Privacy Policy

We collect information you provide directly to us when you create an account, build a profile, complete a transaction, or communicate with other users. This includes:

Account information: Name, email address, password (encrypted), phone number (for account and notification purposes), and role (athlete, brand, agent, agency, school, or business).

Profile information: Display name, profile image, bio, sport, position, school, graduation year, location, social media handles and follower counts, service offerings, and pricing rates. For athletes, this also includes gender, interests and content categories, engagement rate, and preferred partnership types — all of which are used to power AI-driven athlete matching, campaign recommendations, and advanced search filters. Your profile type is also used to verify that you have a profile before allowing interactions with other users (messaging, following, posting, reviewing, proposing deals, and requesting representation). For athletes, your representation status (whether you have an active agent or agency) is also stored and used to enforce anti-poaching protections that prevent other agents and agencies from contacting you when you are already represented.

Transaction information: Deal details, payment amounts, platform fees (tiered), commission rates and types (percentage, flat-fee, hybrid), tax documents (W-9, 1099), payout preferences, saved payment method references (Stripe customer IDs and payment method IDs — DirectNIL never sees or stores raw card numbers), commission transaction records, and installment/milestone schedules.

Communication data: Direct messages, group chat messages, posts, comments, likes, follows, reviews, and notifications sent or received through the Platform.

Shipping information: Name, address, and phone number provided for physical product delivery in applicable NIL deals.

Notification preferences: Your push notification opt-in status and device tokens for delivering browser-based push notifications about new messages, deal updates, and platform activity.

Service partner data: Company name, service categories, portfolio, service listings, and partnership request details for users registered as NIL Service Partners.

Campaign data: Campaign details (name, product, goal, budget, target audience, target locations, preferred sports, preferred social platforms, follower ranges, deliverables, timeline, and AI-generated campaign briefs), campaign participant records (athlete invitations, acceptance status, deal links, and match scores), and campaign performance metrics (views, reach, likes, comments, shares, saves, clicks, and engagement rate) that brands self-report for content created as part of a campaign.

Revenue sharing data (schools): For schools using the Revenue Sharing Hub: institution budget limits and per-sport caps, administrator records (name, email, job title, role, assigned sports/rosters, and granular permissions), roster entries and athlete invitations, revenue-share arrangement details (athlete, sport, allocation amounts, payment schedule, payment amounts and dates, and approval history), scheduled and processed payment records, school payment method references (Stripe payment method IDs and the method type — card or ACH bank account; DirectNIL never sees or stores raw card or bank account numbers), and an immutable audit log of financial and administrative actions. Revenue-share amounts are private financial information visible only to the school's authorized administrators and the affected athlete — they are never displayed on public profiles.

Usage data: IP address, browser type, device information, pages visited, and interaction data collected automatically through cookies and similar technologies.

ROI tracking & attribution data: When a brand sets up ROI tracking on a deal or campaign, the Platform generates tracking links and QR codes that redirect visitors to the brand's destination URL. When a visitor (who may not be a Platform user) clicks a tracking link or scans a QR code, we collect: the event type (click, unique visitor, QR scan, product view, add-to-cart, checkout start, purchase, lead, registration, promo code use, refund); an approximate location (country and region derived from the visitor's IP address); device type, browser, and referrer URL; an anonymous visitor identifier and session identifier set via cookies or local storage; a unique click identifier; and the date and time of the event. Purchase and revenue figures are self-reported by the brand and are not independently verified. Tracking links are active for the brand-selected tracking period, after which event recording may stop, though historical event data may be retained for analytics and dispute-resolution purposes.

We use your information to: (a) create and manage your account; (b) display your profile on the Platform; (c) process payments via Stripe's charge-on-completion model (saving and charging payment methods, transferring payouts to athletes/agents/agencies, and calculating tiered platform fees) — DirectNIL does not hold, escrow, or custody any funds; (d) send notifications about deals, messages, deadlines, payment failures, and platform updates via email, in-app alerts, and browser push notifications; (e) verify profiles using AI-driven tools; (f) facilitate NIL compliance disclosures to schools; (g) generate AI-powered recommendations, matches, and campaign suggestions; (h) prevent fraud, abuse, and violations of our Terms of Service; (i) comply with legal obligations; (j) display social content including posts, comments, reviews, and follower connections; (k) facilitate group messaging between multiple users; (l) facilitate product shipping for deals involving physical deliverables; (m) verify that users have a profile in at least one sector before allowing them to interact with other users (message, follow, post, review, propose deals, or request representation), ensuring all platform participants are identifiable and accountable; (n) enforce anti-poaching protections by checking an athlete's representation status and blocking contact attempts from agents and agencies who are not the athlete's current representative; (o) power campaign management tools, including AI-generated campaign briefs, athlete recommendations with match scores, similar-athlete discovery, and advanced search filters based on athlete profile data (sport, location, gender, follower counts, engagement rate, interests, and preferred partnership types); (p) display self-reported campaign performance metrics and analytics dashboards for brands to track their campaign results; and (q) run automated payment reconciliation to detect and recover missed payment events (e.g., webhook delivery failures) and process scheduled commission payouts to agents and agencies who have completed Stripe Connect onboarding; and (r) generate and operate ROI tracking links and QR codes for brand deals and campaigns, record anonymous tracking events (clicks, scans, views, conversions) from visitors who use those links, attribute conversions to prior clicks using the brand-selected attribution window, and display self-reported ROI metrics and analytics dashboards to the brand (and, where the brand opts in, a basic performance summary to the athlete); and (s) operate the Revenue Sharing Hub for schools — designating and verifying a Main Administrator, approving and managing additional school administrators and their permissions, managing sports rosters and athlete connections, proposing and approving revenue-share arrangements subject to school-configured budgets and approval chains, charging the school's saved payment method (instantly for cards, or via asynchronous ACH bank debit) and transferring payments to connected athletes' Stripe accounts, recording every financial and administrative action in an immutable audit log, and displaying connected athletes' NIL deal information to the school's authorized administrators. Revenue-share amounts are excluded from public athlete profiles.

We do not sell your personal information to third parties.

Your public profile information (name, sport, school, social stats, services, and ratings) is visible to other users on the Platform. Private information such as your email address, payment details, and tax documents are never shared publicly.

We share your information with the following categories of third-party service providers: (a) Stripe — processes payments, saves and charges payment methods, and facilitates payouts via Stripe Connect; subject to Stripe's privacy policy; (b) Cloud infrastructure providers — host and store platform data; (c) Email service providers — deliver notifications and transactional emails; (d) AI service providers — power athlete matching, campaign building, athlete recommendations, similar-athlete discovery, contract generation, and verification features; (e) Browser push notification services — deliver push notifications to your device where you have opted in. DirectNIL itself never sees or stores raw credit card numbers — all card data is handled securely by Stripe.

Sharing within schools. If you are connected to a school on the Platform (as an athlete on a roster or as an administrator), certain information is shared with that school's authorized administrators: your roster membership and status; your revenue-share arrangement details and payments (visible only to authorized administrators and you); and, for athletes, summaries of your NIL deals completed on the Platform. This visibility is limited by each administrator's assigned role and permissions, and revenue-share amounts are never displayed publicly or shared outside your school.

We may also disclose your information when required by law, court order, or government regulation, or to protect the rights, property, or safety of DirectNIL, our users, or others.

We retain your personal information for as long as your account is active. After account closure, we retain transaction records, tax documents, and related data for seven (7) years as required for tax and legal compliance, then delete or anonymize it. Profile content may be retained in archived form for dispute resolution purposes. Agency profiles: If an agency cancels its annual partnership subscription, the agency's profile is permanently removed from the Platform. Associated transaction and tax records are retained for the standard seven-year period for compliance purposes.

Athletes under the age of 18 ("Minors") may use the Platform with parental or legal guardian consent. When a Minor creates an account, we collect the parent or guardian's name, email, and phone number for consent verification and communication purposes.

Parents or guardians who provide consent acknowledge that they are responsible for the Minor's use of the Platform and the information the Minor shares. Parents may request access to, correction of, or deletion of their Minor's personal information by contacting us at wwatson77@directnil.com.

The Platform is not directed to children under the age of 13. We do not knowingly collect information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately and we will delete it.

We use cookies and similar tracking technologies (local storage, pixels) to maintain your login session, remember your preferences, analyze platform usage, and improve our services. You can control cookies through your browser settings, but disabling them may limit certain Platform features.

ROI tracking cookies. When a visitor clicks a brand's DirectNIL tracking link or scans a brand's QR code, we set an anonymous visitor identifier and session identifier via cookies or local storage on the visitor's browser. These identifiers let us count unique visitors and attribute later conversions (within the brand-selected attribution window) back to the original click. No DirectNIL account or personal profile is linked to these identifiers — they are anonymous to the Platform. The brand's destination website may set its own cookies after the redirect, governed by that site's own privacy policy.

We use industry-standard encryption and security practices to protect your data, including encrypted password storage, secure API authentication, and restricted internal access. All payments are processed through Stripe, which is PCI-DSS compliant. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If you are a California resident, under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have the right to: (a) Know what personal information we collect about you and how it is used; (b) Access and receive a copy of your personal information; (c) Delete your personal information, subject to certain legal exceptions (such as retained tax records); (d) Correct inaccurate personal information; (e) Opt out of the "sale" or "sharing" of your personal information — we do not sell your data, but you may opt out of sharing for targeted advertising; and (f) Non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at wwatson77@directnil.com. We will verify your identity before processing your request and respond within 45 days.

Residents of other U.S. states may have additional privacy rights under their state's laws. To the extent required by applicable law, you may have rights to access, correct, or delete your personal information. Contact us at wwatson77@directnil.com to exercise these rights.

In the event of a data breach affecting your personal information, we will notify affected users in accordance with applicable state and federal notification laws, generally within 30 days of discovery.

We may update this Privacy Policy from time to time. Updated versions will be posted on the Platform with a revised "Last updated" date. We encourage you to review this policy periodically. Material changes will be communicated via email or Platform notification when required by law.

For any privacy-related questions or requests, contact us at wwatson77@directnil.com.