Privacy policy
1. Who is responsible
True Meridian AI, which operates Rally, is accountable for the personal information in its custody. We handle it under the Personal Information Protection and Electronic Documents Act (PIPEDA).
Our Privacy Officer can be reached at caelen@truemeridianai.com.
2. What we collect
From the early access form
If you fill in the form on our website we collect your name, email address, whether you identify as a young person or an organization, and whatever you write in the message box. We use it only to contact you about Rally becoming available. We do not add you to a newsletter and we do not pass it to anyone else.
From Participants
| Information | Why we need it |
|---|---|
| Name, email, phone | To create your account and let Organizations contact you about a placement. |
| Date of birth | To confirm you are 15 to 25, and to work out whether guardian consent is required. |
| Postal code, and travel range | To rank listings by how far you would have to travel. We use the area, not a precise address. |
| Strengths survey answers, and the themes produced from them | To rank listings by fit. Explained in section 5. |
| Applications, placements, check ins, and confirmed hours | To run the service and to build the hours record you can export. |
| Guardian name and contact details, where you are under 16 | To request and record consent. |
| Messages sent through the Platform | To deliver them, and to investigate safety reports. |
| Device type, app version, IP address, and pages or screens used | To keep the service working and secure, and to fix faults. |
From Organizations
Contact details for the people who administer the account, the Organization's name and registered status, listing content, and billing details. Payment card details go directly to Stripe; we do not receive or store them.
What we do not collect
We do not ask for a Social Insurance Number, health information, or precise background-check results. We do not buy personal information from data brokers, and we do not track you across other websites.
3. Consent
We collect, use, and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise.
You give express consent when you create an account, when you complete the strengths survey, and when you apply to a listing, which releases specific information to that Organization. We tell you what is being shared at the point you apply.
Participants under 16
If you are under 16, we ask for a parent or guardian's contact details during registration and send them a request to approve the account. The account stays inactive until they approve it. We also ask them to approve each placement before it starts.
We collect the guardian's name, email, and relationship to you, and use it only for consent and for contacting them about your use of Rally.
A guardian can review what we hold about the young person, ask us to correct it, or withdraw consent at any time by writing to caelen@truemeridianai.com. Withdrawing consent closes the account.
Withdrawing consent
You can withdraw consent at any time, subject to legal and contractual limits, by closing your account or writing to us. We will tell you what withdrawing means in practice. Some of it, such as records of confirmed hours already relied on by an Organization, may need to be retained.
4. How we use it
- To create and run your account.
- To rank and show listings that fit.
- To pass an application to the Organization you applied to.
- To record check ins and confirmed hours, and to produce your exportable record.
- To request and record guardian consent.
- To take payment from Organizations and to process performance bonuses.
- To respond to support requests and safety reports.
- To keep the Platform secure and to prevent fraud and misuse.
- To understand how the Platform is used, in aggregate, so we can improve it.
- To meet legal obligations.
We will not use your information for a new purpose without asking, unless the law allows it.
5. The strengths survey and automated ranking
The survey sorts your answers into strengths themes. Those themes, your postal area, and your stated travel range are used to rank listings. The ranking is produced automatically.
It affects the order in which you see things. It does not decide anything about you. It does not gate access to listings, and it is not shown to Organizations as a score. When you apply, an Organization sees your strengths themes as context alongside your application; it does not see your individual survey answers.
You can retake the survey whenever you want, which replaces the previous result. You can ask us for a plain-language explanation of how a ranking was produced.
6. Who we share it with
Organizations you apply to
When you apply, that Organization receives your name, age or age band, contact details, strengths themes, approximate distance, and anything you wrote in the application. Where you are under 16, it also receives confirmation that guardian consent is on file. Organizations that host you also receive your check in and hours records.
Organizations are separately responsible for the information they receive. What they do with it is governed by their own privacy practices, not this policy.
Service providers
We use a small number of companies to run the Platform. They may access personal information only to do the work we have asked them to do, under contracts requiring protection comparable to ours.
| Provider | What it does for us |
|---|---|
| Vercel | Hosts and serves the website and app front end. |
| Supabase | Runs our database, file storage, and account authentication. Most personal information described above lives here. |
| Stripe | Processes Organization subscription payments and performance bonus payouts. Stripe receives payment details directly. |
| Resend | Delivers transactional email, including email verification, guardian consent requests, and shift reminders. |
We also use GitHub to store our source code. It holds no personal information about users.
Legal and safety
We may disclose information where the law requires it, to respond to a valid legal demand, to establish or defend a legal claim, or where we reasonably believe it is necessary to prevent serious harm to a person. If we believe a young person is at risk we may contact police or a children's aid society.
Business changes
If Rally is sold or merged, personal information may transfer as part of that, subject to the buyer honouring this policy. We will give notice before any transfer takes effect.
We do not sell personal information, and we do not share it with advertisers.
7. Where it is stored
Our database is hosted with Supabase. Vercel serves the site from edge locations in several countries. Stripe and Resend both operate from the United States.
This means personal information is stored or processed outside Canada, including in the United States. Information held in another country is subject to that country's laws and may be accessible to its courts, law enforcement, and national security authorities. By using Rally you consent to that transfer. Write to us if you would like more detail about where a particular category of information sits.
8. How long we keep it
| Category | Retention |
|---|---|
| Early access form submissions | Until Rally launches in your area and we have contacted you, then 12 months. |
| Account and profile | While the account is open, then 12 months after closure. |
| Confirmed hours records | 7 years, so a record can be reissued if a school queries it. |
| Guardian consent records | 7 years after the account closes, as proof consent was obtained. |
| Messages | 24 months. |
| Safety reports and investigations | 7 years. |
| Billing records | As long as tax law requires, currently 6 years. |
| Technical logs | 90 days. |
When a retention period ends we delete the information or render it anonymous.
9. How we protect it
We use encryption in transit and at rest, access controls that limit staff access to what their role requires, logging of access to participant records, and regular review of our providers. No system is perfectly secure, and we do not claim otherwise.
If a breach creates a real risk of significant harm, we will report it to the Privacy Commissioner of Canada and notify affected people as PIPEDA requires.
10. Your rights
You can ask us to:
- confirm whether we hold personal information about you, and give you access to it;
- tell you how it has been used and who it has been disclosed to;
- correct anything inaccurate or incomplete;
- delete your account and the information attached to it, subject to what we must keep;
- give you a copy in a portable format;
- withdraw consent.
Write to caelen@truemeridianai.com. We respond within 30 days, and will tell you if we need an extension and why. Access is free in ordinary cases; if a request needs unusual effort we will tell you the cost before doing the work. We may need to verify your identity first. Where the account belongs to someone under 16, a guardian on file can make these requests.
11. Complaints
If you are unhappy with how we have handled your information, write to our Privacy Officer at caelen@truemeridianai.com. We will investigate and reply in writing.
If you are still not satisfied you can complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec, K1A 1H3, or through priv.gc.ca.
12. Cookies
Our use of cookies and similar technologies is described in the Cookie Policy.
13. Changes
We may update this policy. If a change materially affects how we handle your information we will give notice by email or in the app before it takes effect, and where the law requires it we will ask for fresh consent. The date at the top shows when this version was published.
14. Contact
Privacy Officer, True Meridian AI
caelen@truemeridianai.com