Privacy Policy.

About RallyOrder Inc.

RallyOrder Inc. ("RallyOrder," "we," "us," "our") offers a school commerce platform that provides point-of-sale, online ordering, and payment processing for school-based stores with built-in artificial intelligence curriculum tools for career and technical education programs ("Curriculum Platform").

Scope of this Policy

This privacy policy applies to RallyOrder's online properties (including our websites, mobile apps, and online platform), our social media pages or handles, and our products and services related to the Curriculum Platform (the "Services"). We offer these Services through teachers, schools, and school districts, and we do so at their direction and in our capacity as a "school official."

This Policy applies when you interact with us through our Services. It also applies anywhere it is linked. It does not apply to third-party websites, mobile applications, or services that may link to the Services or be linked to from the Services. Please review the privacy policies on those websites and applications directly to understand their privacy practices.

We may change this Policy from time to time. If we do, we will notify you by posting the updated version.

The Services do not use any third-party advertising, including targeted advertising.

Our Handling of Student Information

We are dedicated to protecting the privacy and personal data of students and others who use our Services.

As a trusted provider of tools that help teachers and schools educate students, we are particularly concerned about the collection and use of students' personal data. We collect only personal data that we need for authorized school purposes at the direction of our school and school district partners, and we comply with applicable privacy laws, such as the Family Educational Rights and Privacy Act ("FERPA"), the Children's Online Privacy Protection Act ("COPPA"), and state comprehensive and student privacy laws, including the California Student Online Personal Information Protection Act ("SOPIPA").

We do not do the following:

• Sell students' personal data.
• Market directly to students or use students' personal data for marketing.
• Serve third-party ads (including targeted ads) on our Services, and we do not use personal data we collect from students or others using the Services to serve targeted ads on other websites or online services.
• Disclose personal data collected through the Services for third parties' targeted ads.
• Build a profile of a student other than in support of authorized school purposes, such as for purposes of assessing the performance of school-based stores managed by students.
• Retain students' personal data for longer than permitted by our agreements with our school or school district partners.

Children's Privacy

Our Services are designed for use by schools and operate at the school's direction. Where a student is under 13 years of age, we rely on the school to provide consent for the collection of the student's personal data under COPPA, and we collect, use, and retain that data only for authorized school purposes, never for marketing or advertising.

We collect from students only the information needed to operate the Services, such as name, school email address, role within the store, and activity within the Services (for example, sales rung up, inventory counts, and responses within our curriculum tools). We do not condition a student's participation on the disclosure of more information than is reasonably necessary.

Parents and guardians may review their child's information, request that it be deleted, or refuse further collection by contacting their school or by contacting us using the information below. We work with the school to honor these requests.

Information We Collect

We collect information from you directly, from the devices you use to interact with us, and from third parties. We may combine information from the Services together and with other information we obtain from our business records. We may use and share information that we aggregate (compile to create statistics that cannot identify a particular individual) or de-identify (strip information of all unique identifiers such that it cannot be linked to a particular individual) at our discretion.

Information you give us

You may provide the following information to us directly when you sign up for an account and use the Services, consult with our customer service team, onboard to our platform, send us an email, communicate through our store-to-store forums, participate in competitions and contests, or make a purchase:

• Contact and professional information, including name, email address, telephone number, and job title (if a school official or acting on behalf of a merchant organization), as well as school name during account registration.
• Government-issued identification numbers during merchant onboarding.
• Content you may include in survey responses.
• Any information or data you provide by interacting in our online store-to-store communication forum. Please note that these comments are also visible to other users of the forum.
• Information provided during customer support inquiries.
• Information provided when you make a purchase, including items purchased, order history, transaction amounts, and time stamps.
• Payment information, including credit card information. (This is collected and processed by, and stored with, our payment service provider.)
• Information you make available when you participate in one of our school-based competitions (e.g., "RallyLeague," which is our Rally Cup event).
• Information provided when you sign up to receive newsletters, alerts, or email offers; participate in special events, games, and promotions; and enter contests.
• Information you make available to us via a social media platform.
• Any other information you submit to us.

Information we collect automatically

We and partners working on our behalf may use log files, cookies, or other digital tracking technologies to collect the following information from the device you use to interact with our Services. We also create records when you make purchases or otherwise interact with the Services.

• Device information, including IP address, browser type, operating system, screen resolution, device ID.
• Analytical information, including details about your interaction with our Services, website, and app, such as pages visited, time on site, referral source, and email delivery, read, and engagement information.
• Diagnostic information, including web traffic logs.

We use cookies to support functionality of the Services, for analytics, and to remember your preferences. You may disable certain cookies in your browser or mobile device using their settings menus. Disabling cookies may also disable some elements of our Services.

We also collect information about student interactions with curriculum tools, such as student responses, progress, and performance metrics.

Information we collect from other sources

We may collect the following information about you from third-party sources.

• From users of the Services: If you decide to invite others to the Services, we will collect your and the other person's names and email addresses to send an email and follow up with the other person. You agree that you will obtain the other person's consent before giving us his or her contact information. We will inform any other person you invite that you gave us his or her information in the invitation email.
• From schools and school districts: We collect information from schools and school districts, including student and advisor names, email addresses, and information about the roles of individuals when onboarding store operators.
• From educational programs, including but not limited to DECA chapters and Career and Technical Student Organizations (CTSOs): Educational programs may provide student member numbers and advisor information for curriculum program participation.
• From booster clubs: Booster clubs may provide contact information for volunteers and account administrators during account setup.

We also may create personal data about you in certain circumstances, such as when transaction data (including information about sales, inventory, and financial metrics) from a student-managed school store is mapped to CTSO standards and linked to you.

How We Use Your Information

We may use any of the information we collect for the following purposes.

• Storefront operations: To provide you with our products and services, including to take steps to enter a contract for sale or for products or services; onboard new student and school advisor store managers; bill or invoice for services; process payments; fulfill orders; send service communications (including renewal reminders); and conduct general business operations (such as accounting, recordkeeping, and audits).
• Curriculum engine: To provide our Curriculum Platform through our AI-assisted curriculum engine; send newsletters and other information related to the Curriculum Platform; and to administer contests.
• Service improvement: We use de-identified data to improve and grow our Services, including to develop new products and services and understand how our Services are being used, and our customer base and purchasing trends.
• Security: To protect and secure our Services, assets, network, and business operations, and to detect, investigate, and prevent theft, unauthorized use, or abuse of the Services and other activities that may violate our policies or be fraudulent or illegal.
• Legal compliance: To comply with legal process, such as warrants, subpoenas, court orders, and lawful regulatory or law enforcement requests and to comply with applicable legal and regulatory requirements.

How We Share Your Information

We may share any of the information we collect with the following recipients.

• Service providers: We engage vendors to perform specific business functions on our behalf, and they may receive information about you from us or collect it directly. These vendors are obligated by contract to use information that we share only for the purpose of providing these business functions, which include:
  • Supporting Service functionality, such as vendors that support payment processing (we do not collect your payment card information), event registration, customer service and customer relationship management, surveys, freight services, application development, postal mailings, and communications (email).
  • Auditing and accounting firms, such as firms that help us create our financial records.
  • Professional services consultants, such as firms that perform analytics, assist with improving our business, provide legal services, or supply project-based resources and assistance.
  • Analytics, including entities that analyze traffic on our online properties.
  • Security vendors, such as entities that assist with security incident verification and response, service notifications, and fraud prevention.
  • Information technology vendors, such as entities that assist with website design, hosting and maintenance, data and software storage, and network operation.
• Business partners: We do not sell your contact information, and we do not share it with third parties for their own marketing. If we run a promotion or an event with a partner, we manage those communications ourselves through our own platform.
• Educational programs: With your school's authorization, we may share limited information with educational programs your school participates in, such as DECA, BPA, FBLA, and FCCLA, to support program participation, competitions, and recognition (for example, school-based enterprise certification). We share only what the program requires for those purposes and only at the school's direction.
• Social media platforms: If you interact with us on social media platforms, the platform may be able to collect information about you and your interaction with us. If you interact with social media objects on our Services (for example, by clicking on a Facebook "like" button), both the platform and your connections on the platform may be able to view that activity. To control this sharing of information, please review the privacy policy of the relevant social media platform.
• Government entities/Law enforcement: We may share information when we believe in good faith that we are lawfully authorized or required to do so to respond to lawful subpoenas, warrants, court orders, or other regulatory or law enforcement requests, or where necessary to protect our property or rights or the health and safety of our employees, contractors, customers, or other individuals.
• Other businesses in the context of a commercial transaction: We may change our ownership or corporate organization while providing the Services. We may transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information as described in this policy.

Security

We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the Services. While we use these precautions to safeguard your information, we cannot guarantee the security of the networks, systems, servers, devices, and databases we operate or that are operated on our behalf.

Your Options and Rights Regarding Your Information

Your account: Please visit your account page to update your account information.

Email unsubscribe: If you do not wish to receive marketing information from us or wish to opt out of future email promotions from us, please contact us. Please note that all promotional email messages you receive from us will include an option to opt out of future email communications.

Do Not Track: Your browser or device may include "Do Not Track" functionality. Our information collection and disclosure practices and the choices that we provide to you will continue to operate as described in this privacy policy regardless of whether a Do Not Track signal is received.

Jurisdiction-specific rights: You may have certain rights with respect to your personal information depending on your location or residency. Please see "Privacy Disclosures for Specific Jurisdictions" below. Please contact us to exercise your rights.

Other Important Information

Data retention

We may store information about you for as long as we have a legitimate business need for it. We determine the retention period for the personal information that we collect based on (1) the length of time we need to retain the information to achieve the purposes for which we collected it, (2) any legal or regulatory requirements applicable to such information, (3) internal operational needs, and (4) any need for the information based on any actual or anticipated litigation or investigation.

Privacy Disclosures for Specific Jurisdictions

California

Your California Privacy Rights; "Shine the Light" Law

California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of personal information to third parties for their own direct marketing purposes in the preceding calendar year. Please contact us to obtain this information.

We do not share your personal information with third parties for those third parties' direct marketing purposes.

California Consumer Privacy Act

The California Consumer Privacy Act ("CCPA") provides California residents with rights to receive certain disclosures regarding the collection, use, and disclosure of information about them, as well as rights to know/access, correct, delete, and limit disclosure of personal information. You have the right to be free from discrimination based on your exercise of these rights. If we collect personal information subject to the CCPA, that information, our practices, and your rights are described below.

Notice at Collection Regarding the Categories of Personal Information Collected

The following table summarizes the categories of personal information we collect; the categories of sources of that information; whether we disclose, sell, or share that information to service providers or third parties, respectively; and the criteria we use to determine the retention period for such information. The table also summarizes the categories of "sensitive" personal information that we collect, the purposes for which such information is used, and whether we sell or share such information. The categories we use to describe personal information are those enumerated in the CCPA. We collect this personal information for the purposes described above in "How We Use Your Information."

We determine the retention period for each of the categories of personal information listed above based on (1) the length of time we need to retain the information to achieve the business or commercial purpose for which it was obtained, (2) any legal or regulatory requirements applicable to such information, (3) internal operational needs, and (4) any need for the information based on any actual or anticipated investigation or litigation.

Entities to whom we disclose information for business purposes are service providers, which are companies that we engage to conduct activities on our behalf. We restrict service providers from using personal information for any purpose that is not related to our engagement.

Under the CCPA, a business "sells" personal information when it discloses personal information to a company for monetary or other benefit. A company may be considered a third party either because we disclose personal information to the company for something other than an enumerated business purpose under California law, or because its contract does not restrict it from using personal information for purposes unrelated to the service it provides to us. A business "shares" personal information when it discloses personal information to a company for purposes of cross-context behavioral advertising. We do not sell or share personal information.

Your rights under the CCPA

• Know and request access to and correction or deletion of personal information: You have the right to request access to personal information collected about you and information regarding the source of that personal information, the purposes for which we collect it, and the third parties and service providers to whom we sell, share, or disclose it. You also have the right to request in certain circumstances that we correct personal information that we have collected about you and to delete personal information that we have collected directly from you. Please contact us to exercise these rights.

Other states

Residents of other states may have the following rights:

• Opt out of "sales" of personal information and use of their personal information for "targeted advertising," as those terms are defined under applicable law.
• Opt out of "profiling" under certain circumstances, as defined under applicable law.
• Confirm processing of and obtain access to personal information under certain circumstances.
• Correct personal information under certain circumstances.
• Request the specific third parties (other than natural persons) to which personal information has been disclosed. (Minnesota, Oregon, and Connecticut only)
• Delete personal information under certain circumstances.

You may contact us by using one of the methods listed below to exercise any rights applicable to your state of residence.

Nevada

Residents of the State of Nevada have the right to opt out of the sale of certain pieces of their information to third parties. Currently, we do not engage in such sales. If you are a Nevada resident and would like more information about our data sharing practices, please contact us.

Contact Information, Submitting Requests, and Our Response Procedures

Contact

Please contact us if you have questions or wish to take any action with respect to information to which this privacy policy applies.

Email: hello@rallyorder.com
Telephone: 208-930-1982
Mail: 838 N 7th St., Coeur d'Alene, ID 83814

Making a request to exercise your rights

Submitting requests: You may request to exercise your rights by contacting us using the information above.

If you are a resident of California, Colorado, or Connecticut, you may, under certain circumstances, authorize another individual or a business, called an authorized agent, to make requests on your behalf.

We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

Verification: We must verify your identity before responding to your request. We verify your identity by asking you to provide personal identifiers that we can match against information we may have collected from you previously. We may need to follow up with you to request more information to verify identity.

We will not use personal information we collect in connection with verifying or responding to your request for any purpose other than responding to your request.

Appeals

Residents of certain states have the right to appeal a denial of their request by contacting us as described in the notice of denial.