Your privacy, your choice

Cookie policy

Last updated: 24 October 2026 · Version 2026-10-24.production-ga4.1

This policy covers rallytravelretreats.com, the Rally Travel Retreats website. It describes the technologies actually used here. It does not describe your bank’s app.

What cookies and browser storage do

Cookies are small values stored by your browser and sent to a website. Local storage keeps information on your device for that website; session storage keeps it for the current browser tab. We explain both because your choices apply to similar storage technologies too.

You can browse and use checkout with analytics and marketing switched off. Continuing to browse, scrolling, or closing the preferences panel does not give consent.

Your choices

Necessary — always on: remembers your privacy choices and supports the payment return flow you request.
Analytics — off by default: uses Google Analytics 4 through Google Tag Manager to measure visits, newsletter signups, enquiries, checkout progress and verified payments. Google scripts load only after you allow analytics.
Marketing — off by default: would support advertising or campaign measurement. No marketing cookies or scripts are currently installed.

Accept all allows both optional categories. Reject optional keeps them off. Manage preferences lets you save each category separately. Accepting analytics allows the Google measurement described below. Advertising tags are not installed.

Open Cookie settings to change or withdraw your optional choices. The same control is in the footer throughout the browsing and checkout pages. Changes apply immediately on this site. If an optional integration is running when you withdraw permission, the page reloads to stop it.

We remember your choice for 180 days on this browser and website origin, then ask again. We also ask again when the consent version changes. Clearing site data or using another browser resets your choice. If your browser prevents storage, the choice applies only to the current page and we tell you it cannot be saved.

Storage inventory

The following storage is used by this implementation. Optional Google measurement is blocked until you allow analytics.

Rally website storage and when it is created
Name / provider	Type / category	Purpose and trigger	Duration
rally-cookie-consent Rally, this website origin	Local storage Necessary	Created only when you accept, reject or save preferences. Stores category choices, policy version and saved/expiry timestamps. Contains no name, email or payment details. When you allow analytics, also stores a random withdrawal token used only by Rally to cancel pending analytics.	Valid for 180 days. An expired record is ignored and replaced after your next choice; the stored value can remain until then or until you clear site data.
rally-zelle-booking-v1 Rally, this website origin	Session storage Necessary for requested checkout	Stores your booking reference and private status token so your payment instructions and status can be restored. No bank credentials are stored.	Current tab session; browser session restore may retain it.
_ga and _ga_* Google Analytics	First-party cookies Optional analytics	Recognise consented visits and link checkout activity to verified payments. Created only after analytics consent.	Google’s default is up to two years and may refresh with use. Rally’s analytics permission expires after 180 days.
rally-analytics-lead Rally	Session storage Optional analytics	A form type and timestamp identify an enquiry return page without storing form values.	Current tab session; ignored after 30 minutes and removed after measurement or withdrawal.
Marketing	Optional	No marketing cookies, storage or scripts installed.	Not applicable

External resources and payments

These resources are present in the site. A request to an external provider can disclose ordinary connection information, including your IP address and browser details, even when it sets no cookie.

Render: hosts the site and booking service. The browser audit observed no Render cookies. Backend readiness requests run on checkout without optional consent.
Google Analytics 4 and Google Tag Manager: optional measurement after analytics consent. Rally sends room type, USD amount, payment method, interaction names and an opaque transaction identifier, without guest form values or bank details. With your consent, Rally securely stores your Google client/session IDs alongside a payment reference for up to the remaining 180-day consent period so verified payments can be measured after you close the page. These IDs are erased on expiry or withdrawal. A withdrawal token lets the site cancel pending server reporting. Events already sent to Google are not removed automatically by withdrawal. Advertising consent stays denied. Google privacy policy.
Google Fonts: supplies fonts on existing pages. No cookies were observed in the audited font requests.
Leaflet via unpkg: supplies the map library and styling. The library is presentation code, not an analytics tracker; no cookies were observed.
Esri / ArcGIS and OpenStreetMap: provide satellite and street-map tiles. Satellite tiles load as you approach the map; street tiles load when the map switches to that view. No cookies were observed during the satellite-map audit.
Image providers: the stylesheet and gallery definitions also reference Unsplash, Sole Mio, Hotels.com’s image CDN and Expedia’s image CDN. When displayed, externally hosted images send ordinary connection information. These are image resources, not installed analytics or advertising scripts.
FormSubmit: enquiry forms reference this email service. Submitting an enquiry sends your chosen contact details and message to Mark; browsing alone does not submit a form.
Stripe: card payment uses a hosted checkout reached only when you choose to continue to payment. No Stripe JavaScript or iframe is loaded on Rally’s browsing pages. Stripe may use its own necessary payment and fraud-prevention technologies on its domain; those were not enumerated by this Rally-site audit. See Stripe’s cookie policy.
Zelle and your bank: transfers happen in your banking service. Rally does not embed Zelle tracking code. Your bank’s own storage is governed by its policies.

Rejecting optional categories does not prevent these existing presentation resources or the payment service you request from working. The audit is a record of the current site and observed requests, not a guarantee about every provider, browser or future update.

Updates and questions

Any new analytics or marketing provider must be added behind the relevant consent control, documented in this inventory and released with a new consent version before use. Optional categories remain disabled until an applicable provider is configured.

You can also remove site data using your browser settings. Removing necessary payment session storage during a payment journey can stop the return page from displaying its status; contact Rally instead of paying twice.

For questions, contact Mark at mark@rallytravelretreats.com. Read our privacy notice for information about enquiries and checkout data.