Legal

Data Processing and Confidentiality Addendum

Version 1.8 · Effective November 10, 2026

Our written commitments on how RallyText processes and protects your data: used only to run and support the service, never sold or shared, and protected. Part of every plan; sign a copy if you need one for your records.

This addendum is part of the Terms and applies to every account. If your organization needs a signed copy, a head coach or team director can sign it in Settings → Security and download the PDF.

1. Who this is between

This addendum is between Frequency 42 LLC, which runs RallyText ("RallyText", "we"), and the team or organization using RallyText ("you"). It is part of the RallyText Terms of Service and applies to every RallyText account. It is free on every plan.

2. Scope

This addendum covers Customer Data: the information you and your members put into RallyText or that RallyText creates for you. That includes rosters, names, phone numbers, email addresses, messages and attachments, attendance and practice records, calendar events, and account and billing contact details.

"Customer Personal Data" means the personal information within Customer Data.

3. Processing Customer Personal Data

When RallyText processes Customer Personal Data on your behalf, you decide the purposes and means of that processing, and RallyText acts as your processor or service provider, as applicable law uses those terms.

We process Customer Personal Data only to provide the service, follow your documented instructions (including the settings and actions you choose in RallyText), comply with this addendum and the Terms, and meet legal obligations. If we believe an instruction violates applicable data protection law, we will tell you unless the law prevents us from doing so.

California privacy requirements. Where the California Consumer Privacy Act ("CCPA") applies, RallyText acts as a service provider for Customer Personal Data processed on your behalf. RallyText will not sell or share Customer Personal Data as those terms are defined by the CCPA. We will not retain, use, or disclose it for purposes outside the business relationship or the purposes described in this addendum, and we will not combine it with personal information obtained from other sources, except as permitted by applicable law. We will provide the level of privacy protection required of a service provider, notify you if we determine that we can no longer meet our obligations, and cooperate reasonably with steps you are legally entitled to take to verify compliance or to stop and remediate unauthorized processing.

4. Purpose-limited access

RallyText personnel access Customer Data only to:

• provide, run, and maintain the service;
• give support you ask for;
• investigate and fix problems, abuse, or security issues;
• review messages flagged by our safety and moderation checks; and
• meet legal obligations.

Access is limited to people who need it for these purposes.

5. No selling, renting, or advertising

We never sell or rent Customer Data and never use it for advertising. We disclose Customer Data only:

• to the service and infrastructure providers described in Section 9, as needed to run RallyText;
• to integrations, message recipients, or other recipients you authorize us to send it to; or
• when required by law.

If the law requires us to disclose your data, we will tell you first unless the law forbids it.

6. Confidentiality of personnel

Everyone at RallyText who can access Customer Data is bound to keep it confidential. Access is limited to the people who need it for the purposes in Section 4.

7. Logging

When RallyText staff open your dashboard to give support, the session is recorded in an internal, tamper-evident log: who opened it, which account, when it started and ended, and the IP address it came from. Support sessions end automatically after 60 minutes without activity or four hours in total. These logs are internal and are not shown in your dashboard.

8. Security

RallyText maintains technical and organizational safeguards for Customer Data, including:

• Connections to RallyText use TLS 1.2 or higher.
• Member phone numbers are encrypted at rest with a separate key for each team.
• Connection tokens for integrations you connect, such as Google Calendar and Planning Center, and webhook signing secrets are stored encrypted.
• Backups, including the database and uploaded files, are encrypted.
• Passwords are stored only as salted hashes, never in plain text.
• The database cannot be reached directly from the public internet.
• Two-factor sign-in is available on every account through authenticator app codes (TOTP) and passkeys.

More detail is available at rallytext.app/security.

9. Service and infrastructure providers

RallyText uses the following service and infrastructure providers to operate the service. The description below explains the role each provider plays and the Customer Data or network information that may pass through or be stored on its infrastructure:

• Telnyx: text message delivery (phone numbers and message text).
• Stripe: payments (billing name, email, and payment details).
• RackNerd: unmanaged infrastructure hosting. RallyText controls and operates the operating system, application, database, backups, encryption, and Customer Data stored on its RackNerd-hosted servers. RackNerd provides the underlying server and network infrastructure, including infrastructure used for the encrypted network tunnel that connects RallyText to its own AI servers.
• Google Workspace: email (email addresses and the emails we send you).
• Cloudflare: network security and delivery for all traffic to RallyText, including pages, sign-ins and messages in transit, and bot protection on public forms (IP address, browser signals, and the content of each request).
• OpenStreetMap Foundation: map images on report-location and public issue map pages (the viewer's IP address and the map area shown).

Where a provider processes Customer Personal Data on RallyText's behalf, RallyText requires appropriate written data-protection obligations as required by applicable law. Some providers listed here supply infrastructure or other services without operating RallyText's application or data layer. Listing a provider in this section does not by itself determine that provider's legal status as a processor, service provider, or subprocessor under every applicable law. RallyText remains responsible for obligations that applicable law places on RallyText for its use of these providers, subject to the Terms.

AI features. AI content checks run on servers operated by RallyText, as do RallyText's other AI features, including Suggest wording in Compose, Smart Import column matching, and support reply drafts. Requests to those servers travel through Cloudflare and RackNerd as described above. Customer Data is not sent to an outside AI company for these features.

Integrations you choose. Integrations you choose to connect, such as Google Calendar, Planning Center, Zapier, or your own webhooks, receive the data you authorize RallyText to send them. They act on your instructions and are not RallyText's service providers for purposes of this addendum.

Changes to providers. The list above is the current list of service and infrastructure providers covered by this section. We will give at least 30 days' notice before a new provider begins processing Customer Data on RallyText's behalf or otherwise receives access to Customer Data in a way materially different from the providers disclosed above, by posting the change on this page and emailing account owners. You may object on reasonable data-protection grounds during the notice period by replying to the notice email or writing to support@rallytext.app. Where RallyText can provide the affected feature without sending your Customer Data to that provider, we may offer an opt-out for that provider or feature. Some providers are necessary to operate RallyText. If we cannot reasonably provide RallyText or an affected feature without the new provider, we will tell you, and if you do not agree to the change you may stop using the affected service or close your account before the provider begins processing your Customer Data and request deletion under Section 14.

10. Where data is processed

RallyText stores and processes Customer Data on its primary application infrastructure in the United States. Some service providers may process information in other countries under their applicable contractual and legal safeguards.

RallyText does not currently offer EU or UK Standard Contractual Clauses. If your use of RallyText requires an international data-transfer mechanism under EU or UK data-protection law, contact us before transferring that information into RallyText.

11. Customer responsibilities and privacy requests

You are responsible for:

• having the legal authority to provide Customer Personal Data to RallyText;
• providing privacy notices required by law;
• obtaining consents required by law;
• using RallyText in compliance with applicable law; and
• ensuring your instructions to RallyText are lawful.

If your use of RallyText involves minors, you are responsible for determining whether parental or guardian permission is legally required and for obtaining that permission when required. This does not limit any independent legal obligations RallyText has under applicable law.

Age check for text sign-ups. When someone joins a youth team by text as an athlete (sports teams, school classes, scouts, troupes, choirs and trail organizations not set to adults-only), RallyText asks their age first. Anyone under 13 is not added: the sign-up is dropped, its texts are deleted, and they are asked to have a parent or guardian, or the coach, sign them up. RallyText does not store the age given.

Privacy requests. If one of your members asks to see, correct, delete, or get a copy of their personal data, you can handle many requests yourself in the dashboard. Where you need additional assistance, we will help within reason. If a member contacts us directly about Customer Personal Data controlled by your organization, we will generally refer the request to you and will not answer it ourselves unless you ask us to or the law requires it. A member who texts STOP is opted out of your text messages immediately.

12. Security incidents

A "Security Incident" means an actual compromise of Customer Personal Data involving unauthorized access, acquisition, disclosure, alteration, loss, or destruction. Unsuccessful attempts or activities that do not compromise Customer Personal Data, such as blocked login attempts or unsuccessful network scans, are not Security Incidents under this addendum.

If we become aware of a Security Incident affecting your Customer Personal Data, we will email the account's head coach or team director and its billing contact without undue delay, and no later than 72 hours after we become aware of it. The first notice will include the information reasonably available to us at that time about what happened, what data was involved, what we are doing about it, and who to contact. We will provide updates as additional material information becomes available.

We will cooperate reasonably with your investigation and provide information available to us that you reasonably need to meet your own legal obligations.

13. Compliance information

On reasonable written request, up to once a year or after a Security Incident, we will answer a reasonable written security questionnaire and provide information reasonably needed to show that we meet this addendum.

We do not generally offer on-site audits. If applicable law requires additional verification or cooperation, we will work with you to identify a reasonable method that protects the security and confidentiality of RallyText, its systems, and other customers.

14. Export and deletion

Export. Staff with permission to manage settings can download the team's data from Settings at any time, or you can ask support@rallytext.app for help. The information and formats available depend on the export tools RallyText offers at the time.

Deletion. You can ask us to delete the team's Customer Data at any time, including when you close the account, by emailing support@rallytext.app. We delete Customer Data from active systems within 30 days of a valid deletion request, subject to the exceptions below and to any legal requirement to keep specific data longer (for example, a legal hold or an active investigation), in which case we keep only what is required and delete it when the requirement ends. Cancelling a subscription does not delete data on its own, because many teams pause between seasons.

Records kept after deletion. Three kinds of records may be kept: billing records, for up to seven years where necessary for financial or legal obligations; opt-out (STOP) records, indefinitely, so an opt-out continues to be honored; and the records of RallyText staff support sessions described in Section 7, kept for 5 years as a tamper-evident security record and then deleted, which keep the team's name and the name, email address and role of the account our staff viewed, but no roster or message content.

Automatic deletion. Even without a request, message logs and attendance and practice records are deleted after 2 years, team administrative audit logs after 1 year, and files shared by text link 90 days after upload (a record that a file was shared, with its name, size and open count, is kept for reporting).

Backups. Deleted Customer Data may remain temporarily in encrypted backups, which are deleted within 90 days as they age out. Backups are used only for disaster recovery and business continuity. We keep a record of each deleted team (its identifier and the deletion date, no personal data), and if a backup is ever restored, every team on that record is deleted again from the restored systems.

15. Processing details

• Subject matter and duration: providing RallyText to you for as long as you use the service and through the retention and deletion periods described in this addendum.
• Nature and purpose: sending and receiving text messages and email for your team, maintaining your roster, calendar, attendance and related records, supporting integrations you enable, and providing other RallyText features you choose to use.
• Data subjects: your staff, members, athletes, parents and guardians, volunteers and followers, and people who contact your RallyText number, for example to sign up or send a report.
• Categories of personal data: names, phone numbers, email addresses, roles and group membership, message content and attachments, attendance and calendar records, and account and billing contact details; and, where a team uses the related features, emergency contacts, household and parent or guardian relationships, custom member fields, safety and emergency incident records and alert acknowledgments, fundraising and donation records, events sent to your API integrations and webhooks, and a location a person chooses to share with a report.

RallyText is not intended for information that requires specialized regulatory protections unless RallyText has expressly agreed in writing to support that processing.

16. Not a HIPAA Business Associate Agreement

This addendum is not a Business Associate Agreement under HIPAA. RallyText does not currently offer HIPAA-covered processing. Do not use RallyText to send or otherwise process protected health information.

17. Order of precedence

The RallyText Terms of Service still apply. Where they conflict with this addendum on data protection, this addendum controls.

18. Changes to this addendum and signed copies

The current version of this addendum is published on rallytext.app with its version number and effective date. We may update it from time to time. If a change materially affects how we process or protect Customer Personal Data, we will give account owners at least 30 days' notice by email and publish the updated version on this page. The notice will explain when the change takes effect and any option to object or opt out. If you do not agree to a material change and no opt-out lets us keep providing RallyText under the previous terms, you may close your account before the change takes effect and request deletion under Section 14. Changes that do not materially reduce your data-protection rights, such as clarifications and corrections, may take effect when published. Continued use of RallyText after a notified material change takes effect means acceptance of the updated addendum, subject to applicable law.

Signed copies. If your organization wants a signed copy for its records, a head coach or team director can sign the current version in Settings, Security, and download a PDF that records the version, the signer, the date, and a fingerprint of the exact text.

Questions: support@rallytext.app. Security reports: security@rallytext.app.

Request a custom addendum

Need different terms, or have your own contract language? Tell us what you need and we'll reply by email.