Skip to main content
NILvault

Privacy Policy

Last updated: July 1, 2026

Your name is your brand — and your data is yours. This policy explains what we collect, why we collect it, how we protect it, and the rights you have over it. It is written to comply with the California Consumer Privacy Act as amended by the CPRA (“CCPA”), the EU and UK General Data Protection Regulation (“GDPR”), the Family Educational Rights and Privacy Act (“FERPA”), the Children’s Online Privacy Protection Act (“COPPA”), and other U.S. state privacy laws. The short version: we encrypt your data, we’re FERPA-aware, and we never sell your information.

1. Who we are & scope

NILvault is operated by Alvorant Inc. (“NILvault,” “we,” “us,” “our”), and we are the controller of your personal information. This policy applies to nilvaultai.com, our web and installable app, and related services (collectively, the “Platform”). It applies to visitors, student-athletes, parents/guardians, and brand or school users worldwide, including residents of California, other U.S. states, and the European Economic Area (“EEA”) and United Kingdom.

2. Information we collect

We collect the following categories of personal information (using the CCPA category framework):

  • Identifiers — name, email address, phone number (if provided), username, and account ID.
  • Account & profile content — school, sport, position, class year, bio, photos, videos, stats, achievements, and anything you add to your media kit or public page.
  • Connected social data — follower counts and engagement metrics, only if you choose to connect your accounts.
  • Commercial & financial information — deals, opportunities, earnings, and payout details you record. We do not store full bank or card numbers; payments are handled by third-party processors.
  • Internet & device activity — pages viewed, features used, approximate location derived from IP address, browser type, and device identifiers.
  • Cookies & similar technologies — see Section 6.
  • Education-related information — limited student information handled with FERPA awareness (see Section 10).
  • Inferences — preferences and interests we derive to surface relevant opportunities and tips.

Sensitive personal information. We do not intentionally collect Social Security numbers, driver’s license numbers, precise geolocation, racial or ethnic origin, health, biometric, or similar sensitive data, and we do not use any such data to infer characteristics. If you voluntarily include such details in free-text fields, please don’t — we ask you not to submit sensitive information we don’t request.

3. How we collect it

  • Directly from you — when you sign up, build your profile, upload content, or contact us.
  • Automatically — through cookies and analytics as you use the Platform.
  • From third parties — social platforms you connect, and infrastructure/analytics providers acting on our behalf.

4. How we use your information & legal bases

We use your information to build your profile and media kit, surface relevant opportunities, track your earnings, help you stay compliant, keep the Platform secure, and improve our services. For users in the EEA/UK, we rely on the following GDPR legal bases:

  • Contract — to provide the account and features you request.
  • Consent — for optional marketing emails, non-essential cookies/analytics, and connecting social accounts. You may withdraw consent at any time.
  • Legitimate interests — to secure, maintain, and improve the Platform and prevent fraud, balanced against your rights.
  • Legal obligation — to comply with applicable laws and lawful requests.

5. We do not sell or “share” your data

We do not sell, rent, or trade your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months, including the personal information of minors under 16. The only time we disclose data is when you explicitly choose to — for example, publishing your public profile or sending your media kit to a brand — or to service providers under contract (Section 7).

6. Cookies, analytics & your choices

We use strictly necessary cookies to run the Platform (such as keeping you logged in) and, with your consent where required, optional analytics cookies to understand usage and improve features. You can control cookies through your browser settings. We honor the Global Privacy Control (“GPC”) and other recognized opt-out preference signals as a valid request to opt out of any sale/sharing where applicable. Because we do not track users across third-party sites for advertising, our response to a “Do Not Track” signal is the same as GPC — we do not sell or share your data.

7. How we disclose information

  • Service providers / processors — hosting, database, email, and analytics vendors who process data only on our instructions under written contracts.
  • At your direction — content you choose to publish or share with brands and schools.
  • Legal & safety — to comply with law, enforce our Terms, or protect the rights and safety of users and the public.
  • Business transfers — in connection with a merger, acquisition, or asset sale, subject to this policy.

8. Data retention

We keep your personal information for as long as your account is active or as needed to provide the Platform, then delete or anonymize it when it is no longer needed, unless a longer period is required by law (for example, tax or dispute-resolution purposes). You can request deletion at any time (Section 9).

9. Your privacy rights

Depending on where you live, you have some or all of the following rights. We will not discriminate against you for exercising them.

California (CCPA/CPRA)

  • Know / access the categories and specific pieces of personal information we collect, use, and disclose.
  • Delete personal information we collected from you.
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of personal information (note: we do neither).
  • Limit the use of sensitive personal information (note: we do not use sensitive PI beyond permitted purposes).
  • Non-discrimination for exercising your rights.

EEA & UK (GDPR)

  • Access, rectification, and erasure (“right to be forgotten”).
  • Restriction of, and objection to, processing.
  • Data portability in a machine-readable format.
  • Withdraw consent at any time without affecting prior processing.
  • Lodge a complaint with your local data protection authority.

Other U.S. states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights to access, correct, delete, and obtain a portable copy of their data, and to opt out of targeted advertising, sale, and certain profiling. You may also appeal a denied request by replying to our decision.

How to exercise your rights. Email [email protected] or use your account settings to view, edit, export, or delete your data. You may also call 888-377-4213. We will verify your identity and respond within the timeframe required by applicable law (generally 45 days for CCPA/U.S. state requests and one month for GDPR requests). You may use an authorized agent to submit a request on your behalf.

10. Student privacy & FERPA

Many of our users are students, so we built NILvault to be FERPA-aware. Where we handle education records on behalf of a school, we act as a “school official” with a legitimate educational interest and use that data only for authorized purposes. We treat education-related information with care, limit access to your records, and give you control over what becomes public. Your public profile only shows what you choose to publish.

11. Children (COPPA)

NILvault is intended for student-athletes 13 and older. We do not knowingly collect personal information from children under 13, and if we learn we have, we will delete it promptly. If you are under 18, we expect a parent or legal guardian to be involved in and consent to your use of the Platform. Parents may contact us to review, correct, or delete their child’s information.

12. Security

  • Data is encrypted in transit (TLS) and at rest.
  • Access is limited to the systems and people who need it to operate the Platform.
  • We use trusted infrastructure providers with strong security practices and review our safeguards regularly.

No method of transmission or storage is 100% secure, but we work hard to protect your information and will notify you and regulators of a breach as required by law.

13. International data transfers

We are based in the United States and process data there. If you access the Platform from the EEA, UK, or elsewhere, your information may be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) to protect your data during international transfers.

14. Changes to this policy

If we update this policy, we’ll post the new version here and update the date above. For material changes, we’ll notify you in-app or by email before they take effect where required.

15. Contact us

Questions about your privacy, or want to exercise a right? Email our privacy team at [email protected] or call 888-377-4213. Postal mail: Alvorant Inc., Attn: Privacy, United States. EEA/UK users may also contact their local supervisory authority.