Privacy Policy

NIL Unlimited, operated by NIL Unlimited LLC (“NIL Unlimited,” “we,” “us,” or “our”), is a multi-platform service that connects eligible athletes, brand partners, and customers through NIL (Name, Image, and Likeness) brand deals, affiliate campaigns, and an athlete-powered e-commerce webshop. The Platform serves athletes at the high school, collegiate (all levels), and post-collegiate levels; brand partners who list products and create campaigns; and customers who purchase products through our webshop.

Our Platform is used by three types of users: athletes who manage NIL deals, affiliate campaigns, and personal storefronts through our mobile application and webshop; brand partners who manage product catalogs, campaigns, and brand pages through our Shopify application, mobile application, and webshop; and customers who purchase products through our webshop or individual athlete storefronts, either as registered account holders or as guests.

NIL Unlimited acts as the merchant of record for all transactions on the webshop. All payments are processed by Stripe, our payment processor. Brand partners are responsible for physical fulfillment, shipping, and handling of returns. NIL Unlimited manages the communication of the fulfillment and returns process between all parties. Shopify is used by brand partners exclusively for store and product catalog management and is not involved in payment processing on our Platform.

This Privacy Policy applies to all NIL Unlimited products and services, including the NIL Unlimited mobile application, the NIL Unlimited webshop, the NIL Unlimited Shopify application, and any associated websites (collectively, the “Platform”). By accessing or using any part of the Platform, you acknowledge that you have read and understood this Policy. This document also includes our Cookie Policy and California Financial Incentive Notice, which appear in the sections below.

If you have questions, please contact us at privacy@nilunlimited.co or by mail at NIL Unlimited LLC, 2237 Blair Blvd, Nashville, TN 37212.

The personal information we collect depends on how you use the Platform. We describe what we collect from each type of user below, followed by information we collect automatically from all users.

Information we collect from athletes

When you apply to register as an athlete, we collect identity and profile data such as your full name, display name, photograph, date of birth, gender, and athletic biography; academic and athletic data including your school name, level of competition, sport, team, state or province of enrollment, eligibility status, and graduation year; contact data including your email address, phone number, and mailing address. If you are under 18 at the time of registration, we also collect the email address of your parent or legal guardian, which is required to complete the registration process.

We also collect account credentials including your username and password, stored in hashed form; NIL eligibility self-certification data; financial and payout data including bank account details, routing numbers, and your Stripe Connect account information used to receive earnings; social media account data from platforms including Instagram, TikTok, X, YouTube, and others via OAuth connections; campaign and content data; storefront data; push notification preferences and device tokens; and communications including messages you send through the Platform, support tickets, and feedback submissions.

If you apply as an athlete but are determined to be in a school or state that does not currently permit NIL activity, we will retain your profile application data on record and notify you by email when you become eligible to participate.

Information we collect from brand partners

When you register as a brand partner, we collect business identity data including company name, brand name, website, and industry; account and contact data; billing and payment data processed by Stripe; Shopify store data including your product catalog information; campaign data including campaign briefs, commission rates, creative assets, eligibility criteria, and performance data; return and refund policy data; and communications including messages with athletes and platform support.

Information we collect from customers

When you make a purchase or create an account on the webshop, we collect identity and contact data including your name, email address, phone number, and shipping and billing addresses; account credentials if you choose to create an account; order and transaction data; product reviews and ratings; push notification preferences; and communications including customer service inquiries.

NIL Unlimited is the merchant of record for all webshop purchases. Payment card data is transmitted directly to Stripe and is never stored on NIL Unlimited’s servers. Physical fulfillment and returns are handled by the applicable brand partner. Each brand partner sets their own return and refund policy within a Platform maximum of 14 days, disclosed at the point of purchase.

If you check out as a guest, we collect only the information necessary to process and fulfill your order. Guest checkout data is not linked to a registered account unless you subsequently create one.

Information collected automatically from all users

Regardless of how you use the Platform, we automatically collect device and technical data such as your IP address, device type, operating system, unique device identifiers, browser type, and mobile network information; usage data including pages or screens viewed, features used, time spent on the Platform, links clicked, and navigation paths; general location data inferred from your IP address; e-commerce session data including shopping cart contents, product views, and checkout flow activity; and cookies and similar tracking technologies as described in the Cookie Policy section below.

Information from third parties

We may also receive information from Shopify (store and product catalog data for brand partners); from Stripe (payment confirmations, tokenized payment references, payout status, and fraud signals); from social media platforms via OAuth connections; from Anthropic, the provider of the Claude AI service we use for athlete-campaign matching and profile tagging; from Klaviyo, our email marketing platform; and from brand partners including campaign eligibility decisions, commission rates, and performance feedback.

We use personal information only for lawful purposes that are consistent with the context in which it was collected.

For athletes

We use your information to review your application and determine your NIL eligibility status; to tag and categorize your athlete profile using AI-assisted tools powered by Claude (Anthropic); to match you with brand campaigns; to operate your athlete storefront on the webshop; to process your earnings and issue payouts through Stripe; to generate required tax documents; to send you campaign updates, payout confirmations, and platform communications; and to detect and prevent fraud or abuse.

For brand partners

We use your information to create and manage your brand partner account; to operate the NIL Unlimited Shopify application; to facilitate campaign creation, athlete matching, and management; to process subscription fees and per-transaction fees through Stripe; to manage communication of order fulfillment and returns; to provide campaign performance analytics; and to detect and prevent fraud or abuse.

For customers

We use your information to process and fulfill your orders; to create and manage your webshop account if you choose to register; to provide customer support; to send you transactional communications related to your purchases; and to detect and prevent fraudulent transactions.

For all users

We use information from all users to improve the Platform, fix bugs, and develop new features; to display product reviews and ratings; to send push notifications and in-app alerts; to comply with applicable laws and regulations in the United States and Canada; to enforce our Terms of Service; and to produce de-identified, aggregated analytics. We send promotional communications only with your consent, and you may opt out at any time.

NIL Unlimited uses artificial intelligence tools, specifically Claude, an AI service provided by Anthropic, PBC, to assist with athlete profile tagging and campaign matching. This process analyzes athlete profile data to generate profile tags and identify the most relevant campaign opportunities for each athlete. The AI-assisted matching is used to inform and improve recommendations but does not make fully autonomous decisions about your eligibility or access to specific campaigns. Human review is part of our overall profile approval and campaign management process.

Where required by applicable law, you have the right to opt out of solely automated decision-making that produces legal or similarly significant effects concerning you, or to request human review of automated decisions. To exercise this right, contact us at privacy@nilunlimited.co with the subject line “Automated Decision-Making Request.”

When athlete profile data is processed through Anthropic’s Claude service, that data is transmitted to Anthropic in accordance with Anthropic’s privacy policy and data processing terms. Anthropic is a data processor acting on our behalf and is contractually bound to process data only as we direct.

When an athlete creates content in connection with a brand campaign on the Platform, ownership and usage rights are governed by the campaign agreement between the athlete and the brand partner. As a general rule: the brand partner owns the content created by the athlete specifically for their campaign; the athlete retains the right to use the content to promote the brand and campaign; and NIL Unlimited retains an irrevocable, royalty-free license to use campaign content on the Platform, in our webshop, and in our marketing materials.

We do not sell your personal information. We share information only in the following circumstances:

• When an athlete joins or applies to a brand campaign, we share that athlete’s profile data with the relevant brand partner.
• When a customer places an order, we share shipping details and order information with the applicable brand partner and shipping carriers.
• In the event of a chargeback, payment dispute, or return, we may share relevant order details with the applicable brand partner and Stripe.
• We share payment and financial data exclusively with Stripe, our PCI-DSS certified payment processor.
• We share brand partner store and product catalog data with Shopify to operate our Shopify application.
• We share athlete profile data with Anthropic, PBC for AI-assisted tagging and campaign matching.
• We share email addresses and engagement data with Klaviyo, our email marketing platform.
• We engage additional service providers for cloud hosting, analytics, customer support, and eligibility review.
• For minor athletes, we share activity and earnings information with the parent or guardian on file.
• We may disclose information to law enforcement or courts when required by applicable US or Canadian law.
• In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

• Athlete account data: retained for the duration of your account and for three years after account deletion.
• Athlete application data for ineligible athletes: retained indefinitely to notify when eligible, unless deletion is requested.
• Brand partner account data: retained for the duration of your account and for three years after closure.
• Financial and tax records: retained for seven years to comply with IRS and Canadian tax requirements.
• Campaign data: retained for three years after campaign completion.
• Customer account data: retained for the duration of your account and for three years after your last transaction.
• Guest checkout data: retained for three to seven years for order fulfillment and tax compliance.
• Communications and support records: retained for two years.
• Device and usage logs: retained for twelve months on a rolling basis.
• Parental consent records: retained for the duration of the athlete’s account and for three years after deletion.

You may request deletion of your account at any time. Following a deletion request, we will delete or anonymize your information within 30 days, subject to any legal retention obligations.

We implement industry-standard technical and organizational measures to protect all personal information, including TLS encryption for data in transit, AES-256 encryption for data at rest, access controls and role-based permissions, regular security assessments, and multi-factor authentication options. All payment card data is handled exclusively by Stripe, our PCI-DSS certified payment processor, and is never transmitted to or stored on NIL Unlimited’s servers.

Athlete profile photographs are reviewed by our team solely for content appropriateness. We do not perform facial recognition, biometric analysis, or any automated processing of facial geometry on profile photographs. No method of transmission or storage is 100% secure. In the event of a data breach, we will notify affected users as required by applicable law.

Minimum age and under-14 protection

The minimum age to use the NIL Unlimited Platform is 14 years old. Users under 14 are blocked from creating an account at the point of entry. If we discover at any time that a user under 14 has created an account, we will immediately terminate the account and delete all associated personal information. Parents or guardians who believe their child under 14 has registered should contact us immediately at privacy@nilunlimited.co.

Verified parental consent for athletes under 18

NIL Unlimited requires verified parental or guardian consent for every athlete user who is under 18 years of age. During registration, if the user’s date of birth indicates they are under 18, a parent or guardian email address is required before registration can proceed. A verification email is sent to the parent or guardian immediately, and the athlete’s account is placed in a pending state. The athlete may complete their profile and browse campaigns during this pending state, but their profile will not go live, they cannot participate in any campaign, and no earnings will be processed until verified parental consent is on record.

Age recalculation

We recalculate each athlete’s age on a regular basis. When an athlete turns 18, the parental consent requirement is automatically lifted and ongoing parental notifications cease. No action is required from the athlete.

Ongoing parental notifications

Once a minor athlete’s profile is active, NIL Unlimited sends the parent or guardian notifications of every new campaign offer received, every campaign application submitted, every payout processed, and every content submission made through the Platform where review is involved.

Parental rights and withdrawal of consent

Parents and guardians of minor athletes may at any time: review all personal information we hold about their child, request correction of inaccurate information, withdraw consent, and request deletion of their child’s account. If consent is withdrawn, the minor athlete’s profile will be taken down and the account suspended immediately. To exercise these rights, contact us at privacy@nilunlimited.co with the subject line “Parental Rights Request.”

Misrepresentation of age

If we discover that an athlete has misrepresented their date of birth during registration, we will immediately suspend the account, contact the athlete and any parent or guardian on file, and require re-verification before the account may be reinstated. We reserve the right to terminate any account where age misrepresentation is confirmed.

Depending on where you reside, you may have the following rights with respect to your personal information:

• Request a copy of the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request that we delete your personal information, subject to legal retention requirements.
• Request that we provide your data in a structured, machine-readable format.
• Unsubscribe from promotional emails at any time.
• Request that we restrict processing of your information.
• Object to processing where we rely on legitimate interests.
• Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact us at privacy@nilunlimited.co. We will respond within 30 days, or within 45 days if additional time is needed, with notice provided.

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• The right to know what personal information is collected, used, shared, or sold.
• The right to delete personal information, subject to exceptions.
• The right to opt out of the sale or sharing of personal information — we do not sell personal information.
• The right to correct inaccurate personal information.
• The right to limit use and disclosure of sensitive personal information.
• The right to non-discrimination for exercising CCPA rights.

To submit a verified consumer request, email privacy@nilunlimited.co or call (615) 719-1084. We will verify your identity before processing the request.

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws may have rights to access, correct, delete, and port their data, and to opt out of certain uses. To exercise these rights, contact us at privacy@nilunlimited.co.

For users located in Canada, we collect, use, and disclose personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec’s Law 25. Canadian users have the right to access personal information we hold about them, to correct inaccurate information, to withdraw consent to certain uses subject to legal and contractual restrictions, and to file a complaint with the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority. To exercise these rights, contact our Privacy Officer at privacy@nilunlimited.co.

NIL Unlimited is based in the United States. If you access the Platform from Canada or elsewhere, your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your home country. By using the Platform, you consent to this transfer. We take steps to ensure that personal information transferred across borders receives appropriate protection consistent with applicable law.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy with a revised “Last Updated” date and, where required by law or where changes are significant, by sending direct notice via email or in-app notification. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy.

Cookies are small text files placed on your device when you access a website or application. Similar technologies include web beacons, pixel tags, local storage objects, and SDKs embedded in our mobile application. This Cookie Policy explains how NIL Unlimited uses these technologies across all parts of the Platform and should be read alongside our Privacy Policy above.

Strictly necessary cookies

These cookies are essential for the Platform to function and cannot be switched off. They include session authentication tokens, shopping cart and checkout session storage, security and fraud-prevention tokens, load balancing and server routing, and user consent preference storage.

Functional cookies

These cookies enable enhanced features and personalization, including language and regional preference storage, remembering your login status between sessions, saving your in-app settings, and storing items in wish lists or saved-for-later features on the webshop.

Analytics cookies

These cookies allow us to count visits and traffic sources so we can measure and improve Platform performance. Analytics providers include Google Analytics, Firebase Analytics, Mixpanel, Amplitude, and Klaviyo.

E-commerce and performance cookies

These cookies support webshop functionality and help us measure the performance of athlete storefronts and affiliate campaigns, including affiliate link tracking, conversion tracking, and checkout flow cookies.

Marketing and advertising cookies

These cookies may be set through our Platform by advertising partners including Meta Pixel, TikTok Pixel, and Google Ads. These are used primarily to measure the effectiveness of our own marketing efforts and athlete campaign performance.

Third-party cookies

Some content or functionality is provided by third parties such as Shopify, embedded social media feeds, the Stripe payment widget, and shipping tracking tools. These third parties may set their own cookies subject to their own privacy policies.

Session cookies are deleted when you close your browser. Persistent cookies remain for 30 days to 2 years depending on the cookie. Affiliate attribution cookies are retained for the applicable campaign attribution window, typically 30 to 90 days. Third-party cookies are governed by the respective third party’s retention practices.

You can manage cookies through our in-app and webshop consent settings, through your browser settings, and through your mobile device settings. You may also opt out of interest-based advertising through the Digital Advertising Alliance at optout.aboutads.info or the Network Advertising Initiative at optout.networkadvertising.org. Our Platform does not currently respond to “Do Not Track” signals.

This California Financial Incentive Notice is provided to California residents pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), specifically California Civil Code Section 1798.125. This Notice applies to athlete users of the NIL Unlimited Platform.

NIL Unlimited offers financial incentives to eligible athletes in connection with the collection, retention, and use of their personal information. These Earnings constitute financial incentives as defined by the CCPA. The programs subject to this Notice include:

• Campaign Earnings Program: athletes earn commissions at rates set by brand partners based on sales generated through affiliate links and campaigns.
• Athlete Storefront Program: athletes earn revenue from customer purchases made through their branded storefronts on the webshop.
• Milestones and Rewards Program: athletes earn additional compensation for reaching performance targets tied to order sales.
• Referral Program: athletes who refer other athletes to the Platform may earn referral bonuses.
• Performance Leaderboard Rewards: athletes who achieve top performance rankings may receive additional rewards and recognition.

Based on our analysis, we estimate that the value of the personal information associated with an average athlete account ranges from approximately $10 to $500 per year, depending on factors including the athlete’s sport, level of competition, social media following, engagement rate, campaign participation level, and storefront revenue generated. Athletes directly receive the commission revenue their campaigns and storefronts generate, minus applicable Platform transaction fees.

Participation in NIL Unlimited’s financial incentive programs is entirely voluntary. To opt in, download the NIL Unlimited app, submit an athlete application, complete the NIL eligibility self-certification, provide verified parental consent if under 18, receive profile approval, accept the Terms of Service and Privacy Policy, and connect a valid Stripe account to receive Earnings.

You may opt out at any time without penalty. To opt out in-app, navigate to Settings > Account > Delete Account, or Settings > Campaign Preferences > Opt Out of All Campaigns. To opt out by email, send a request to privacy@nilunlimited.co with the subject line “Opt Out of Financial Incentive Programs.” We will process your request within 30 days.

We will not discriminate against you for exercising your CCPA rights. However, if you opt out of financial incentive programs, you will no longer be able to receive the associated Earnings. This is not discrimination but the natural consequence of opting out of a voluntary program.