Privacy Policy

This Privacy Policy explains how Sports Media, Inc. ("Sports Media," "we," "us") collects, uses, shares and protects personal information through NILSuperStar.com and related services ("NIL Superstar"). Sports Media, Inc. is the controller of your personal data. Our address is 274 Mount Harvard Ave., Suite 350, Severance, CO 80550. Privacy questions and requests: info@nilsuperstar.com.

1. Who NIL Superstar is for

NIL Superstar is for athletes 13 and older, their parents and guardians, and verified businesses. We do not allow anyone under 13 to create an account and we do not knowingly collect personal information from children under 13. If we learn we have, we delete it. Athletes 13 to 17 can use NIL Superstar only after a parent or guardian approves the account. See our Parents and Guardians guide.

2. Information we collect

Information you give us

• Account and signup: name, email, level (high school, college or other), school or club, sport, state, graduation year, date of birth, and optionally a mobile number (athletes 18 and older only).
• Parent or guardian information for athletes under 18: name and email, and a record of their approval.
• Profile information you choose to add later, such as photos, a bio, statistics, awards and social media handles.
• Consent records: each choice you make about terms, marketing email, text messages and brand visibility, with the date, time, IP address and browser of the choice.
• Brand accounts: business name, contact details, category, and disclosures about any ties to a school's athletics program.
• Messages and opportunities exchanged on the platform.

We do not collect bank account numbers, Social Security numbers or home addresses at signup. Payout and tax details, when needed for a store royalty or program payment, are collected and held by our payment processor.

Information collected automatically

• Device and log data such as IP address, browser type, pages viewed and referring site.
• Cookies and similar technologies, described in our Cookie Policy. Analytics and advertising cookies run only with your consent and never on account pages.

We do not collect precise geolocation.

3. How we use information

• To create and run your account, confirm your email and verify eligibility.
• To apply age, state and school rules, including keeping minors' profiles private and blocking high school NIL where a state does not allow it.
• To show your profile to verified brands, only if you turn on brand visibility. Athletes under 18 are never shown to brands without parent or guardian approval and are never shown to search engines.
• To send account, safety and compliance messages, such as parent approval requests and reporting reminders.
• To send marketing email or text messages, only with your separate consent. We never send marketing to athletes under 18.
• To keep the platform safe, prevent fraud, and meet legal obligations.
• To understand how the site is used and improve it, using aggregated or consented analytics.

4. How we share information

• Brands on the platform: only profile fields you choose to make visible, and only after you opt in. Brands never see your date of birth, email, phone number or a minor's school or city through the directory. First contact happens through platform messaging.
• Service providers who operate the platform for us under written contracts: hosting, database, email delivery, customer relationship management (GoHighLevel), print-on-demand fulfillment, and payment processing. They may use your information only to provide services to us.
• Parents and guardians of athletes under 18 receive account and brand communications for that athlete.
• Legal and safety: when required by law, or to protect the safety of any person, including reporting suspected exploitation of a minor.
• Business transfers: if Sports Media is involved in a merger or sale, information may transfer subject to this policy.

We do not sell personal data to data brokers or share it with anyone outside the platform for their own marketing. Brands pay for access to our software. Because brand access to opted-in athlete profiles may be treated as a "sale" under some state laws, we make brand visibility a separate opt-in that you can turn off at any time. We do not use athletes' data for targeted advertising.

5. Athletes under 18

• No accounts under 13.
• Accounts for ages 13 to 17 stay inactive until a parent or guardian approves.
• Minors' profiles are private to brands and never indexed by search engines; the database itself enforces this.
• We do not sell minors' personal data, use it for targeted advertising or profiling, or send minors marketing messages.
• We do not use design features meant to significantly increase a minor's time on the platform.
• We perform and keep data protection assessments for features used by minors, as Colorado law requires.
• A parent or guardian can request access to or deletion of their minor's data at any time.

6. Your choices and rights

Depending on where you live, you may have the right to:

• Confirm whether we process your personal data and access it.
• Correct inaccurate data.
• Delete your data.
• Get a portable copy of your data.
• Opt out of the sale of personal data, targeted advertising and profiling. You can turn off brand visibility in your dashboard at any time.
• Withdraw consent for marketing email (use the unsubscribe link) or text messages (reply STOP).

To make a request, email info@nilsuperstar.com from the email on your account. We verify requests before acting and respond within 45 days, which may be extended once by 45 days when necessary. An authorized agent or a parent or guardian may make a request for you. We do not discriminate against anyone for exercising privacy rights.

Appeals

If we decline your request, you may appeal by replying to our decision with the subject line "Privacy Appeal." We respond to appeals within 45 days. If you disagree with the outcome, you may contact your state attorney general. Colorado residents may contact the Colorado Attorney General.

Global Privacy Control

We honor the Global Privacy Control browser signal as a request to opt out of targeted advertising and the sale of personal data. When we detect it, advertising cookies stay off.

7. Data retention

• Account and profile data: while your account is open, then deleted or de-identified within 90 days of closure unless the law requires longer.
• Consent and parent approval records: kept for as long as needed to prove consent, generally five years.
• Signup form details: deleted 30 days after submission, whether or not the signup was completed. The record of your consent choices is kept as described above.
• Security and audit logs: up to five years.

8. Security

We encrypt data in transit, limit access by role, keep consent records that cannot be altered, and enforce minors' privacy rules in the database itself. We maintain a written information security program. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

9. Changes

We will post any changes here and update the date above. For material changes, we will notify account holders by email before the change takes effect.