Privacy Policy

How RallyComm handles your data.

Last updated: May 2, 2026 · Effective: May 2, 2026

1. Who this policy covers

We collect information from two distinct groups of people, and we keep the data we collect about each group separate:

• Device operators / customers. The person or business who purchases a RallyComm device, activates a subscription, and configures the device.
• Message recipients. The phone numbers a customer adds to their device's recipient list. These are typically the customer's crew members, family contacts, or event safety officials. We never market to recipients and we do not contact them outside the operational messages a customer sends from their device.

2. Data we collect

From device operators / customers

• Email address (for account, receipts, and support).
• Billing details handled by Stripe — we never see your card number. See Stripe's privacy policy.
• Device serial number, firmware version, and hardware diagnostics (uptime, signal strength, error counts) sent by the device on a signed heartbeat every 5 minutes for fleet support.
• The recipient phone numbers and friendly names you save on the device — stored locally on the device and echoed to our backend only when needed for service support.

From message recipients

• Your phone number (provided to us by the device operator who added you to their device).
• Inbound SMS messages you send back to a RallyComm device's number — these are forwarded to that device for the operator to read.
• The fact that you have or have not opted out via STOP, so we can suppress further sends.

We do not collect recipient names beyond what the operator chose to label you, message content from third parties, device GPS history beyond what the operator chooses to share, browsing behavior, advertising identifiers, or any biometric data.

3. How we use data

• To deliver SMS through Twilio's network on the operator's behalf.
• To activate, suspend, and bill device subscriptions through Stripe.
• To diagnose device problems and ship over-the-air firmware updates.
• To honor STOP / HELP keywords as required by U.S. carriers and the CTIA Short Code Monitoring Handbook.
• To comply with legal process and, where required, with carrier A2P 10DLC compliance audits.

4. What we never do

We do not sell, rent, or trade recipient phone numbers or any other personal data. We do not share recipient data with third parties for marketing or analytics. We do not use recipient data to build profiles for advertising. The only third parties who see your phone number are:

• Twilio — our SMS carrier; sees the From / To / message body for routing purposes only (Twilio Privacy).
• Stripe — payment processor; only sees the operator's billing data, never recipient data (Stripe Privacy).
• Hologram — cellular SIM provider for the device's 4G LTE radio; sees data session metadata (Hologram Privacy).
• Cloudflare — hosts our backend and CDN (Cloudflare Privacy).
• Supabase — encrypted database for device, subscription, and customer records (Supabase Privacy).

All four are bound by Data Processing Agreements that prohibit independent use of the data we route through them.

5. Retention

• Recipient phone numbers: kept on the device's local config until the operator removes them, plus up to 30 days in backend support logs after removal.
• Message content: kept by Twilio for up to 13 months (their default retention); RallyComm itself does not log message bodies on the backend.
• Device heartbeats / diagnostics: 30 days.
• OTA install logs: 365 days.
• Audit logs (subscription / activation events): 730 days.
• Stripe billing records: 7 years per U.S. tax law.

6. Recipient rights — how to opt out

If you are receiving messages from a RallyComm device and you no longer wish to receive them, you have several options:

• Reply STOP to any message from the device. This is honored automatically by Twilio and immediately suppresses all future sends to your number from that device.
• Reply HELP to receive contact information.
• Email us at privacy@rallycomm.com with the phone number you want removed and we will purge it from every device that has saved it, plus our backend support logs, within seven (7) business days.
• Contact the device operator directly and ask them to remove you from their recipient list.

7. Operator rights

Customers can export, correct, or delete their account data at any time by writing to privacy@rallycomm.com. Account deletion cancels any active subscription, releases the device's Twilio number back to the carrier pool, and pauses the cellular SIM. Hardware you have purchased remains yours.

8. Security

Backend data is encrypted at rest (Supabase / AES-256) and in transit (TLS 1.3). Devices authenticate to our backend with a unique HMAC key generated on first boot; that key never leaves the device. Stripe and Twilio credentials live as Cloudflare Workers secrets and are never exposed to client-side code.

9. Children

RallyComm is a B2B / professional motorsports product. We do not knowingly collect data from anyone under 13. If you believe a child has been added to a device's recipient list without a parent's consent, please email privacy@rallycomm.com and we will remove the number immediately.

10. International users

RallyComm devices and our backend are hosted in the United States. If you are accessing the service from outside the U.S., your data will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses where required for EU / UK transfers.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced via email to active customers at least 30 days before taking effect. The "Last updated" date at the top of this page always reflects the current version.

12. Contact

Privacy questions, deletion requests, or carrier compliance inquiries:

• Email: privacy@rallycomm.com
• General support: support@rallycomm.com