Privacy Policy

Last updated: October 13, 2026

Echo AI LLC (“Echo AI,” “we,” “us,” or “our”) provides Rally, a group-buying service for merchants, creator partners, and shoppers. This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Rally website, Rally services, and the Rally connector for Muse (collectively, the “Services”).

Summary for shoppers

  • When you join a rally (a group buy on Rally) we collect your name, email address, shipping address, and the item and quantity you chose. Your card details go directly to our payment processor, Stripe; we never see or store your full card number.
  • Stripe gives us a card fingerprint, not your card number. We use it to make sure a card cannot earn a referral discount by referring itself, and to recognize repeated payment disputes.
  • The creator who shared the rally never receives your name, email address, or shipping address, and neither do other shoppers. Creators see only rally progress, such as the number of units joined.
  • The merchant receives your name, email address, shipping address, and order details only if the rally fills, so it can ship your order and handle returns. If the rally does not fill, the merchant does not receive them.
  • If you tick the optional box when you join, we may later email you about new rallies on Rally. We are not sending these emails yet. When we do, every one will have an unsubscribe link that takes effect immediately.
  • We do not sell your personal information or use it for targeted advertising.
  • We do not use your personal information to train AI models.

1. Information we collect

Information you provide

We may collect:

  • Account and contact information: Such as your name, email address, account role, business name, and login or authentication details.
  • Merchant information: Such as store details, product and deal information, rally targets, deadlines, commission terms, fulfillment terms, and merchant dashboard settings.
  • Rally information: Such as rallies created or joined, deal selections, quantity, rally status, authorization and charge status, the version of our Terms you agreed to and when, your personal share link and share code, which rally link you joined through and who joined through yours, the private link to your order page, communications, and creator partner activity.
  • Order-related information: Such as your name, email address, shipping address, the product, quantity, price, payment status, and merchant.
  • Support information: The content of messages, requests, and other information you send when you contact us.

Payment information

Payments are processed by Stripe through Rally’s Stripe Connect integration. You enter your card details in a form provided by Stripe, and Stripe processes them under its own privacy policy. Rally does not receive or store your full payment-card number. Rally receives transaction information needed to operate the Services, which may include authorization and charge status, transaction amount, tax calculations and tax transaction identifiers, refund and dispute information, transfer and settlement information, Stripe transaction references, and a card fingerprint that Stripe derives from the card (it does not reveal the card number). To calculate sales tax, we use the shipping address you enter.

Information collected automatically

When you use the Services, we may collect device and usage information, including IP address, browser type, device type, operating system, pages viewed, actions taken, referring pages, approximate location derived from IP address, and dates and times of access. We may use cookies and similar technologies for authentication, security, preferences, service operation, and analytics.

Information from connected services

If you connect Rally to Muse or another compatible service, we may receive the account identifiers, instructions, and contextual information needed to complete your request. We receive only the information made available through that connection and your use of it.

2. How we use information

We may use information to:

  • Provide, maintain, secure, and improve the Services.
  • Create and manage accounts, deals, rallies, and merchant dashboards.
  • Count authorized units and determine whether published rally goals are met.
  • Charge your card through Stripe if the rally fills and cancel your card hold if it does not.
  • Calculate applicable marketplace sales or use taxes.
  • Collect, report, and remit taxes where required.
  • Maintain tax and transaction records.
  • Provide marketplace sales reports required by law.
  • Process and administer refunds and disputes.
  • Apply referral discounts, by recording which rally link you joined through.
  • Prevent a card from earning a referral discount by referring itself, and recognize repeated payment disputes, using the card fingerprint.
  • Operate your personal share link and the private link to your order page.
  • Send service messages, deadline reminders, support replies, and security notices.
  • If you opted in, send you emails about new rallies and deals on Rally, and use the rallies you joined to choose which ones to tell you about.
  • Understand how shoppers use Rally, such as which kinds of deals they join, to improve the Services.
  • Display merchant-published deal terms and commission disclosures.
  • Produce analytics about a merchant’s own deals, including filled and unfilled rallies, progress toward targets, and product performance.
  • Complete requests made through Muse or another connected service.
  • Detect fraud, abuse, security incidents, and violations of our Terms of Service.
  • Comply with law, enforce agreements, and protect users, Echo AI, and others.
  • Create aggregated or de-identified information that does not reasonably identify an individual.

We do not use your personal information to train AI models.

Rally analytics present observed activity and outcomes. They do not make definitive claims about why a rally succeeded or failed.

3. How we disclose information

We may disclose information as follows:

  • To merchants: When a rally fills, we provide the merchant with each charged shopper’s name, email address, shipping address, and order details so it can fulfill orders, provide customer service, and handle returns, refunds, and disputes. Before a rally fills, the merchant sees only counts and totals. Under our Merchant Agreement, merchants may use this information only for those purposes and to meet legal obligations, and may not use it for marketing without a separate legal basis, or sell it.
  • To creator partners: Creators who share a merchant’s rally may see rally progress, unit counts, and sales totals used to calculate their commission. They never receive shoppers’ names, email addresses, or shipping addresses.
  • To Muse or another connected service: When you connect Rally and make a request, we exchange the minimum rally, deal, or account information reasonably needed to complete that request. The Rally connector never returns shoppers’ names, email addresses, shipping addresses, or payment details. Your use of the connected service is also subject to that provider’s terms and privacy notice.
  • To service providers: We use vendors that process information for us under contractual restrictions, including Stripe (payment processing), Google Cloud (hosting and databases, in the United States), and Resend (transactional email), as well as other hosting, security, and support providers.
  • To governmental authorities: to taxing, regulatory, law-enforcement, or other governmental authorities where required by applicable law, for example in sales and use tax returns, records, and audits.
  • For legal and safety reasons: We may disclose information if required by law or if reasonably necessary to protect rights, safety, property, users, or the integrity of the Services.
  • For a business transaction: Information may be disclosed in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable law.
  • With your direction or consent: We may disclose information when you ask us to or otherwise consent.

4. Merchant data separation

A merchant can access rally, order, and performance data for that merchant’s own deals only. Rally does not provide a merchant with another merchant’s identifiable customer, deal, or performance data. We may use aggregated or de-identified information across the Services when it does not reasonably identify a person or reveal another merchant’s confidential business information.

Merchants receive personal information as independent sellers. Merchants receiving Buyer information through Rally remain subject to the use restrictions in the Rally Merchant Agreement described in Section 3, in addition to their own privacy notices. Contact the relevant merchant about its handling of order, fulfillment, return, or customer-service information.

5. Data retention

We retain personal information for as long as reasonably necessary to provide the Services, maintain business and transaction records, resolve disputes, enforce agreements, protect the Services, and meet legal obligations. In particular:

  • Shipping addresses are deleted automatically 120 days after a rally closes if you were charged (so the merchant can handle delivery issues, returns, and disputes), and 30 days after it closes if you were not charged. The city, state, and ZIP code used to calculate sales tax on a charge are kept with the tax records, without your street address.
  • Names and email addresses are deleted automatically six years after a rally closes if you were charged (the period in which contract claims can be brought in Washington), and two years after it closes if you were not charged. Order amounts and consent records are kept afterwards without your name or email address.
  • Card fingerprints, referral relationships, share codes, and private order links are deleted six years after a rally closes if you were charged, and two years after it closes if you were not.
  • If you opted in to emails about new rallies, we keep your name and email address for as long as you stay subscribed. After you unsubscribe, the periods above apply.
  • Copies of the emails we send you are deleted after one year.
  • Merchant account information, including merchant agreement records, is kept while the account is open and afterwards for as long as needed for accounting, tax, and legal purposes.
  • Shipping addresses are stored encrypted, and access is limited to the merchant for a filled rally and to Rally staff who need it to provide support.

A merchant that received your information for a filled rally keeps its own copy under its own retention practices, subject to the use restrictions in the Rally Merchant Agreement. We may retain aggregated or de-identified information where permitted by law.

6. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Consumer health data (Washington)

Rally is not designed to collect health diagnoses or to infer health conditions from Buyer purchases. Rally does not currently support prescription drugs, OTC medicines, dietary supplements, ingestible wellness products, medical devices, diagnostic products, or other high-risk regulated health products (see the Prohibited Products Policy). Ordinary beauty and personal-care purchases are processed as ordinary commerce. Deals in review categories, or whose wording may be a health or medical claim, cannot be published until Rally has reviewed them. This does not mean that no health-data law could ever apply.

If Rally later decides to add health, supplement, or medical product categories, or any other product or feature that could involve regulated consumer health data, it will complete a separate legal and privacy review before enabling it. If Rally later introduces a product or feature that causes it to collect consumer health data regulated by Washington’s My Health My Data Act, Rally will put in place the separate notice, policy, and rights process that law requires before enabling that feature. You may exercise the rights described below by contacting us.

8. Your choices and rights

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a copy of your personal information, or to object to or restrict certain processing. You may also withdraw consent where processing relies on consent.

To make a privacy request, email hello@echoaisms.com. We may need to verify your identity and authority before completing a request. We will respond as required by applicable law. You may also manage cookies through your browser settings, although disabling certain cookies may affect service functionality.

Emails about new rallies are optional. Use the unsubscribe link in any such email, or email hello@echoaisms.com. Unsubscribing does not stop service messages about rallies you joined.

Do Not Track. Some browsers send “Do Not Track” signals. Because there is no common standard for these signals, the Services do not respond to them. We do not track you across other companies’ websites, and we do not use third-party advertising cookies.

For information held by a merchant as the seller, contact that merchant directly. We may direct merchant-specific requests to the relevant merchant.

9. Children’s privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can review and, where appropriate, delete it.

10. International use

Echo AI is based in the United States. If you access the Services from another country, your information may be processed in the United States or other countries where we or our service providers operate, subject to applicable safeguards and law.

11. Changes to this policy

We may update this Privacy Policy as the Services change. We will post the updated policy with a revised “Last updated” date and provide additional notice when required by law.

12. Contact us

For privacy questions or requests, contact:

Echo AI LLC
Redmond, Washington 98052, United States
Email: hello@echoaisms.com
State of registration: Washington, United States