or services (for example, Stripe’s hosted onboarding or billing pages). We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party services you access.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the “Last Updated” date at the top of this page. Your continued use of the Business App after changes are posted constitutes your acceptance of the revised policy.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Florida, without regard to its conflict of law provisions.

13. Contact Us

If you have any questions about this Privacy Policy, your data, or your privacy rights, please contact us:

• Email: masonpfitz@gmail.com
• Entity: Wait Watch LLC (doing business as Rally)