Privacy Policy
Effective October 5, 2026 · Last updated October 17, 2026
1. WHO WE ARE AND WHAT THIS POLICY COVERS
Next Level Roster LLC ("NL Roster," "we," "us," or "our") is a Florida limited liability company located in Sarasota, Florida. We provide software of the same name that reads a college athletics program's recruiting email and organizes the information in it about prospective student-athletes into a recruiting board for the program's coaching staff.
This Privacy Policy explains how we collect, use, disclose, retain, and protect information in connection with:
- our public website at nlroster.com (the "Website"); and
- the NL Roster application at app.nlroster.com, including its connections to Gmail and Microsoft 365 mailboxes (the "Service").
We act in two roles.
On the Website, and for our own business relationships, we decide how the information is used, and this Privacy Policy governs it directly.
In the Service, a college or university (an "Institution") decides what information enters the Service and how it is used, under a written agreement with us. We process that information on the Institution's behalf and on its instructions, as its service provider. If your information is in an Institution's account, that Institution controls it, and the Institution's own privacy policies also apply. This Privacy Policy describes what we do with that information on the Institution's behalf, and Section 12 explains how to make a request about it.
2. OUR COMMITMENTS, IN SUMMARY
- We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising.
- We do not use information in the Service to train artificial intelligence models, and OpenAI, the AI provider the Service uses, is contractually prohibited from doing so.
- We do not share one Institution's information with any other Institution, and we do not combine, compare, or match one Institution's records with another's.
- Our access to mailboxes is read-only. The Service cannot send email from a connected mailbox, or delete, move, label, or change any email in one.
- Email that is not about a recruit is discarded as soon as it is identified. No one at the Institution sees it, and no one at NL Roster reads it except as Section 6.9 allows.
- The Service is designed to keep no record of anyone younger than a high school freshman.
- We delete email content automatically, on the schedule in Section 10.
3. IF YOU ARE A PROSPECTIVE STUDENT-ATHLETE OR A PARENT, READ THIS FIRST
You may be reading this because a college program's recruiting software holds information about you that you did not give us directly. This Section explains how that happens and what we do with the information.
How your information reached the Service. You, your parent, or your coach sent an email to a college coach. That college uses NL Roster. With the college's authorization, the coach's work mailbox was connected to the Service. The Service read the email, identified it as recruiting email, and recorded the details it contained, such as your name, graduation year, school, positions, measurements, contact details, and links to video, so the college's coaching staff can find them later. The email was sent to the college, and we process it for the college.
What we do not do. We do not buy information about you, scrape the internet for it, or obtain it from any source other than email sent to the college and records the college itself provides. We never sell it, never use it for advertising, and never share it with any other college. We do not grade or evaluate players. A college's board can sort players by a number in that college's own records, such as a fastball velocity from an email, and show where that number falls among the college's other players. Apart from checking that each number is believable, to catch misreadings, we never compare a player with anything from another college or any other source. We do not send you any email or other message.
Your choices. You, or your parent or guardian, can ask for a copy of the information a college holds about you in the Service, ask for it to be corrected, or ask for it to be deleted. Because the college controls the information, we pass your request to the college and act on its instructions, as described in Section 12.1. There is no charge.
4. INFORMATION WE COLLECT
4.1 Website visitors
We measure Website traffic using Vercel Web Analytics, a service of the company that hosts the Website. It does not use cookies and does not track you across other websites. For each page view, it records the date and time, the page viewed, the referring website if you followed a link, your approximate location (country, region, and city) derived from your connection, and your browser type, operating system, and device type. Your IP address is not stored. Visitors are counted using a temporary value derived from each request (the "visitor value"), which is discarded after 24 hours, so we cannot recognize you if you return on a later day. Separately, our hosting providers keep standard server logs, including IP addresses, under their own terms, as Section 8.2 describes.
Emergency page. The Website includes a page, intended only for a person we have designated, for engaging an emergency lockdown of the Service. The page does not use our analytics. When a code entered there is not valid, we may record the time of the attempt and, to limit repeated attempts from the same internet connection, a value that we compute from the connection's IP address using a secret key, so that the record does not contain the IP address itself. We do not record what was entered. We use the computed value only to count attempts from that connection, not to identify anyone or to work out the IP address, and we erase it within 2 hours; the record of the attempt is deleted 7 days after it is made. When a valid code is entered, we record the time and which designated person's code was used. The server logs described above also apply to this page.
4.2 Demonstration requests and business contacts
If you request a demonstration through the Website, you give us your name, your program or school, your work email address, and the sport you select. We also record the date and time of the request, the page you sent it from, and your browser's user-agent string, which we keep only to help spot automated spam.
Business contacts. We also keep the names, titles, and contact details of college coaches and staff whom we contact, or plan to contact, about our services, and of people at companies in college athletics whom we contact about working together, together with our correspondence with them and our notes of when and how we contacted them, whether and when they replied, when we plan to follow up, and the outcome. We obtain those details from their institutions' or companies' public websites, from professional networking sites such as LinkedIn, from people who introduce us to them, or from the people themselves.
4.3 Demonstration accounts
If we create a sign-in for you to a demonstration copy of the Service, we hold your work email address and display name and record the date, time, IP address, and browser information of each sign-in, so that we know whether the demonstration is being used. Sign-in records are deleted 90 days after each sign-in. The account emails, the record of the times at which links are emailed, and the administrative alert described in Section 4.4 also apply to demonstration accounts. The demonstration contains only fictional players.
4.4 Coaches and staff who use the Service ("Authorized Users")
When an Institution asks us to create an account for you, we receive your name, work email address, and role. When you use the Service, we process your password (stored by our hosting provider in hashed form), your enrollment in an authenticator application, the date, time, IP address, and browser information of your sign-ins and authenticator checks, your acceptance of our Terms of Service, the times at which an invitation, a password-reset link, or a one-time sign-in link is emailed to your address, the notes you write, the changes you make to records, the exports you take, and the information you import. When a password-reset or one-time sign-in link is emailed to you, we receive an administrative alert naming your email address and your programs and roles. The Service also records cookieless page-view analytics of the kind described in Section 4.1. The Service sends you email only about your account, such as your invitation, password-reset and one-time sign-in links, and notices of a change to your password, email address, or authenticator; those emails are delivered by our email delivery provider (Section 8.2) and contain no advertising. We may also write to you ourselves, for example about support or a change to this Privacy Policy. If you contact us for support, we keep that correspondence.
4.5 Information from a connected mailbox
When you connect your work mailbox to the Service, we receive the information described in Section 6, including your email address, your name as shown on your account, your organization's Google Workspace domain or Microsoft tenant, and the email that arrives in your mailbox after you connect it.
4.6 Information about prospective student-athletes and others in recruiting email
From each email that the Service identifies as recruiting email, the Service records information about each prospective student-athlete the email describes, which may include name; graduation year; high school, club, or travel team; city and state; whether the player is a transfer, and the player's current school; email address and telephone number; academic information such as grade point average and test scores; height, weight, handedness, and positions; athletic measurements such as velocities and times; honors, awards, and statistics; social media handles; and links to video. The Service also keeps the content of the email for a limited period, as described in Section 10, and records the name and email address of the person who sent it. The college's staff may also add their own notes and recruiting information about a player, such as priority, recruiting stage, and follow-up dates.
4.7 Information we do not seek
We do not ask for, and the Service is not designed to record, Social Security numbers or other government identification numbers, financial account or payment card numbers, health information, or biometric information. Because the Service keeps the content of recruiting email for a limited period, an email may contain information of those kinds if its author chose to include it, such as a mention of an injury. The Service does not copy that information into recruiting records.
4.8 Cookies and browser storage
The Website does not use cookies. The Service does not use advertising or tracking cookies. It keeps in your browser's storage only what it needs to work:
- your sign-in, and, kept only in the browser tab where you signed in, a marker of that tab;
- if the box "Remember this computer for 12 hours" (or "for 24 hours", if you are not the owner of any of your programs) is ticked when you enter an authenticator code, a random value that lets you sign in again in that browser without another code until those hours have passed since you entered the code, and that is erased when you choose Sign out but not when the Service signs you out for inactivity;
- the time of your last activity, which lets the Service sign you out of that browser after an hour without activity, and which is erased when you choose Sign out;
- if the Service signs you out for inactivity, a note that lets the sign-in page say why, which is erased when you next sign in with your password;
- after you open an invitation or password-reset link, a marker that you still have a password to choose, which is erased when you choose it in that browser;
- while you are connecting a mailbox, the one-time code that completes the connection, kept only in that browser tab and erased once it is used;
- your color theme setting, which follows your device's setting until you choose light or dark;
- if your account belongs to more than one program, the program you last chose, which is erased when you choose Sign out; and
- a time marker, kept for that browser rather than for any one account, which lets the Service mark email newer than that time: it records the arrival time of the newest email (or, if there is none, the current time) when the Service is first used in that browser and again while the Inbox page is open there.
Our analytics, on the Website and in the Service, are cookieless.
5. HOW WE USE INFORMATION
Website and business information. We use the information in Sections 4.1 through 4.3 to operate and secure the Website and the Service, to understand in aggregate how the Website is used, to respond to demonstration requests, to provide and follow up on demonstrations, to communicate with you about our services when you have asked us to, and to write to the people described in Section 4.2 about our services or about working together. If you ask us to stop sending you messages that promote our services or propose working together, by replying to one of them, by writing to privacy@nlroster.com, or in any other way, we will stop promptly, and in any case within 10 business days, and we will add you to our do-not-contact list (Section 10). This does not stop the emails about your account described in Sections 4.3 and 4.4, or our replies to you.
Information in the Service. We use the information in Sections 4.4 through 4.6 only to provide the Service to the Institution that holds it, in accordance with our agreement with that Institution. That includes reading and classifying email, recording information about prospective student-athletes, presenting it to the Institution's Authorized Users, providing support that the Institution or its users request, securing the Service and investigating misuse, and complying with law. We use operational information that contains no email content and no information about prospective student-athletes, such as counts of emails processed, processing times, and error codes, to operate, secure, and improve the Service and for billing.
6. HOW WE ACCESS AND USE GOOGLE AND MICROSOFT DATA
This Section describes how the Service accesses, uses, stores, shares, retains, and deletes data received from Google and Microsoft when an Authorized User connects a work mailbox.
6.1 What the Service accesses
| Mail service | Permissions requested | What they allow |
|---|---|---|
| Google (Gmail) | gmail.readonly; openid; email; profile | Read-only access to email messages; your email address, name, and Google Workspace domain |
| Microsoft 365 | Mail.Read; User.Read; offline_access; openid; profile | Read-only access to email messages; your name, email address, and Microsoft tenant; a continuing connection until you disconnect |
None of these permissions allows the Service to send, delete, move, label, or change any email. The Service accepts a connection only from a mailbox in your Institution's own Google Workspace domain or Microsoft tenant.
6.2 What the Service reads
The Service reads only email that arrives in your mailbox after you connect it. It does not read anything already in your mailbox. For Gmail, it reads email in all folders and labels except drafts, sent mail, spam, trash, and chats. For Microsoft 365, it reads email in the Inbox folder only. It does not read or store file attachments, except that the text of an email forwarded within a message is read as part of that message and, for Gmail, so is the text of an email attached to a message.
6.3 How the Service uses it
The Service uses this data only to provide the features you see in the Service:
- Before any artificial intelligence model receives an email, the Service checks its text for common ways of describing a child younger than a high school freshman, such as "8th grader," "in middle school," or "12 years old," and for a graduation year later than that of current high school freshmen, and erases any such email it detects.
- It sends the email's sender name and email address, subject, and date (each limited to 500 characters), and up to the first 24,000 characters of its body, to our artificial intelligence provider to determine whether the email concerns a prospective student-athlete. If the provider's answer gives a graduation year, school level, or age that places someone below high school, or quotes words from the email that describe a child, the Service erases the email. If the provider reports a child without such support, a coach is asked to review the record instead.
- If the email does not concern a prospective student-athlete, the Service deletes its content immediately and keeps only a message identifier, its arrival time, which mailbox it came from, and the fact that it was not recruiting email. No one at your Institution sees it, and no one at NL Roster reads it except as Section 6.9 allows. The sender's email address is also kept briefly in a daily counter that enforces processing limits, and is deleted in the ordinary course, generally within 15 days.
- If the email is recruiting email, the Service sends the same fields again, together with the identity of the original sender of any forwarded email, so that our artificial intelligence provider can extract the information the email states about each prospective student-athlete. The Service checks that information again under the rule for children and adds it to your program's shared recruiting board.
Recruiting email read from your mailbox, and the information drawn from it, becomes part of your program's shared recruiting board and is visible to the other Authorized Users in your program, according to their roles. It is not visible to anyone at any other Institution.
6.4 How the Service stores and protects it
Data is stored in the United States by our database provider, Supabase, on Amazon Web Services. It is encrypted at rest and in transit. The long-lived credential that Google or Microsoft issues for your connection is stored in encrypted secret storage, can be read within the Service only by our server-side functions, and is never sent to a browser. When the connection ends, a Microsoft credential is deleted immediately, and a Google credential is revoked at Google where possible and deleted, ordinarily within minutes and in all cases within 24 hours.
6.5 How the Service shares it
We share Google and Microsoft data only (a) with those of the service providers listed in Section 8.2 that receive it, which are Supabase, OpenAI (our artificial intelligence provider, for classification and extraction), Vercel, and, for correspondence you send us, Google Workspace, each for the purposes stated there; (b) with the other Authorized Users in your program, as described in Section 6.3; (c) as necessary to comply with law; and (d) as part of a merger, acquisition, or sale of assets, subject to the notice and consent that Google's and Microsoft's terms require. We do not sell it, and we do not use or transfer it for advertising of any kind, including retargeting and personalized or interest-based advertising.
6.6 Retention and deletion
Section 10 states how long the Service keeps each kind of data. When you disconnect your mailbox, the Service reads nothing further and disposes of its credential as described in Section 6.4. Disconnecting does not change anything in your mailbox. Information already added to your program's recruiting board remains part of your Institution's records, which your Institution controls, and you or your Institution may ask us to delete it by writing to privacy@nlroster.com. For a Google mailbox, we also keep a one-way hash of the Google account's identifier, which does not reveal your name or email address, only to count the Google accounts that complete our Google consent screen against the limit Google sets for applications it has not yet verified. We keep it only for as long as Google applies that limit to the Service.
6.7 Limited Use
NL Roster's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
NL Roster's use of information received from Microsoft APIs complies with the Microsoft APIs Terms of Use.
6.8 No AI training
We do not use Google Workspace API data, or any other data received from Google or Microsoft, to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Nor do we use it to train or fine-tune any other model.
6.9 Human access
No one at NL Roster reads email content received from Google or Microsoft except (a) with the express consent of the Authorized User concerned to view specific messages, such as when you ask us for help with a particular email; (b) when necessary for security purposes, such as investigating a bug, a security incident, or abuse; (c) to comply with law; or (d) when the data has been aggregated and anonymized and is used for our internal operations.
6.10 How to revoke access
You can disconnect your mailbox at any time from the Integrations page in the Service. You can also revoke the Service's access through your account settings: for Google, at myaccount.google.com/permissions; for Microsoft, at myapps.microsoft.com. Your Institution's administrator can also revoke the Service's access for every user at the Institution through the Google Admin console or Microsoft Entra.
7. ARTIFICIAL INTELLIGENCE
The Service uses artificial intelligence models provided by OpenAI through OpenAI's application programming interface to classify email and to extract information about prospective student-athletes. Under OpenAI's business terms, content we send through the interface is not used to train OpenAI's models. We instruct OpenAI not to store our requests as retrievable records. OpenAI nonetheless retains request and response content in its abuse-monitoring logs for up to 30 days, or longer if it is legally required to do so, and then deletes it. We have not obtained a zero data retention arrangement from OpenAI, and we will update this Privacy Policy if we do.
The Service does not make decisions about anyone. It records what an email says, flags anything it is unsure of for a coach to review, and leaves the use of the information to the Institution's staff.
8. HOW WE SHARE INFORMATION
8.1 We do not sell or share for advertising
We do not sell personal information or share it for cross-context behavioral or targeted advertising. We do not allow third parties to collect personal information on the Website for advertising, and we do not disclose personal information to third parties for their own direct marketing purposes.
8.2 Service providers
We use the following service providers. Each uses the information it receives only to provide its services to us, under its terms with us, except as the table describes, and we will have written data protection terms in place with each before it processes any Institution's information:
| Service provider | What it does | Information it receives |
|---|---|---|
| Supabase, Inc. | Database, sign-in, server functions, and encrypted secret storage, on Amazon Web Services in the United States | All information in the Service; demonstration requests; the emergency page's records described in Section 4.1 |
| OpenAI OpCo, LLC | Artificial intelligence models that classify email and extract recruiting information | The email fields described in Section 6.3 and the model's responses |
| Vercel Inc. | Hosting of the Website and the Service's web application, and analytics for both | Standard web request information such as IP address, browser type, and the address of each page requested, including the one-time authorization response that Google returns when a Gmail mailbox is connected, and the cookieless analytics described in Section 4.1. It also keeps its own records of that information, such as logs, traffic data, and usage statistics, which it uses under its own terms to operate, improve, and support its services, for analytics, benchmarking, and reporting, and for its other business purposes. It may disclose them as its terms and privacy notice permit, including in aggregate or de-identified form and, for the personal information in them, to its affiliates, service providers, and business partners, to public authorities where the law requires, and in a business transfer. |
| Plus Five Five, Inc. (Resend) | Delivery of the Service's account emails to the people who have accounts on the Service | Each recipient's email address and the content of each account email described in Sections 4.3 and 4.4, including any one-time link or code, which it keeps for up to 30 days. It also keeps its own records of the use of its service, such as each email's sender, recipient, and delivery and related activity logs, which it uses under its own terms to manage its relationship with us, for its own business operations and legal obligations, to prevent fraud and misuse, to verify identity, to provide, optimize, maintain, and secure its service, and as the law otherwise permits. It receives no email from any mailbox and no information about players. |
| GitHub, Inc. | Hosting of our source code; availability monitoring and administrative alerts | Service status information, such as the status of each part of the Service and each scheduled job, the database's size, and counts of emails, connected mailboxes, and administrative alerts. For availability monitoring, it receives no email content, no information about players, and no name or address of any user, program, or mailbox. Our source code and its history, including our development notes and other business records, contain no information from any Institution's account, but do contain the names and contact details of some people we have corresponded with, such as the business contacts described in Section 4.2 and people who were given demonstration accounts. |
| Aikido Security BV | Automated security scanning of our source code and of the publicly reachable pages of the Website and the Service | Our source code and its history, including our development notes and other business records, which contain no information from any Institution's account but do contain the names and contact details of some people we have corresponded with, such as the business contacts described in Section 4.2 and people who were given demonstration accounts; and what the Website and the Service's sign-in page show to any visitor. It receives no email content and no information about players. |
| Anthropic, PBC | Our AI assistant for software development and business administration, including preparing our correspondence with business contacts | Our source code, development notes, and other business records; the names, titles, and contact details of some people we have contacted or plan to contact, or who asked us for a demonstration, such as the business contacts described in Section 4.2, and of people who were given demonstration accounts; email in our business email account, which it can read through a connector and reads and drafts in when we ask it to (before we first receive any Institution's information, we will remove its access to any mailbox in which we receive or send an Institution's information); and the records of our test and demonstration programs and operational records from the Service's database, which hold only fictional players. It receives no information from any Institution's account (Section 11). Before October 8, 2026, it could also read other records in the Service's database, which then held no Institution's information. It acts under its consumer terms and its privacy policy, as the controller of our conversations with it, and uses them for its own purposes, including providing, maintaining, and securing its service, improving its service and conducting research by means other than training its models, debugging, preventing and investigating misuse, resolving disputes, enforcing its terms, and meeting its legal obligations. We have switched off the use of those conversations to train its models; under its privacy policy, it may still use a conversation that its systems flag for safety review, or that we report to it. Section 10 states how long it keeps them. |
| Google LLC (Google Workspace) | Our business email | Correspondence between you and us, including our correspondence with the business contacts described in Section 4.2 |
Google and Microsoft provide your Institution's mailboxes to your Institution; they are your Institution's service providers, not ours.
8.3 Within an Institution
Information in an Institution's account is visible to that Institution's Authorized Users according to the roles the Institution assigns.
8.4 Legal requirements
We may disclose information when we believe in good faith that the law requires it, such as in response to a subpoena or court order. Where information belongs to an Institution, we will, where the law permits, notify the Institution first and give it an opportunity to object.
8.5 Business transfers
If NL Roster is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. Any successor will be bound by commitments at least as protective as those in this Privacy Policy and in our agreements with Institutions, and we will give the notice and obtain the consent that the law, those agreements, and Google's and Microsoft's terms require.
9. CHILDREN AND MINORS
Children under 13. The Website and the Service are not directed to children under 13, and children may not use them. The Service is designed to keep no record of anyone younger than a high school freshman. It applies three automated checks: on arrival, before any artificial intelligence model receives an email; again when our artificial intelligence provider classifies the email; and again after the details are extracted. It erases any email that a check identifies, and it refuses any record whose stated graduation year shows such a child. When an email is erased at the second or third check, our artificial intelligence provider will already have received it and will retain it as described in Section 7.
Automated checks cannot catch everything, so the Service also flags for a coach's review any player added from an email or an import without a graduation year (unless the player is at a college), and any player who may be under 13. Apart from the brief records of an erasure described in Section 10, and a flagged record while a coach reviews it, we do not knowingly retain personal information of a child under 13. If you believe the Service holds information about a child under 13, write to privacy@nlroster.com. We will notify the college concerned and, unless it shows within 5 business days that the person is not under 13, we will delete the information and confirm that we have done so.
Prospective student-athletes who are minors. Most of the prospective student-athletes whose information appears in the Service are minors. We treat their information with particular care. We never sell it, never use it for advertising or marketing, never share it with any other Institution, never use it to build a profile of anyone for any purpose other than the Institution's own recruiting, and never use any player's name, image, video, or measurements in our marketing or demonstrations, which use only fictional players.
The Website. The Website is intended for college coaching staff. We do not knowingly collect personal information through the Website from anyone under 18.
10. HOW LONG WE KEEP INFORMATION
We keep information for the periods below. The Service enforces them automatically, except periods that depend on an Institution's agreement or instructions, on a service provider's terms or backup cycle, or on our own records and annual review, and except while automatic deletion is suspended to preserve evidence of a security incident:
| Information | How long |
|---|---|
| Content of a recruiting email (body, subject, sender name and address, the original sender of a forwarded email, the AI's stated reason for its classification, and the Service's notes from checking it) | Deleted 90 days after the email arrives |
| The artificial intelligence model's response to an email, as returned and as parsed for reprocessing | Deleted 30 days after the email arrives |
| Email that is not recruiting email | Content deleted immediately when identified. Kept: message identifier, arrival time, mailbox, and classification. |
| Email erased under the rules for minors, or because it is about a player removed at a family's request (whether it arrived before or after the removal) | Content erased as soon as identified, or when the player is removed. Kept: message identifier, arrival time, and a short note of the reason. |
| Record that each email arrived and what the Service did with it (message identifier, arrival time, outcome, and the players concerned) | For the term of the Institution's agreement, then deleted with the Institution's other records |
| Sender email addresses in the daily processing-limit counter | Deleted in the ordinary course, generally within 15 days |
| Email that cannot be processed after automatic retries | Deleted 7 days after the last retry fails |
| Recruiting records, notes, flags, and edit histories | For the term of the Institution's agreement, then deleted within 60 days after it ends (30 days for the Institution to export, then up to 30 days to delete) |
| Do-not-add record for a player removed at a family's request (name, graduation year, date, and a short reason) | For the term of the Institution's agreement, so that the player is not added back, then deleted with the Institution's other records, or earlier if the college asks us to lift it |
| Sign-in records of Authorized Users, including IP address and browser information | Deleted 90 days after each sign-in or authenticator check; session records deleted 90 days after the session's last activity |
| Mailbox connection credentials | When the connection ends: Microsoft, deleted immediately; Google, revoked where possible and deleted within 24 hours |
| Mailbox connection details (mailbox address, name, and account identifier) | Deleted when the connection ends, except as kept in our administrative records (below) |
| One-way hash of a Google account's identifier, which does not reveal the account's name or address | For as long as Google limits the number of users of applications it has not verified |
| Authorized User account information | For the term of the Institution's agreement, then deleted with the Institution's other records |
| Our administrative alerts and access log, which may include a user's name, email address, programs, and roles; the name, email address, title, and proposed role of a person an Owner asks us to add; a mailbox address and the identifier of its account; the address of a mailbox whose connection was refused; the name, program, and sport given in a demonstration request; the name and graduation year of a player we have removed from a program's board, such as at a family's request; the designation of the person whose emergency code was used; and what we write ourselves in those records, such as the reasons for our administrative actions, which may name a person | For the term of the Institution's agreement, then deleted with the Institution's other records. Those about a demonstration request, a demonstration account, or a demonstration program are kept for the period stated below for demonstration requests and demonstration accounts. The alert raised for an emergency lockdown is kept as stated below for the emergency page. The alert raised when we pause automatic deletion is deleted at our yearly review once deletion has been resumed for 2 years, unless it concerns a security incident that is still open. |
| Records of privacy requests from players and families | 3 years after the request is closed |
| Copies held by our artificial intelligence provider for the Service (OpenAI) | Up to 30 days, or longer if legally required |
| Copies of our conversations with our AI assistant held by its provider (Anthropic) | Up to 30 days after each session, or, for a conversation kept in our account's history, up to 30 days after we delete it; up to 2 years for a conversation its systems flag for safety review, 5 years for one we report to it, and longer where the law requires it or Anthropic needs it to resolve a dispute or to enforce its usage policy |
| Copies of account emails held by our email delivery provider | Up to 30 days |
| Backup copies, once in place | Overwritten in the ordinary course, within 30 days |
| Demonstration requests, demonstration accounts, and business contacts | Until you ask us to delete them, or until they are no longer needed. At a review we hold at least once a year, we delete those no longer needed and, in any case, those for which 2 years have passed since the later of our last message to you and your last message to us or use of a demonstration account, or, if we have never written to you, since we obtained your details. If you ask us to stop sending you messages that promote our services or propose working together, or to delete your information, we add your name, the email address or telephone number at which we contacted you or from which you wrote to us, and the date of your request to a do-not-contact list, so that we do not send you such messages again. We keep that entry for as long as we send such messages, unless you tell us that you want to hear from us again. If you asked us to delete your information, that entry is all we keep, apart from copies that our service providers (Section 8.2) delete on their own schedules and under their own terms, and the sign-in records of a demonstration account, which are deleted 90 days after each sign-in (Section 4.3). |
| Website analytics | We use aggregate figures only; the visitor value is discarded after 24 hours. Vercel keeps its own records of the analytics under its own terms (Section 8.2). |
| Emergency page: the time of each attempt with a code that is not valid, and the value computed from the connection's IP address (Section 4.1) | The computed value is erased within 2 hours; the record of the attempt is deleted 7 days after it is made |
| Emergency page: when a valid code is used, the time and which designated person's code it was (Section 4.1) | Kept in our security records about the code and the lockdown, including the administrative alert raised for the lockdown. At our yearly review, we delete those about a lockdown released 2 or more years earlier, and the record of a code withdrawn 2 or more years earlier, unless they concern a security incident that is still open. The time kept with the code is replaced each time the code is used. |
11. SECURITY
We protect information with safeguards that include encryption at rest and in transit, an enforced boundary around each Institution's records, mandatory authenticator codes for every user with access to an Institution's records, role permissions enforced by the database, read-only mailbox access, encrypted storage of mailbox credentials, automated monitoring, and an emergency lockdown that can stop, at once, email intake, mailbox reading, and all user access to Institutions' records. Our database provider reports that its platform holds a SOC 2 Type 2 report and ISO/IEC 27001 certification. NL Roster does not itself hold a third-party security certification. No security measure is perfect, and we cannot promise that a security incident will never happen. If a security incident affects an Institution's information, we will notify the Institution as our agreement with it requires. We do not allow our own software development and AI tools to access Institutions' information, and before we first receive any Institution's information, we will remove our AI assistant's access to any mailbox in which we receive or send an Institution's information. Before any Institution's information is stored in the Service, our AI development assistant's access to the database will be limited to our test and demonstration programs, which hold only fictional data, and to operational records that hold no Institution's information.
12. YOUR CHOICES AND RIGHTS
12.1 Prospective student-athletes, parents, and guardians
- Write to privacy@nlroster.com. Tell us the player's full name, graduation year, and high school, and, if you know it, the college program you are asking about. Tell us whether you want a copy of the information, a correction, or deletion.
- We acknowledge your request within 2 business days.
- We refer it to the college. Within 5 business days, we identify each college whose records contain the information and send your request to it. We do not tell you about any college you did not name, because a college's recruiting interest in a player is confidential to that college, and we do not tell one college that another holds the same information.
- We verify the request. We will not act on a request until we have reasonably confirmed that it comes from the player or the player's parent or guardian. A request sent from the player's or a parent's or guardian's email address, as it appears in the original email, is ordinarily sufficient.
- We act on the college's instructions within 10 business days after receiving them. If the college has not responded within 15 business days, we send it a reminder; if it still has not responded 5 business days later, we will act on a verified request to delete or correct information, as our agreements with colleges provide. If you asked for a copy, the college sends it to you, because a record may also contain other people's information.
- When information is deleted at your request, the Service also prevents the player from being added back to that college's records, whether by later email or by the college's staff. To do that, it keeps the player's name and graduation year, with the date and a short reason, on that college's do-not-add list for as long as the college uses the Service. The emails we had stored about the player are erased too, except each one's identifier, arrival time, and a short note of the reason it was erased. Because the Service recognizes a later email about the player only after our artificial intelligence provider has read it, that provider will have received that email and will retain it as described in Section 7.
We do not charge for any request.
12.2 Authorized Users
If you are a coach or staff member using the Service, contact your Institution's administrator or write to privacy@nlroster.com. We will act on your Institution's instructions.
12.3 Website visitors, people who request or use a demonstration, and business contacts
Write to privacy@nlroster.com to ask what information we hold about you, to correct it, or to delete it. We will respond within 30 days. When we delete your information at your request, we keep only your name, the email address or telephone number at which we contacted you or from which you wrote to us, and the date of your request, on our do-not-contact list (Section 10), so that we do not send you messages that promote our services or propose working together again. Copies that our service providers hold are deleted on their own schedules and under their own terms (Sections 8.2 and 10), and the sign-in records of a demonstration account are deleted 90 days after each sign-in (Section 4.3).
12.4 Rights under state law
Depending on where you live, you may have rights under state law to know, access, correct, or delete personal information, or to opt out of its sale or use for targeted advertising. We do not sell personal information or use it for targeted advertising. We handle requests to access, correct, and delete information as described in this Section 12, whether or not a particular law requires us to. If we decline a request, we will explain why, and you may appeal by replying to our response; we will respond to an appeal within 45 days. We will not discriminate against you for making a request.
12.5 California disclosures
Do Not Track. We do not track visitors across websites and do not sell or share personal information, so every visitor already receives the treatment that "Do Not Track" and Global Privacy Control signals request.
Tracking by others. We do not permit other parties to collect personal information about your online activities over time and across websites through the Website.
Categories and sharing. The categories of personally identifiable information we collect are described in Section 4, and the categories of third parties with which we share it are described in Section 8.
Reviewing and changing information. You may review and request changes to your information as described in this Section 12.
13. INFORMATION FROM OUTSIDE THE UNITED STATES
We store the information in the Service in the United States. Some of our service providers, including OpenAI, Vercel, Resend, Aikido, Anthropic, and Google (for our business email), may process or store information in other countries where they or their own providers operate. If you send email to an Institution in the United States from another country, information about you may be processed by the Service on that Institution's behalf.
14. CHANGES TO THIS PRIVACY POLICY
We will post any change to this Privacy Policy on this page and update the "Last Updated" date. If we make a material change, we will notify Institutions and Authorized Users in advance. We will not use information we have already collected in a way materially different from what this Privacy Policy described when we collected it unless we first obtain the consent of the affected Institution and, where the law or Google's or Microsoft's terms require, of the affected users.
15. CONTACT US
Next Level Roster LLC
Sarasota, Florida
Privacy questions and requests: privacy@nlroster.com
Security reports: security@nlroster.com
Support: support@nlroster.com