NILVaultAI Privacy Policy — Data Protection & FERPA Compliance

This Privacy Policy (“Policy”) applies to all personal information collected by Alvorant Inc., doing business as NILVaultAI (“Company,” “we,” “us,” or “our”) through:

• The NILVaultAI website and web application
• Mobile applications (when available)
• APIs and integrations with third-party platforms
• Communications (email, chat, phone) with our team

This Policy applies to all Users of the Platform, including student-athletes, university administrators, conference officials, enterprise customers (apparel companies, sports agencies, accounting firms), professional advisors (CFPs, sports agents, insurance agents), and visitors to our website.

This Policy is designed to comply with all applicable U.S. federal privacy laws and the comprehensive consumer data privacy laws of all 20+ states that have enacted such legislation, including but not limited to California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Delaware (DPDPA), Nebraska (NDPA), New Hampshire (NHPA), New Jersey (NJDPA), Tennessee (TIPA), Minnesota (MNCDPA), Maryland (MODPA), Kentucky (KCDPA), Indiana (INCDPA), Rhode Island (RIDTPPA), and Florida (FDBR).

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, password, role (athlete, administrator, advisor, etc.), institution or organization affiliation.
• Athlete Profile Data: Sport, position, team, eligibility status, enrollment status, academic class year, jersey number.
• NIL Contract Data: Contract terms, deal values, counterparty information, compensation structures, contract duration, and performance terms.
• Financial Information: Banking details for payment processing (processed via PCI DSS-compliant third-party providers such as FIS or Fiserv — we do not store full banking credentials), tax identification numbers (SSN/ITIN for tax reporting purposes, encrypted at rest).
• Tax Information: W-9/W-8BEN forms, state of domicile, competition schedule data for multi-state nexus determination, withholding preferences.
• Communications: Inquiries, support tickets, contact form submissions, AI Agent conversation logs.

2.2 Information Collected Automatically

• Device & Browser Information: IP address, browser type and version, operating system, device identifiers, screen resolution.
• Usage Data: Pages visited, features used, click patterns, session duration, referral URLs, search queries within the Platform.
• Log Data: Server logs, error reports, access timestamps, API call records.
• Location Data: Approximate geographic location derived from IP address (we do not collect precise GPS geolocation unless you explicitly consent).

2.3 Information from Third Parties

• University Systems: Enrollment verification data, Student Information System (SIS) integrations (Banner, Workday, Ellucian) — processed under institutional agreements and FERPA school official designations.
• Third-Party Platforms: Integration data from platforms such as Opendorse, INFLCR, or similar services when you authorize such connections.
• Public Sources: Publicly available athletic roster information, NCAA compliance databases.

2.4 Sensitive Personal Information

We may collect certain categories of sensitive personal information, including:

• Social Security Numbers or Individual Taxpayer Identification Numbers (for tax reporting only)
• Financial account information (processed by PCI-compliant processors)
• Precise geolocation data (only with explicit opt-in consent)
• Information concerning a known minor (under 18) when a parent/guardian manages the account

We process sensitive personal information only for the purposes disclosed in this Policy and obtain opt-in consent where required by applicable state law (including Virginia, Colorado, Connecticut, Oregon, Montana, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, and others requiring affirmative consent for sensitive data processing).

We use your personal information for the following purposes:

3.1 Platform Operations & Service Delivery

• Creating and managing your account
• Processing NIL contracts and facilitating agreement-driven payments
• Performing cap monitoring and allocation modeling
• Generating multi-state tax calculations and withholding estimates
• Preparing NIL Go disclosure forms and compliance reports
• Verifying athlete enrollment status through institutional integrations
• Providing AI Agent responses to compliance and informational queries

3.2 Compliance & Legal Obligations

• Fulfilling NCAA reporting requirements (de-identified, as applicable)
• Generating tax documents (1099-NEC, W-2, state tax filings)
• Processing tax withholdings for international student-athletes (NRA withholding)
• Maintaining FERPA-compliant records for educational institutions
• Responding to lawful subpoenas, court orders, or regulatory inquiries

3.3 Security & Fraud Prevention

• Detecting, preventing, and responding to security incidents
• Verifying user identity and preventing unauthorized access
• Maintaining audit trails for compliance verification

3.4 Improvement & Analytics

• Analyzing usage patterns to improve Platform features and performance
• Training and improving our AI Agent (using de-identified data only)
• Generating aggregated market intelligence reports (fully anonymized)

3.5 Communications

• Sending transactional communications (payment confirmations, compliance alerts)
• Providing customer support
• Sending product updates and feature announcements (with opt-out available)

Data Minimization: In compliance with Maryland’s MODPA and similar state requirements, we collect only the information that is reasonably necessary and proportionate to provide the services you request. We regularly review our data collection practices to ensure minimization.

We do not sell your personal information and have not sold personal information in the preceding 12 months. We share personal information only in the following circumstances:

4.1 With Your Institution or Organization

If you are an athlete affiliated with a university, your NIL activity data, cap allocation data, and compliance records may be shared with authorized administrators at your institution as required for institutional compliance obligations.

4.2 Service Providers

We engage trusted service providers who process data on our behalf under strict contractual obligations, including:

• Cloud infrastructure providers (data hosting and storage)
• Payment processing partners (PCI DSS Level 1 certified)
• Identity verification services
• Customer support platforms
• Analytics providers (receiving only de-identified data)

4.3 Legal & Regulatory

• When required by law, regulation, subpoena, or court order
• To comply with NCAA reporting obligations (de-identified data)
• To federal, state, and local tax authorities as required by law
• To protect the rights, property, or safety of Alvorant Inc., our Users, or the public

4.4 Authorized Integrations

When you authorize integrations with third-party platforms (e.g., Opendorse, accounting software), your data is shared only as necessary to enable the integration and in accordance with the third party’s own privacy policy.

4.5 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of the transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

No Sale of Data: NILVaultAI does not sell, rent, or trade personal information to third parties for monetary or other valuable consideration. This applies under the definitions of “sale” in all applicable state privacy laws, including the broad definitions in California (CCPA/CPRA), Colorado (CPA), and Texas (TDPSA).

Depending on your state of residence, you may have the following rights regarding your personal information. We honor these rights for all U.S. residents regardless of state, applying the highest standard of protection:

5.1 Universal Rights (All Users)

• Right to Know / Access: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions (e.g., legal compliance, completing transactions).
• Right to Correct: Request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: Although we do not sell personal information, you may exercise this right at any time.
• Right to Opt-Out of Targeted Advertising: Opt out of the use of your personal information for targeted advertising purposes.
• Right to Data Portability: Receive a copy of your personal information in a structured, commonly used, machine-readable format.
• Right to Non-Discrimination: Exercise your privacy rights without receiving discriminatory treatment.

5.2 California Residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to limit the use and disclosure of sensitive personal information to purposes necessary to perform services.
• Right to know the categories of sources from which personal information was collected.
• Right to know the business or commercial purpose for collecting personal information.
• Right to know the categories of third parties with whom personal information is shared.
• We do not use or disclose sensitive personal information for purposes other than those permitted under CPRA §1798.121.
• Authorized Agents: You may designate an authorized agent to submit requests on your behalf with proper written authorization.
• Financial Incentives: We do not offer financial incentives for the collection or sale of personal information.

Source: Cal. Civ. Code §§1798.100–1798.199.100

5.3 Virginia Residents (VCDPA)

• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
• Right to appeal our decision regarding a privacy request within a reasonable time.

Source: Va. Code Ann. §§59.1-575 to 59.1-585

5.4 Colorado Residents (CPA)

• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
• We honor Universal Opt-Out Mechanisms (UOOM) including the Global Privacy Control (GPC) signal as required by Colorado law.

Source: Colo. Rev. Stat. §§6-1-1301 to 6-1-1313

5.5 Connecticut Residents (CTDPA)

• Right to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.
• We honor Universal Opt-Out Mechanisms including GPC signals as required by Connecticut law.

Source: Conn. Gen. Stat. §§42-515 to 42-525

5.6 Texas Residents (TDPSA)

• Right to opt out of the processing of personal data for targeted advertising.
• Right to opt out of the sale of personal data (including broad definition covering loyalty programs and discounts).

Source: Tex. Bus. & Com. Code §§541.001–541.205

5.7 Oregon Residents (OCPA)

• Right to obtain a list of specific third parties to whom we have disclosed personal data.
• We honor Universal Opt-Out Mechanisms including GPC signals.
• Enhanced protections for geolocation data and minors’ data.

Source: Or. Rev. Stat. §§646A.570–646A.604

5.8 Additional State Protections

We comply with comprehensive consumer data privacy laws in all states where such laws are enacted, including:

• Montana (MCDPA): Enhanced geolocation and minor data protections.
• Iowa (ICDPA): Consumer access, deletion, and opt-out rights.
• Delaware (DPDPA): Universal Opt-Out Mechanism recognition, broad consumer rights.
• Nebraska (NDPA): Applies to all businesses regardless of revenue or processing thresholds.
• New Hampshire (NHPA): Universal Opt-Out Mechanism recognition.
• New Jersey (NJDPA): Affirmative opt-in consent for processing data of individuals aged 13–17 for targeted advertising.
• Tennessee (TIPA): Affirmative defense for NIST privacy framework conformance (which we maintain).
• Minnesota (MNCDPA): Right to question profiling results and be informed of rationale behind automated decisions. Privacy officer designation required.
• Maryland (MODPA): Strictest data minimization standard (“strictly necessary”). Complete ban on sale of sensitive personal information.
• Kentucky (KCDPA), Indiana (INCDPA), Rhode Island (RIDTPPA), Florida (FDBR), Utah (UCPA): Full compliance with applicable consumer rights and business obligations.

5.9 Exercising Your Rights

To exercise any of these rights, you may:

• Email us at: [email protected]
• Use the in-app privacy settings accessible from your account dashboard
• Submit a request through our website contact form

We will verify your identity before processing any request. Verification may require you to confirm information associated with your account. We will respond to verified requests within 45 days (or 30 days where state law requires), with a possible extension of an additional 45 days for complex requests.

5.10 Right to Appeal

If we decline your privacy request, you have the right to appeal our decision. To appeal, contact us at [email protected] with the subject line “Privacy Appeal.” We will respond to appeals within 60 days. If your appeal is denied, you may contact your state’s Attorney General to file a complaint.

When NILVaultAI processes student education records on behalf of educational institutions, we do so as a “school official” under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. §1232g.

Our FERPA Commitments

• We perform institutional services that the institution would otherwise perform itself.
• We have a legitimate educational interest in the records to which we are given access.
• We operate under the direct control of the institution with respect to the use and maintenance of education records.
• We use personally identifiable information from education records only for the purposes for which the disclosure was made.
• We maintain FERPA-grade data isolation using a three-tenant architecture, ensuring institutional data is logically separated.
• We enter into Data Privacy Agreements (DPAs) with each institutional customer, specifying data access scope, permitted uses, retention periods, and data destruction obligations.

Source: 20 U.S.C. §1232g; 34 C.F.R. Part 99

NILVaultAI is designed primarily for individuals 18 years of age or older. However, we recognize that some high school athletes (particularly in the 45 states permitting high school NIL activities) may be under 18.

Our COPPA Compliance

• We do not knowingly collect personal information from children under 13 without verifiable parental consent.
• For athletes aged 13–17, accounts must be created and managed by a parent or legal guardian.
• In compliance with New Jersey’s NJDPA, we require affirmative opt-in consent before processing data of individuals aged 13–17 for targeted advertising, sale, or profiling.
• Parents/guardians may review, delete, or prohibit further collection of their child’s information at any time by contacting us at [email protected].
• We do not use data collected from minors for any commercial purpose beyond providing the requested Platform services.

Source: 15 U.S.C. §§6501–6506; 16 C.F.R. Part 312

NILVaultAI processes data for international student-athletes competing at U.S. institutions. Specific provisions include:

• Processing of NRA (Nonresident Alien) tax withholding information as required by IRS regulations.
• W-8BEN form processing for international athletes receiving NIL compensation.
• Tax treaty benefit analysis for applicable countries.
• All international athlete data is stored and processed within the United States.

If you are located outside the United States and access the Platform, your information will be transferred to and processed in the United States. By using the Platform, you consent to this transfer.

We implement industry-leading security measures to protect your personal information:

Technical Safeguards

• Encryption: AES-256 encryption at rest; TLS 1.3 encryption in transit for all data transmissions.
• Access Control: Role-Based Access Control (RBAC) with principle of least privilege. Multi-factor authentication (MFA) required for all administrator accounts.
• Architecture: Three-tenant data isolation ensuring institutional data is logically and cryptographically separated.
• Monitoring: 24/7 intrusion detection and prevention systems (IDS/IPS), real-time security event monitoring, and automated threat response.
• Audit Trails: Immutable, append-only logging for all access to sensitive records, capturing user identity, timestamp, action, and affected data.

Organizational Safeguards

• Annual penetration testing by independent third-party security firms.
• Regular penetration testing and vulnerability assessments.
• Employee background checks and mandatory security training.
• Incident response plan with 24–48 hour breach notification procedures as required by state laws.
• Alignment with the NIST Privacy Framework (providing an affirmative defense under Tennessee’s TIPA).

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Retention Periods

• Active Accounts: Data retained for the duration of the account relationship plus 90 days following termination for data export.
• Tax Records: Retained for 7 years following the tax year in compliance with IRS record-keeping requirements (26 U.S.C. §6501).
• NIL Contracts & Compliance Records: Retained for 6 years following contract expiration or the athlete’s last date of eligibility, whichever is later, for NCAA compliance audit purposes.
• FERPA Education Records: Retained in accordance with the terms of each institutional Data Privacy Agreement, and securely destroyed upon agreement termination.
• Server Logs & Analytics: Automatically purged after 24 months.
• AI Agent Conversation Logs: Retained for 12 months, then automatically de-identified for model improvement purposes.

Upon expiration of retention periods, data is securely deleted using cryptographic erasure or NIST SP 800-88 compliant methods.

We use cookies and similar technologies to operate and improve the Platform:

Types of Cookies

• Strictly Necessary Cookies: Required for Platform functionality (authentication, security, session management). Cannot be disabled.
• Performance & Analytics Cookies: Help us understand how you use the Platform. Collected in aggregate and de-identified form. May be disabled.
• Functional Cookies: Remember your preferences (dashboard layout, language settings). May be disabled.

We do not use advertising cookies or tracking pixels for targeted advertising purposes.

You can manage cookie preferences through your browser settings or the cookie preference center in your account settings.

NILVaultAI honors the following opt-out signals:

• Global Privacy Control (GPC): We recognize and honor GPC signals as valid opt-out requests for the sale/sharing of personal data and targeted advertising, as required by California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Oregon (OCPA), Montana (MCDPA), Delaware (DPDPA), Nebraska (NDPA), New Hampshire (NHPA), Minnesota (MNCDPA), and other states mandating Universal Opt-Out Mechanism compliance.
• Do Not Track (DNT): We honor browser-based Do Not Track signals by disabling non-essential analytics tracking when detected.

The Platform may contain links to or integrate with third-party services, including:

• Payment processors (FIS, Fiserv, or similar)
• NIL marketplace platforms (Opendorse, INFLCR)
• University Student Information Systems (Banner, Workday, Ellucian)
• Accounting and tax preparation software

These third parties have their own privacy policies governing their collection and use of your information. We encourage you to review the privacy policies of any third-party service before sharing your information. We are not responsible for the privacy practices of third-party services.

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will post the updated Policy on our website with a new “Last Updated” date.
• We will provide prominent notice through email notification and/or in-app alert at least 30 days before the changes take effect.
• For enterprise customers, material changes will be communicated in accordance with their MSA notification provisions.
• Your continued use of the Platform after the effective date of changes constitutes your acceptance of the updated Policy.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:

For Minnesota residents: As required by MNCDPA, our designated Privacy Officer responsible for compliance is accessible at the email address above.

If you are not satisfied with our response to your inquiry, you may contact your state’s Attorney General’s office to file a complaint.