Privacy Policy

VowRally (“VowRally”, “we”, “us”) makes booking software for wedding vendors (“vendors”, “you”) — photographers, videographers, DJs, florists, planners, hair and makeup artists and similar businesses. This policy explains what we collect, why, who we share it with, and how to have it deleted. It covers vowrally.com, the VowRally app, and the booking links vendors send to their clients.

Two roles. For your own account (your name, email, subscription) we are the controller. For the data you store about your clients — couples, parents and other contacts — you are the controller and we process it on your behalf, under our Data Processing Addendum. If you are a couple and have a question about your data, contact the vendor you booked; we will help them respond.

What we collect

Account information

• Your name, email address, business name, time zone, logo and branding choices.
• Sign-in records (we use emailed magic links; we do not store passwords).
• Subscription status and plan. Your card details for our subscription are collected and stored by Stripe, not by us.

Studio and client (CRM) data

• Contacts you add or that arrive through your inquiry form: names, emails, phone numbers, wedding date, venue, guest count, notes.
• Jobs, packages, pricing, questionnaires, shot lists, gallery links you paste in, and files you upload.
• Messages between you and your clients that pass through VowRally.

Contracts and e-signature records

• The agreement text and each version sent, the signer's typed name and email, the e-records consent they gave, and when they signed.
• The signer's IP address and browser user agent, portal access times, and a fingerprint (hash) of the signed PDF. These make up the audit certificate that shows who signed what and when.

Payment metadata

• Payments from couples are processed by Stripe on the vendor's own Stripe account. We receive metadata such as amount, status, payment method type (for example “card” or “bank account”), last four digits, and Stripe IDs. We never see or store full card numbers or bank account numbers — Stripe handles that data under its own privacy policy.

Inquiry emails

• If you forward inquiries to your VowRally inbound address, we receive and store those emails, including headers and attachments, so we can file them against the right job and draft a reply. We do not read your personal mailbox.

Calendar data (Google)

• If you connect Google Calendar, we read free/busy times so we can check whether a wedding date is open and avoid double-booking. We do not need or store event titles, descriptions or attendees for this feature.

Usage and device data

• Basic server logs (IP address, browser, pages requested, errors) used for security, debugging and preventing abuse.

Google user data — Limited Use

VowRally's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve user-facing availability and calendar features inside VowRally.
• We do not use Google user data for advertising, including retargeting or interest-based ads.
• We do not sell Google user data.
• Google user data may be processed by our AI provider only to draft replies for you (for example, “that date is open”). It is not used to train or improve general AI models, ours or anyone else's.
• People at VowRally do not read Google user data unless you ask us to for support, it is needed for security or to comply with law, or it has been aggregated and anonymized for internal operations.

You can disconnect Google Calendar at any time in Settings or from your Google Account permissions page.

How we use data

• To run the service: store your CRM, check dates, send booking links, collect signatures, record payments, send reminders.
• To draft replies with AI when you use the booking agent. Drafts are suggestions; you decide what is sent.
• To bill your subscription and send account and security emails.
• To keep the service secure, prevent fraud and abuse, and fix problems.
• To comply with legal obligations and enforce our Terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your data or your clients' data to train AI models. Our AI provider processes it through its API under terms that prohibit training on it.

Who we share data with

We share data only with service providers (subprocessors) that help us run VowRally, with the vendor a client is booking, when required by law, or as part of a merger or sale of the business (with notice to you). Our current subprocessors:

We will update this list before adding a new subprocessor that handles client data.

How long we keep data

• Account and CRM data: while your account is active, and for 30 days after your plan ends so you can export it or return.
• E-signature audit records (signed agreements, audit certificates, IP and user agent logs): for the life of your account plus 7 years, so that signed agreements can be proven if there is a dispute — unless you request deletion and the law allows it.
• Billing records: as long as tax and accounting law requires.
• Server logs: typically up to 30 days.

Your rights and deletion requests

Depending on where you live (for example, California and other US states with privacy laws, or the EU/UK), you may have the right to access, correct, delete or get a copy of your personal information, and to opt out of certain uses. We honor these requests for everyone, not just residents of those places, and we will not treat you differently for making one.

Email support@vowrally.com from the address on your account. We may need to verify your identity. We aim to respond within 30 days. If you are a vendor's client, we will forward your request to the vendor, who controls that data, and help them carry it out.

Cookies

We use only essential cookies — to keep you signed in and to protect forms from abuse — plus cookies set by Stripe on payment pages to process payments and prevent fraud. We do not use advertising or cross-site tracking cookies.

Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access is restricted by account, and each studio's data is isolated from other studios at the database level. No system is perfectly secure; if a breach affects your data we will notify you as the law requires.

Children

VowRally is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

International users

We are based in the United States and store data in the US. If you use VowRally from outside the US, your data will be transferred to and processed in the US. See our DPA for how we handle EU and UK data.

Changes

If we make a material change, we will email account owners and update the date above before it takes effect.

Contact

Questions or requests: support@vowrally.com.
VowRally, [LEGAL ENTITY NAME], [MAILING ADDRESS].