This Privacy Policy explains how rallyp0int ("rallyp0int", "we", "us" or "our") collects, uses and shares personal information when you use the rallyp0int app, the rallyp0int.com website and everything we offer through them (together, the "Services"). We handle personal information in line with the New Zealand Privacy Act 2020.
Words defined in our Terms of Service have the same meaning here. By using the Services you acknowledge that your information is handled as this policy describes.
1Information We Collect
"Personal information" means information about an identifiable person.
- Information you give us:
- Account information: your name, email address, password or sign-in method, and other details you give when you sign up.
- Profile information: anything you add to your profile, such as a phone number, age, location and profile photos.
- Host information: if you host events, your host name, city, any social media handle or photo you add, and the mobile phone number you confirm by a one-time code.
- Ticket and payment information: the tickets you get (event, tier, price, booking fee, time of purchase), the attendee name you put on each ticket, and whether each one has been scanned or refunded. Card payments are handled by Stripe: your card number goes to Stripe, not to us, and we keep only a reference to the payment and the email address your receipt is sent to.
- Ticket transfers: if you send a ticket to someone, the username or email address you send it to, and when it was sent, accepted, declined, cancelled or expired. If someone sends a ticket to you, we keep the same record and who sent it.
- Payout information: if you sell paid tickets, you set up payouts with Stripe through a Stripe Connect Express account. Stripe collects the identity details it needs to verify you (such as your name, date of birth, address and, if Stripe asks for it, an identity document) and your bank account details, under Stripe's own privacy policy. We do not store your bank account number or identity documents; we keep your Stripe account identifier, whether Stripe has verified the account and enabled payouts, and a record of what you have earned and been paid. If we ever pay you by bank transfer ourselves instead, we store the bank details you give us encrypted.
- Purchases: details of subscriptions and other things you buy from us.
- Communications: your messages to us, such as support requests, feedback and reports.
- Content you post: posts, photos, videos, comments, events, messages and anything else you share on the Services.
- Information we collect automatically:
- Usage data: how you use the Services, such as the pages and screens you view, the features you use, your location if you allow it, and logs.
- Website and app analytics: on rallyp0int.com and in the rallyp0int app we record the pages and screens you view and what you do on them (for example opening an event, choosing tickets, starting checkout or playing a clip) with our own first-party analytics. We do not use third-party trackers or advertising cookies for this. Your browser or device keeps a random identifier that does not contain your name or email address; if you are signed in, these records are also linked to your account. We do not store your IP address with them, and we do not record what you type into searches or forms. On the website, if your browser sends a Do Not Track or Global Privacy Control signal, we do not collect them; in the app, you can ask us to stop by contacting admin@rallyp0int.com.
- Device information: your IP address, device type, operating system, browser and device identifiers.
- Cookies and similar technologies: we use cookies and similar technologies to keep you signed in, remember your settings, protect checkout from bots and understand how the Services are used.
- Information from others:
- Services you link to your rallyp0int account (for example, a social media account or signing in with Apple or Google), and fraud prevention services.
- If you set up payouts, Stripe tells us the status of your Stripe account (for example whether your details are complete and whether payouts are enabled, or why they are not).
2How We Use Your Information
- To run the Services: to operate, maintain and improve the Services, manage your account and give you support.
- Tickets and payouts: to sell and issue tickets, let you name them and send them to other people, check them at the door, process refunds, and pay hosts what they have earned (through Stripe).
- Safety and moderation: to review events before they go public, and to screen photos and videos for illegal or harmful content, using automated tools (Google Cloud Vision and Video Intelligence) and human review.
- Security and fraud prevention: to protect against fraud, bots, unauthorised transactions and other misuse.
- Communication: to send you tickets, receipts, transfer notices, security alerts and other messages about the Services.
- Personalisation: to recommend events, people and content you may like.
- Analytics: to understand how the Services are used and to improve them.
- First-party analytics: to count visits and see which pages, screens and features are used and where people get stuck, for example when buying tickets. We do not use these records for advertising.
- Marketing: to tell you about rallyp0int features and offers. You can opt out of marketing messages at any time.
- Legal: to meet our legal obligations, respond to lawful requests, and enforce our terms and policies.
3How We Share Your Information
We do not sell your personal information. We share it only as follows.
- With hosts and their door staff: when you buy or hold a ticket, the event's host and the co-hosts they appoint can see your first name, username, email address, the attendee name on the ticket, its tier, what was paid for it, and when it was bought, scanned or refunded, so they can run the event and contact you about it. The host's door staff can see the attendee name on the ticket, your username, the ticket tier and reference, and whether and when it was scanned, and can search the guest list by name or username; they cannot see your email address.
- With people you send tickets to: when you send a ticket, the person you send it to sees your first name, your username, the event and the ticket tier, even before they accept. When you receive one, the sender sees the username or email address they sent it to and whether you accepted it.
- With other users: your profile and the content you post are shown to other users according to your settings and the visibility you choose.
- With service providers: we share information with service providers who work on our behalf and may use it only for that work. They are: Stripe (card payments and refunds); Stripe Connect (host payouts: Stripe collects and verifies hosts' identity and bank details through Stripe Express accounts and pays hosts; see Payout information above); Google Cloud and Firebase (hosting, sign-in, phone-number checks, databases, file storage, push notifications, app usage analytics, and content screening with Cloud Vision and Video Intelligence); Sentry (error and performance reports from the app, website and our servers, which include device and browser details and, from the app and our servers, your account identifier, but not your name or email address; we do not record screen sessions); MapTiler (maps and address search on the website, which receives the addresses you search for); Cloudflare Turnstile (a security check at checkout and in ticket waiting rooms that tells people from bots, which receives your IP address and browser details); Resend (sending our emails, such as tickets, receipts and transfer notices, which receives your email address and the email's contents); and RevenueCat (managing subscriptions bought in the app through the App Store, which receives your account identifier and purchase history).
- For legal reasons: if the law requires it, in response to a court order or other legal process, or where we believe in good faith that it is needed to protect our rights or property or anyone's safety.
- Business transfers: as part of a merger, sale of assets, financing or acquisition of all or part of our business.
- With your consent: for any other purpose you agree to.
- Aggregated or de-identified data: information that cannot reasonably be used to identify you.
4How Long We Keep Information
We keep personal information only for as long as we need it for the purposes in this policy, including to meet legal, accounting and reporting requirements. In deciding how long, we consider the amount, nature and sensitivity of the information, the risk of harm from misuse, whether we can achieve our purposes another way, and the law.
For example, we keep records of ticket sales, refunds and payouts for as long as tax and accounting law requires, even after an account is closed. We no longer ask hosts for identity documents; any documents sent to us under our earlier host verification process are deleted 90 days after their review.
5Your Rights
You can ask to see the personal information we hold about you and ask us to correct it. Depending on where you live, you may also have the right to:
- ask us to delete your personal information, subject to legal exceptions;
- ask us to restrict or stop certain processing;
- receive your information in a structured, machine-readable format;
- withdraw consent you have given, without affecting processing that has already happened.
To make a request, contact us using the details in section 9. We may need to confirm your identity first. If you are not happy with our response, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz) or the data protection authority where you live.
6Security
We use reasonable safeguards to protect personal information from loss and from unauthorised access, use, change and disclosure. Information is encrypted in transit, access to it is restricted, and hosts' bank details, where we hold them, are encrypted. No system is completely secure, so please keep your password private and tell us if you think your account has been misused.
7International Transfers
We are based in New Zealand, but our servers and most of our service providers are overseas. Our main data is hosted by Google Cloud in the United States, and error reports are stored by Sentry in the European Union. When we send personal information overseas, we take reasonable steps to make sure it is protected in a way comparable to the New Zealand Privacy Act 2020.
8Changes to This Policy
We will post any changes to this policy on this page and update the Effective Date. If a change materially affects how we handle your personal information, we will also tell you in the app or by email. Please keep your email address up to date so we can reach you.
9Contact Us
For questions about this policy or your personal information, or to make a privacy request, email admin@rallyp0int.com.