Privacy Policy

This Privacy Policy applies to personal information NILytical processes in connection with the Services.

It does not apply to websites, applications, or services operated independently by third parties, even when those services link to NILytical or are accessible through the Services.

The information we collect depends on how you use NILytical.

2.1 Account information

When you create or manage an account, we may collect:

• First and last name;
• Email address;
• Password or authentication information;
• Date of birth or age range;
• Parent or guardian information when required;
• Profile information;
• Communication preferences; and
• Account settings.

2.2 Athlete profile information

We may collect information about your athletic and educational background, including:

• School;
• Sport;
• Position;
• Team;
• Graduation year;
• Geographic region;
• Recruiting star rating or classification;
• Recruiting-profile links;
• Athletic achievements;
• Performance statistics;
• Roster status;
• Scholarship or commitment status;
• Social-media platforms and audience metrics; and
• Other information relevant to NIL comparisons.

2.3 Identity and athlete-verification information

To confirm that an account belongs to a student-athlete, we may collect:

• A student identification card;
• A school roster screenshot or link;
• A school-issued email address;
• A recruiting-profile link;
• A photograph;
• School, team, or graduation information;
• Verification status and review notes; and
• Other documentation reasonably necessary to confirm identity or athlete status.

Verification materials may contain information such as your name, photograph, school, student status, or identification number.

You should conceal or remove information that is not necessary for verification before uploading a document.

Do not submit Social Security numbers, financial-account numbers, medical information, passport information, driver’s-license information, or other highly sensitive information unless we specifically request it and explain why it is necessary.

2.4 NIL offer and agreement information

When you submit an NIL offer or opportunity, we may collect:

• Offer amount;
• Guaranteed compensation;
• Potential bonuses or incentives;
• Cash and noncash compensation;
• Contract or offer duration;
• Payment timing;
• Deliverables;
• Content-posting requirements;
• Appearance obligations;
• Exclusivity terms;
• Usage-rights terms;
• Termination provisions;
• Brand, sponsor, collective, agency, or school category;
• Offer date;
• Offer status;
• Sport, position, location, or other comparison attributes;
• Written descriptions;
• Screenshots or supporting documents; and
• Information concerning whether an offer was accepted, rejected, negotiated, or completed.

You should not submit an entire contract or confidential agreement unless NILytical requests it and you have the legal right to provide it.

2.5 Communications

When you contact us, we may collect:

• Your name and contact information;
• The contents of your message;
• Support records;
• Survey responses;
• Feedback; and
• Other information you choose to provide.

2.6 Device, usage, and technical information

When you use the Services, we and our service providers may automatically collect:

• Internet Protocol address;
• Browser type;
• Device type;
• Operating system;
• Language settings;
• Approximate location derived from an IP address;
• Referring and exit pages;
• Pages and features viewed;
• Dates and times of access;
• Session duration;
• Clicks and interactions;
• Error logs;
• Authentication and security events;
• Cookie or similar-technology identifiers; and
• Other diagnostic and usage information.

2.7 Information from third parties and public sources

We may obtain information from:

• Public school or team rosters;
• Recruiting websites;
• Public social-media profiles;
• Authentication providers;
• Identity- or athlete-verification providers;
• Analytics and security providers;
• Public athletic statistics;
• Other users who submit information; and
• Publicly available sources.

We may combine information from these sources with information you provide.

We may use personal information to:

3.1 Provide the Services

• Create and maintain accounts;
• Authenticate users;
• Verify identity and athlete status;
• Process NIL-offer submissions;
• Generate comparisons, ranges, percentiles, charts, and confidence scores;
• Personalize results by sport, position, recruiting classification, or other relevant attributes;
• Provide customer support; and
• Communicate about accounts and the Services.

3.2 Protect data quality and platform integrity

• Review submissions;
• Detect false, duplicate, manipulated, or suspicious entries;
• Prevent unauthorized access;
• Enforce account restrictions;
• Investigate misuse;
• Protect athletes’ anonymity;
• Monitor security; and
• Enforce our Terms of Service.

3.3 Create aggregated and deidentified analytics

We may combine or deidentify information to:

• Calculate NIL market ranges;
• Produce aggregate compensation statistics;
• Identify market trends;
• Compare categories of athletes or offers;
• Establish minimum sample sizes;
• Improve confidence scoring;
• Prepare research and educational reports; and
• Improve our benchmarking methods.

We do not intend to display your name with your individual NIL-offer data unless you expressly authorize us to do so.

3.4 Develop and improve NILytical

We may use information to:

• Understand how users interact with the Services;
• Test and improve features;
• Conduct internal research;
• Correct errors;
• Develop analytical or statistical models;
• Evaluate the accuracy and fairness of our comparisons; and
• Create new products and services.

Before using identifiable athlete information to train a general-purpose artificial-intelligence model operated by an unrelated third party, we will provide any notice or obtain any consent required by applicable law.

3.5 Communicate with you

We may send:

• Verification requests;
• Security alerts;
• Support responses;
• Service announcements;
• Policy updates;
• Surveys;
• Educational information;
• Product updates; and
• Marketing communications where permitted by law.

You may opt out of nonessential promotional emails, but you may continue to receive service-related communications.

3.6 Comply with law and protect rights

We may process information to:

• Comply with legal obligations;
• Respond to lawful requests;
• Establish, exercise, or defend legal claims;
• Protect NILytical, our users, and others;
• Prevent fraud or illegal conduct; and
• Enforce our agreements.

We may disclose information in the following circumstances.

4.1 Service providers

We may disclose information to vendors that perform services for us, such as:

• Website and cloud hosting;
• Database storage;
• Authentication;
• Email delivery;
• Customer support;
• Security monitoring;
• Analytics;
• Identity or athlete verification;
• Document processing;
• Error reporting; and
• Legal, accounting, or professional services.

Service providers may process information only for authorized purposes and subject to appropriate contractual restrictions.

4.2 Aggregated or deidentified information

We may disclose statistics, reports, or other information that has been aggregated or deidentified so that it is not reasonably linked to an individual athlete.

Examples may include:

• Typical offer ranges by sport;
• Compensation percentiles;
• Market trends;
• General recruiting-rating comparisons;
• Regional comparisons; and
• Sample-size or confidence information.

We may provide aggregated or deidentified information to users, researchers, educational institutions, media organizations, partners, or the public, provided that doing so is consistent with our commitments and applicable law.

4.3 Business transfers

If NILytical is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or transfer of all or part of the business, information may be disclosed or transferred as part of that transaction.

Any recipient will be subject to applicable privacy obligations.

4.4 Legal and safety disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with a subpoena, court order, warrant, or other legal process;
• Respond to a government request;
• Protect the safety, rights, or property of NILytical, our users, or others;
• Investigate fraud, security incidents, or violations of our Terms;
• Prevent illegal activity; or
• Establish, exercise, or defend legal claims.

Where legally permitted and appropriate, we may notify affected users of requests seeking their identifying information.

However, we cannot promise that we will challenge every request or that advance notice will always be possible.

4.5 At your direction or with your consent

We may disclose information when you direct us to do so or provide consent.

Unless you direct us to disclose it or disclosure is otherwise described in this Policy, NILytical does not intend to publicly display:

• Your identity-verification documents;
• Your student ID;
• Your private email address;
• Your individual NIL agreement or offer screenshot;
• Your name connected to your individual NIL offer;
• Your account password; or
• Private communications with NILytical.

NILytical’s public or member-facing analytics are intended to use anonymized or aggregated data.

NILytical uses measures designed to reduce the chance that market information can be connected to a particular athlete. These measures may include:

• Removing names and direct identifiers;
• Aggregating multiple submissions;
• Requiring minimum sample sizes;
• Suppressing narrow categories;
• Rounding figures;
• Combining categories;
• Delaying data publication;
• Limiting filters; and
• Restricting market data to verified users.

Despite these measures, no system can guarantee complete anonymity.

An athlete may be identifiable or inferable when a data category is unusually small, the athlete has unique characteristics, an offer has been publicly discussed, or several pieces of information are combined.

Users are prohibited from attempting to reidentify athletes from NILytical data.

7.1 Users under 13

The Services are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13.

A child under 13 may not create an account or submit information.

If we learn that we collected personal information from a child under 13 without legally valid parental consent, we will take reasonable steps to delete it.

Parents and guardians may contact support@nilytical.com concerning a child’s information.

7.2 Teen users

Many student-athletes are minors. Users between 13 and 17 may use NILytical only with the permission of a parent or legal guardian.

We may request information reasonably necessary to confirm age, guardian consent, or guardian authority.

7.3 Information about other minors

Users may not submit unnecessary personal information about another minor.

When submitting an offer, screenshot, or document, users should redact the names, contact information, signatures, and identifying details of other minors unless there is a lawful reason to provide that information.

NILytical and its service providers may use cookies, local storage, pixels, software-development kits, and similar technologies to:

• Keep users signed in;
• Remember settings;
• Maintain security;
• Prevent fraud;
• Understand site usage;
• Diagnose errors;
• Improve performance; and
• Measure communications.

You may be able to control certain cookies through your browser settings. Disabling necessary cookies may prevent parts of the Services from functioning.

Where required by law, we will request consent before using nonessential cookies or similar technologies.

NILytical does not sell personal information for money.

NILytical does not knowingly sell or share the personal information of users under 16 for cross-context behavioral advertising.

If our practices change in a way that constitutes a “sale” or “sharing” under applicable privacy law, we will update this Privacy Policy and provide any legally required notice and opt-out mechanism.

The disclosure of information to service providers that process it on NILytical’s behalf is not intended to constitute a sale of personal information.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to:

• Maintain an account;
• Provide comparisons and analytics;
• Verify users and submissions;
• Protect platform integrity;
• Resolve disputes;
• Enforce agreements;
• Comply with legal obligations; and
• Maintain appropriate business records.

Retention periods depend on the type of information and why it was collected.

10.1 Account information

Account information is generally retained while an account remains active and for a reasonable period afterward for security, fraud prevention, dispute resolution, and legal compliance.

10.2 Verification documents

Identity- and athlete-verification documents will be retained only for as long as reasonably necessary to complete verification, address fraud or disputes, comply with law, and maintain platform integrity.

Where feasible, NILytical may retain a verification result rather than the underlying document.

10.3 NIL submissions

Identifiable NIL submissions may be retained while your account remains active and afterward as reasonably necessary for the purposes described above.

When an account or submission is deleted, information may remain temporarily in backups, security logs, fraud-prevention records, or records required by law.

10.4 Aggregated and deidentified information

We may retain information that has been properly aggregated or deidentified because it is no longer reasonably linked to an identifiable person.

NILytical uses administrative, technical, and organizational safeguards designed to protect personal information.

Depending on the nature and maturity of the Services, safeguards may include:

• Access controls;
• Authentication;
• Encryption in transit;
• Encryption at rest where supported;
• Restricted administrative access;
• Logging and monitoring;
• Vendor controls;
• Data minimization;
• Secure development practices; and
• Incident-response procedures.

No security system is perfect. We cannot guarantee that information will never be accessed, lost, altered, or disclosed without authorization.

You are responsible for protecting your password and account credentials and for promptly notifying us of suspected unauthorized access.

Depending on where you live, you may have the right to:

• Confirm whether we process your personal information;
• Access personal information we maintain about you;
• Correct inaccurate information;
• Delete certain personal information;
• Obtain a portable copy of certain information;
• Restrict or object to certain processing;
• Withdraw consent where processing is based on consent;
• Opt out of certain sales, sharing, targeted advertising, or profiling;
• Appeal the denial of a privacy request; and
• Receive equal service without unlawful discrimination for exercising a privacy right.

These rights may be subject to exceptions and identity-verification requirements.

12.1 Submitting a request

You may submit a privacy request by emailing support@nilytical.com.

Your request should state:

• Your name;
• The email associated with your account;
• The right you wish to exercise; and
• Any information reasonably necessary to locate your records.

We may ask you to verify your identity before processing a request.

A parent or legal guardian may submit a request on behalf of a minor. An authorized agent may submit a request where permitted by law, but we may require proof of authority and direct verification from the user.

12.2 Account deletion

You may request deletion of your account and associated identifiable information. You can also delete your account directly from your profile page.

Deletion may not remove:

• Aggregated or deidentified statistics;
• Information we must retain by law;
• Security and fraud-prevention records;
• Records necessary to resolve disputes or enforce agreements;
• Information contained in temporary backups until overwritten; or
• Information lawfully provided by another source.

12.3 Correcting NIL submissions

Because accurate data is essential to NILytical’s benchmarking, you may ask us to correct or remove inaccurate offer information associated with your account.

This section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to NILytical.

The categories of personal information NILytical may collect include:

• Identifiers;
• Customer-record information;
• Internet or electronic-network activity;
• Geolocation information at an approximate level;
• Education-related information;
• Professional or athletic information;
• User-submitted financial or commercial information concerning NIL offers;
• Inferences used to generate comparisons; and
• Sensitive personal information, such as account credentials and information contained in verification documents.

We collect these categories from users, devices, service providers, public sources, and third parties described in this Policy.

We use and disclose these categories for the business and commercial purposes described in Sections 3 and 4.

NILytical does not sell personal information for money and does not knowingly sell or share the personal information of users under 16 for cross-context behavioral advertising.

California residents may request access, correction, deletion, or information about applicable data practices by contacting support@nilytical.com.

We will not unlawfully discriminate against you for exercising a CCPA right.

California’s “Shine the Light” law may allow certain residents to request information regarding disclosures of personal information to third parties for their direct-marketing purposes. NILytical does not currently disclose personal information to third parties for their own direct-marketing purposes without consent.

Residents of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, and other jurisdictions may have additional privacy rights under applicable state law.

Where required, NILytical will honor valid requests to:

• Access;
• Correct;
• Delete;
• Obtain a portable copy;
• Opt out of targeted advertising, sales, or certain profiling; and
• Appeal a denied request.

To appeal a decision, email support@nilytical.com with the subject line “Privacy Appeal” and explain why you believe the decision should be reconsidered.

NILytical is operated from the United States.

If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States and other locations where our service providers operate.

Privacy laws in those locations may differ from the laws where you live.

If NILytical begins intentionally offering the Services in the European Economic Area, United Kingdom, Switzerland, or other regions with additional requirements, this Policy may be supplemented with region-specific notices.

NILytical uses automated calculations and statistical methods to generate estimated NIL ranges, comparison groups, percentiles, and confidence scores.

These outputs may be based on attributes such as:

• Sport;
• Position;
• Recruiting classification;
• Geographic region;
• Athletic performance;
• Audience size;
• Engagement statistics;
• Offer type;
• Compensation structure; and
• Available comparison data.

These automated outputs are informational estimates. They do not make legally binding decisions about users and do not determine eligibility, employment, admission, scholarships, contracts, or access to essential services.

You may contact support@nilytical.com with questions concerning a result or to report information you believe is inaccurate.

NILytical may use third-party providers for hosting, authentication, databases, analytics, email, verification, security, or other functions.

Those third parties may process personal information on our behalf or under their own privacy policies, depending on the service.

NILytical may also link to external websites. We are not responsible for the content or privacy practices of independently operated third-party websites.

You should review the privacy policies of third-party services you use.

If we discover a security incident involving personal information, we will investigate and take reasonable steps to contain and remediate it.

We will notify affected individuals and government authorities when required by applicable law.

We may update this Privacy Policy to reflect changes to:

• Our Services;
• Our data practices;
• Our service providers;
• Applicable law; or
• Security and operational requirements.

We will post the revised Policy and update the “Last Updated” date.

When legally required, we will provide additional notice or request consent before materially changing how previously collected personal information is used.

Questions, complaints, or privacy requests may be sent to:

NILytical

Email: support@nilytical.com

Mailing address: [INSERT BUSINESS MAILING ADDRESS]

Legal entity name: [INSERT LEGAL ENTITY NAME]

For privacy requests, use the subject line: Privacy Request