Privacy Policy

1. About This Policy

Rally Technologies Pty Ltd (ABN: 12 660 772 369) ("Rally", "we", "us", or "our") operates the rallyhq.ai website and the Rally platform (the "Service").

This Privacy Policy explains how we collect, use, store, and disclose personal information in connection with our Service. We are committed to protecting personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Who This Policy Covers

This policy applies to:

• Visitors to the rallyhq.ai website
• Customers — ASX-listed companies and their authorised users (company secretaries, IR teams, executives) who use the Rally platform
• Shareholders and investors whose personal information is processed through the Rally platform on behalf of our customers

Rally acts as a data processor when handling shareholder and investor data on behalf of its customers. Our customers (ASX-listed companies) remain the data controllers responsible for their shareholders' personal information and for ensuring they have the appropriate authority to upload and use that data within Rally.

3. Information We Collect

3.1 Information you provide directly

When you visit our website, sign up for a trial, or use the Rally platform, we may collect:

• Name and email address
• Company name and ASX ticker code
• Billing information (processed securely via Stripe — we do not store card details)
• Communications you send us via our contact form or support channels

3.2 Information collected automatically

When you visit our website or use the platform, we automatically collect:

• IP address and browser type
• Pages visited and time spent on those pages
• Device and operating system information
• Referring website

We collect this information using Google Analytics and cookies. See Section 7 for more detail on cookies.

3.3 Shareholder and investor data processed on behalf of customers

When customers use Rally's shareholder CRM features, they may upload or sync personal information about their shareholders and investors, including:

• Name and contact details (email, address)
• Shareholding information sourced from your share registry
• Engagement data (email opens, portal visits, announcement clicks)

Rally processes this data solely on behalf of and under the instruction of the relevant customer. Rally does not use shareholder data for its own marketing purposes or share it with third parties except as necessary to provide the Service.

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Rally platform
• Process your subscription and billing
• Respond to your enquiries and provide customer support
• Send you product updates, service notifications, and (where you have opted in) marketing communications
• Monitor platform usage and diagnose technical issues
• Comply with our legal obligations

We do not sell your personal information to third parties.

5. Disclosure of Personal Information

We may disclose your personal information to:

• Stripe — for payment processing. Stripe's privacy policy is available at stripe.com/privacy
• Google Analytics — for website analytics. Google's privacy policy is available at policies.google.com/privacy
• Email infrastructure providers — Brevo for transactional and campaign emails sent through the platform, and Mailgun for inbound email processing (ASX announcement and registry report ingestion)
• Hosting and infrastructure providers — Rally's platform and data are hosted on Cloudflare's globally distributed infrastructure
• Professional advisers — lawyers, accountants, and auditors where necessary
• Law enforcement or regulatory bodies — where required by law or in response to a valid legal request

We take reasonable steps to ensure that third party service providers handle personal information in accordance with the Australian Privacy Principles.

6. Data Storage and Security

Rally's platform is built on Cloudflare's globally distributed, serverless infrastructure. Customer data is held in a managed PostgreSQL database, encrypted at rest and in transit, accessed through a secure encrypted connection pool. Uploaded files are kept in encrypted object storage. All credentials are stored as encrypted secrets and are never exposed in code or logs.

As a multi-tenant platform, Rally enforces strict tenant isolation at the data layer: every record is tied to its owning company and every query is automatically scoped to that company, ensuring one organisation's data can never be accessed by another.

Access to the platform is protected by securely hashed passwords and optional multi-factor authentication, with role-based permissions distinguishing administrators from read-only users. All incoming data is validated before processing. Sensitive actions — including sign-in, registration, and password reset — are rate-limited to deter abuse. Inbound integrations and webhooks are cryptographically verified to prevent replay attacks.

While we take reasonable steps to protect your personal information, no method of transmission over the internet is completely secure and we cannot guarantee absolute security.

7. Cookies

Our website uses cookies to improve your experience and to collect analytics data via Google Analytics.

We use the following types of cookies:

• Session cookies — to operate the Service
• Preference cookies — to remember your settings
• Analytics cookies — to understand how visitors use our website (Google Analytics)

You can instruct your browser to refuse cookies or to alert you when cookies are being sent. If you disable cookies, some parts of our website may not function correctly.

8. Marketing Communications

If you sign up for a Rally trial or subscription, we may send you product updates and relevant information about the Service. You can opt out of marketing communications at any time by clicking the unsubscribe link in any email or by contacting us at team@rallyhq.ai.

We will not send unsolicited marketing emails. All marketing emails include a functioning unsubscribe link in compliance with the Spam Act 2003 (Cth).

9. Access, Correction, and Deletion

You have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to our legal obligations to retain certain records

To exercise any of these rights, please contact us at team@rallyhq.ai. We will respond within 30 days.

10. Shareholder Data — Customer Responsibilities

Rally's customers are responsible for ensuring they have the appropriate legal authority to upload, sync, and use shareholder data within the Rally platform. Customers must ensure their use of shareholder data complies with:

• The Australian Privacy Act 1988 and Australian Privacy Principles
• The Spam Act 2003 (Cth)
• Any applicable obligations under ASX Listing Rules

Rally processes shareholder data solely as directed by customers and in accordance with this policy.

11. Retention of Data

We retain personal information for as long as necessary to provide the Service and meet our legal obligations. When a customer cancels their Rally subscription, their data is retained for 30 days before deletion to allow for any final exports. Shareholder data is deleted from Rally's servers within 30 days of a subscription ending.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the effective date. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy or wish to make a privacy request, please contact us: