1. Who we are
Rallio ("we", "us") operates the tennis opportunity platform at this website. For privacy questions, contact support@rallio.co.
Where Malaysian personal data protection law (including the Personal Data Protection Act 2010) applies, we process personal data in line with those obligations and this Policy.
2. Data we collect
Depending on how you use Rallio, we may collect:
- Account data — email, phone number, password or auth tokens, name, handle, avatar, and onboarding preferences (skill, availability, travel radius).
- Profile & community data — bio, club memberships, roles (player, organiser, admin), verification or membership status.
- Session activity — sessions you create or join, join requests, waitlist position, attendance/check-in signals, chat messages in session or DM threads, and related timestamps.
- Location data — venue names, map pins, and approximate location used to show nearby sessions when you enable location-related features.
- Payment coordination data — session price notes, payment status, and receipts or proof you upload for organiser review (Rallio typically does not store full card numbers for off-platform transfers).
- Device & usage data — IP address, browser/app type, pages viewed, crash or performance diagnostics, and notification delivery status (including push subscription endpoints if you enable push).
- Communications — messages you send to support, and content of in-app notifications.
If you sign in with Google (or another provider), we receive basic profile information those providers share with us (typically name, email, and avatar) subject to your settings with that provider.
3. How we use data
We use personal data to:
- Create and secure your account, and keep you signed in
- Show relevant sessions and clubs, and operate join / waitlist / guest flows
- Power organiser tools (rosters, approvals, announcements, attendance)
- Enable chat, notifications, and reminders you have opted into
- Coordinate payment confirmation between players and organisers
- Prevent abuse, enforce Terms, and protect the integrity of the community
- Improve product reliability and understand aggregate usage
- Comply with law and respond to lawful requests
We do not sell your personal data. We do not use session chat content to train public AI models.
4. Legal bases (where required)
Where a legal basis is required, we rely on:
- Contract — to provide the Service you requested (account, sessions, clubs)
- Legitimate interests — to secure the platform, prevent fraud, and improve features in ways that do not override your rights
- Consent — for optional items such as marketing emails or certain location / push features, where consent is required
- Legal obligation — when we must retain or disclose data under law
5. Sharing
We share data only as needed:
- Other users — organisers and participants see profile information and session activity appropriate to the feature (for example name and avatar on a roster; reduced detail when your privacy settings limit visibility).
- Service providers — hosting, database, authentication, email/SMS/push, analytics, and error monitoring processors who act on our instructions.
- Venues / clubs — only what you or an organiser choose to share in session or club contexts.
- Legal & safety — when required by law, or to protect users, the Service, or rights from serious harm or abuse.
6. Privacy controls
In Settings you can control options such as profile visibility, sharing stats with organisers, and location sharing, as well as notification preferences. Turning a control off may limit discovery or organiser features that depend on that data.
7. International transfers
We may process data on infrastructure located outside your country (for example cloud regions used by our providers). Where required, we use appropriate safeguards for those transfers.
8. Retention
We keep account and session records while your account is active and for a reasonable period afterward for security, dispute resolution, and legal compliance. Incomplete signups may be deleted sooner. You may request deletion of your account by contacting support; some records may be retained where we have a lawful need (for example fraud prevention or financial proof metadata).
9. Security
We use industry-standard measures such as encrypted transport (HTTPS), access controls, and database permissions. No method of transmission or storage is 100% secure — please use a strong password and protect your device.
10. Children
Rallio is not directed at children under 13 (or the minimum age required in your country). If you believe we have collected data from a child inappropriately, contact us and we will take steps to delete it.
11. Your rights
Subject to applicable law, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion or restriction of processing
- Object to certain processing
- Withdraw consent where processing is consent-based
- Lodge a complaint with a data protection authority
To exercise these rights, email support@rallio.co. We may need to verify your identity before responding.
12. Cookies & similar technologies
We use cookies and similar technologies for authentication, preferences, and measuring basic product usage. You can control cookies through your browser settings; disabling some may break sign-in or core features.
13. Changes
We may update this Policy from time to time. The "Last updated" date will change when we do. Continued use of the Service after an update means you acknowledge the revised Policy. Material changes may be highlighted in-product or by email when practical.
14. Contact
Privacy requests: support@rallio.co.
See also our Terms of Service.