Privacy Policy

NIL Ledger ("we," "us," or "our"), a trade name of Athlete Infrastructure LLC, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at nilledger.com and any related applications (collectively, the "Service"). By using the Service, you agree to the collection and use of information as described in this policy.

1. Information We Collect

A. Information You Provide Directly

• Account registration: name, email address, password, sport, school, and position. For Agency accounts: agency name, team member names and emails, and roles.
• Phone number: optional for athlete accounts and required for Agency accounts, used for account and transactional communications and, only with your separate consent, SMS messages (see Section 2b).
• Public roster opt-in: if an athlete chooses to appear on an Agency's public roster, we collect the athlete's date of birth solely to confirm they are 18 or older. It is not displayed publicly.
• Financial data: NIL income, expenses, brand deal details, payment amounts, and dates
• NIL deal information: brand names, contract values, payment schedules, and deliverables
• Compliance log entries: disclosure records, NCAA-related notes, and any contract documents you choose to attach to a compliance record for your own records
• Communications you send us, including support requests
• Marketing preferences: your opt-in or opt-out choice for communications about other Athlete Infrastructure LLC products and services

Payment Information: When you begin your free trial, we collect your credit card information, including card number, expiration date, and CVV, which is transmitted directly to and stored by our payment processor, Stripe, Inc. We do not store your full card number on our servers. Stripe stores and encrypts your payment information in accordance with PCI-DSS Level 1 standards. Your card will not be charged until the conclusion of your 7-day free trial period.

B. Information Collected Automatically

• Log data: IP address, browser type, pages visited, time and date of visits
• Device information: device type, operating system, unique device identifiers
• Usage data: features used, actions taken within the Service
• Cookies and similar tracking technologies (see Section 8)

C. Financial Account Data (Elite Plan — Plaid Integration)

If you connect a bank account through our Plaid integration (available on the Elite plan), we collect transaction data, account balances, and institution information through Plaid Technologies, Inc. We do not store your bank login credentials. Plaid's privacy policy is available at plaid.com/legal.

2. How We Use Your Information

• Provide, operate, and maintain the Service
• Process transactions and manage your subscription via Stripe, including storing your payment method for billing at the end of your free trial
• Automatically categorize imported transactions as NIL income types or athlete expenses
• Generate tax reserve calculations and financial summaries
• Send payment reminders and account notifications
• Generate CPA-ready export reports at your request
• Respond to your support requests and communications
• Send marketing communications about other products and services offered by Athlete Infrastructure LLC, but only if you have opted in at signup or subsequently
• Improve and develop new features of the Service
• Comply with applicable legal obligations
• Detect and prevent fraud or abuse of the Service

We do not sell your personal information to third parties. We do not use your financial data for advertising purposes.

2a. Marketing Communications

During account registration, you are given the option to opt in to receive marketing communications about other products and services offered by Athlete Infrastructure LLC. This opt-in is entirely voluntary and is presented as an unchecked checkbox — you will not receive marketing communications unless you affirmatively select this option.

You may opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email we send
• Contacting us at support@nilledger.com

Opting out of marketing communications will not affect your NIL Ledger account, subscription, or access to the Service. We will never share your contact information with third parties for their own marketing purposes.

2b. SMS / Text Messaging

If you provide a phone number, you may separately consent to receive text messages (SMS) from NIL Ledger at that number by checking the consent box presented at signup. This consent is entirely optional and is not a condition of purchasing or using the Service. Providing a phone number alone does not enroll you in SMS messaging — you must affirmatively check the consent box.

If you consent, the messages you may receive include account and transactional notifications such as payment reminders, deal or compliance deadline alerts, and security or account-related notices. Message frequency varies. Message and data rates may apply depending on your mobile carrier plan. Carriers are not liable for delayed or undelivered messages.

You may opt out of SMS messages at any time by replying STOP to any text message, or by contacting us at support@nilledger.com. Replying HELP, or contacting that address, will provide assistance. Opting out of SMS will not affect your account, subscription, or access to the Service. We do not share your phone number with third parties for their own marketing purposes, and we do not sell it.

3. How We Share Your Information

• Supabase — our database and authentication provider, which stores your account and financial data securely
• Stripe — our payment processor, which handles subscription billing and secure storage of your payment method. Your credit card information is collected at signup and stored by Stripe to enable automatic billing at the end of your 7-day free trial. We do not store full card numbers on our servers. Stripe is PCI-DSS Level 1 compliant.
• Plaid (Elite plan only) — our bank connectivity provider, which facilitates secure access to your financial institution data
• Vercel — our hosting infrastructure provider
• PostHog — our product analytics provider, which helps us understand how the Service is used so we can improve it. This includes usage events and session recordings of in-app activity. All form inputs and on-screen text are masked in these recordings, so your financial figures, balances, and deal amounts are never captured. PostHog does not use your data for advertising. PostHog's privacy policy is available at posthog.com/privacy.
• Sentry — our error and performance monitoring provider, which helps us detect and fix technical problems. When an error occurs, technical details about the error (such as the error message and a stack trace) are sent to Sentry. We have configured Sentry not to send personal information such as your IP address or the contents of your requests. Sentry does not record sessions and is not used for advertising. Sentry's privacy policy is available at sentry.io/privacy.
• Anthropic, Inc. — when you use the Deal Analyzer feature, deal descriptions and contract text you provide are transmitted to Anthropic's Claude API for analysis. Anthropic processes this data solely to return an analysis result. Per Anthropic's API terms, inputs and outputs are not used to train AI models. Anthropic's privacy policy is available at anthropic.com/privacy. We strongly recommend removing personal identifiers (name, address, Social Security number, account numbers) from any contract text before submitting.
• Advisors or agents you authorize — if you grant Agent/Advisor access on the Elite plan, those individuals will have read-only or edit access to your dashboard data as you configure
• Legal compliance — we may disclose information if required by law, subpoena, or court order, or to protect the rights, safety, or property of NIL Ledger or others

3a. AI-Powered Features & Data Handling

NIL Ledger's Deal Analyzer feature uses artificial intelligence powered by Anthropic's Claude API. When you use this feature:

• Text you enter or upload (deal descriptions, contract language) is transmitted over an encrypted connection to Anthropic's API servers for processing
• Anthropic's API terms explicitly prohibit using API inputs or outputs for AI model training — your data is not used to train any AI model
• Temporary files you upload to the Deal Analyzer (PDF, Word, or image contracts) are deleted from our servers immediately after text extraction — they are never permanently stored by the Deal Analyzer. (Contracts you choose to attach to a Compliance record are stored privately in your account for your records, and are deleted when you remove them or delete your account.)
• We strongly recommend removing personally identifiable information (full name, address, Social Security number, bank account numbers) from any contract before submitting to the Deal Analyzer
• The Deal Analyzer is an educational and informational tool only. It does not constitute legal or financial advice.

For more details on how we handle your data across all features, see our Trust & Security page.

3b. Agency Plan & Managed Client Data

On the Agency plan, a sports agency, advisor, or representative (an "Agency") creates and manages records on behalf of the athletes it represents (each, a "Client"). This affects how data is handled:

• Agency-entered data. A Client's financial data, deals, compliance entries, and analyses are entered and managed by the Agency, not by the athlete. The Agency is responsible for the accuracy and lawfulness of the information it enters and for having the athlete's authorization to do so.
• Client consent. Management of a Client's data is gated by the Client's consent. A Client may grant, decline, or revoke consent and access at any time. We process Client data on the Agency's behalf to provide the Service.
• Role-based team access. Agency team members may have different roles (owner, admin, member). Their access to Client data is governed by those roles, which the Agency controls.
• Athlete (Client) bank connections. Where a Client connects a financial institution in connection with an Agency, that connection is authorized by the athlete directly through Plaid's secure interface; the Agency does not receive the athlete's bank login credentials, and NIL Ledger does not store them.
• Data isolation. Each Agency's Client data is logically isolated so that one Agency cannot access another Agency's Clients.
• Public roster (optional). An Agency may invite a Client to appear on a public roster page. A Client appears only if they affirmatively opt in from their private portal, and may remove themselves at any time. When a Client opts in, we ask the Client to provide their date of birth solely to confirm they are 18 or older; the public roster is not available to anyone under 18. A Client's date of birth is used only for this age check and is not displayed publicly. The public roster page displays only the Client's name, sport, school, position, and an optional photo — never any financial information. Because the roster page is public, information shown on it can be viewed and indexed by anyone, including search engines.

If you are an athlete represented by an Agency that uses NIL Ledger and you have questions about, or wish to revoke, the Agency's access to your data or your appearance on a public roster, you may use the controls provided in your portal or contact us at support@nilledger.com.

4. Data Security

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest in our database
• Row-level security so each user can only access their own data
• Access controls limiting personnel access to production systems
• Secure, hashed storage of passwords — we never store plaintext passwords
• PCI-DSS compliant payment processing via Stripe — we never store full card numbers

5. Data Retention

We retain your account information and financial data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory purposes. Aggregated, anonymized data may be retained indefinitely.

6. Your Rights and Choices

• Access — request a copy of the data we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — request that we delete your account and associated data
• Portability — request an export of your data in a machine-readable format
• Opt-out of marketing — withdraw your marketing consent at any time without affecting your account

To exercise any of these rights, contact us at support@nilledger.com. We will respond within 30 days.

7. Children's Privacy

The Service is intended for college athletes who are at least 18 years of age, or athletes under 18 only with parental or guardian consent. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us immediately at support@nilledger.com.

8. Cookies

We use cookies and similar technologies to maintain your session, remember your preferences, and understand how the Service is used. Most are essential for the Service to function. We also use a limited set of analytics technologies (through PostHog) to measure usage and improve the Service; these are not used to track you across other websites and are not used for advertising. You may disable cookies in your browser settings, but doing so may affect the functionality of the Service.

9. California Privacy Rights

If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. We do not sell personal information. To exercise your rights, contact us at support@nilledger.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top and notify you via email or a prominent notice within the Service. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

Athlete Infrastructure LLC, d/b/a NIL Ledger
Email: support@nilledger.com