PRIVACY POLICY

MyNextOffer, LLC (“MyNextOffer,” “we,” “us,” or “our”) operates the MyNextOffer platform located at mynextoffer.io (the “Service”). This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you use the Service. Please read it carefully. By using the Service you consent to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you provide when you create an account or use the Service, including:

• Account information: name and email address
• Athlete profile data: gender, sport, position, graduation year, high school name, city, state, GPA, SAT/ACT scores, intended major, height, weight, athletic stats, highlight video links, social media handles, profile photo, and a short bio
• Optional contact details: if you add them on your profile, your phone number, date of birth, street address and ZIP code, and a parent or guardian’s name, email, and phone number. These are used only to help you fill in recruiting questionnaires and are never shown on your public profile page.
• Unofficial transcript: if you upload one, the file itself (a PDF or image of your academic record, which may show your grades, school, student ID or date of birth). It is stored so you can attach it to emails you choose to send to coaches; it is never shown on your public profile page and is not sent to AI providers. You can replace or remove it at any time.
• Information about other people: if you ask someone for an endorsement, the name, role and email address you enter for them, and what they write when they complete it (their name, role, email, relationship to you, and message). Endorsements appear on your public profile only if you choose to show them.
• Recruiting activity: schools saved, coaches contacted, outreach log entries, messages generated, follow-up notes
• Payment information: billing name, email, and payment method details processed by Stripe (we do not store full card numbers)
• Gmail connection data: if you connect your Gmail account, we store your Gmail address, AES-256-GCM encrypted OAuth access and refresh tokens, and a daily send counter. We do not store the content of any emails in your Gmail inbox.
• Communications: messages you send to our support team

1.2 Information Collected Automatically

When you use the Service we automatically collect:

• Usage data: pages visited, features used, AI generations requested, session duration, click patterns
• Device and technical data: IP address, browser type and version, operating system, device identifiers, referring URLs
• Cookies and similar technologies: cookies that keep you signed in and, only if you accept them, cookies that remember how you found us and power analytics (see Section 9)
• Email delivery data: when you send a recruiting email through the Service, we embed a tracking pixel in that email. If the recipient opens the email, we record the open timestamp, open count, the recipient’s IP address, and user-agent string. We also track link clicks within sent emails. This data is used to show you whether a coach opened or engaged with your email. See Section 5 for more detail.

1.3 Information from Third Parties

We may receive limited information from third-party services you connect. When you connect Gmail, Google provides us with your Gmail address and OAuth tokens. When you pay, Stripe confirms your payment status. We do not purchase data from data brokers.

2. How We Use Your Information

We use your information for the following purposes:

3. AI Processing and Third-Party AI Providers

MyNextOffer uses AI APIs to power content generation features. When you request AI-generated content (coach emails, follow-ups, strategy advice, social posts), relevant portions of your athlete profile are transmitted to the AI provider to generate the output.

• We use OpenAI, Anthropic (Claude) and Google (Gemini) APIs; which provider handles a given feature can change. Data transmitted is governed by each provider’s terms (OpenAI, Anthropic, Google).
• Recruiting Assistant (chat): when you ask the Recruiting Assistant a question, your message and the parts of your MyNextOffer data it needs to answer (profile, stats, saved schools, coach contacts and recruiting activity — never your date of birth, home address, phone or parent contact details) are sent to an AI provider. The Recruiting Assistant only uses providers whose API terms do not use that data to train their models. Your conversations are stored so you can return to them, deleted automatically after 180 days without activity, and deleted immediately when you delete a conversation or your account.
• We do not transmit your payment information or full account credentials to AI providers.
• AI-generated content may be stored in our database to display your generation history and to improve our prompt quality, and is deleted after 90 days (see Section 7).

4. Gmail API Integration & Limited Use

Connecting your Gmail account is optional. If you choose to connect it, the following applies:

4.1 Scope Requested

We request a single Google OAuth scope:

• gmail.send — allows us to send recruiting emails from your Gmail address on your behalf. You compose and approve every message before it is sent. This scope only permits sending; it does not grant the ability to read, list, search, modify, or delete any message in your mailbox.

4.2 What We Store

• Your Gmail address
• OAuth access and refresh tokens, encrypted at rest using AES-256-GCM
• Token expiry timestamp
• A daily send counter (resets at midnight UTC) to stay within Google’s sending limits

4.3 What We Do Not Do

• We do not read, index, or store the content of your Gmail inbox
• We do not read, list, search, or access message bodies, subject lines, headers, metadata, or attachments of any message
• We do not use your Gmail data to serve advertisements
• We do not share your Gmail data with any third party except as strictly necessary to operate the Service (Google’s own API servers)
• We do not use your Gmail data for any purpose other than sending the recruiting emails you compose and approve
• We do not transfer Gmail data to, or use it for training, any AI/ML model

4.4 Disconnecting Gmail

You may disconnect your Gmail account at any time from Settings → Gmail Connection. Upon disconnection, we revoke our access with Google and your encrypted tokens are immediately deleted from our database. Deleting your account does the same. You can also revoke access at any time from your Google Account permissions.

5. Email Tracking

When you send a recruiting email through the Service, we embed a small transparent 1×1 pixel image in the email. When the email is opened by the recipient, their email client loads this pixel, which allows us to record:

• The date and time the email was opened
• The number of times the email was opened
• The IP address and browser/mail client user-agent string of the device that loaded the pixel

We also track whether the Hudl or YouTube film links in your sent emails are clicked, by routing those links through mynextoffer.io before forwarding to the film. The pixel and the redirect use our own mynextoffer.io address, not a disguised one. A click can come from a mail security scanner, so it does not mean a coach watched the film.

This data is displayed only to you in your outreach dashboard to help you gauge coach engagement. It is not sold, shared with third parties, or used for advertising. Recipients (college coaches) are the individuals whose IP addresses and user-agents may be incidentally collected through this tracking. If a coach uses an email privacy proxy (such as Apple’s Mail Privacy Protection), the data recorded will reflect the proxy rather than their actual device. Tracking is on by default. You can turn it off for every email in Settings → Email, or for one email by turning on Personal mode when you compose it. Laws on email tracking differ by state; you are responsible for making sure it is not prohibited where you are, and should turn it off if you are unsure. The IP address and user-agent are deleted 90 days after they are recorded; the sent email and its open and click counts stay in your history until you delete your account.

5A. Information About College Coaches

MyNextOffer keeps a directory of college coaches so athletes can find and contact the programs recruiting their sport. This section is for those coaches.

• What we hold: name, job title, school, sport and team, work email address, work phone number, and public social media handle.
• Where it comes from: information colleges publish on their athletics websites (staff directories and coach biography pages). We check it against those public pages on a regular schedule and update or retire records when a page changes.
• How it is used: it is shown to signed-in MyNextOffer subscribers so they can contact coaches about recruiting. Athletes write and send their own emails from their own email accounts; we do not email coaches on our own behalf. We use AI providers (see Section 3) to read athletics web pages and to tell whether two directory entries are the same person, and an athlete’s Recruiting Assistant question may include coach contact details from their own list. Emails athletes send may include the tracking described in Section 5.
• What we do not do: we do not sell coach information, and we do not publish coach email addresses or phone numbers on public pages.
• Retention: a coach who leaves a school is marked as departed and is no longer shown to athletes. Working copies made while reading athletics websites are deleted within 30 to 90 days.

Asking to be removed. Email privacy@mynextoffer.io with your name, school, and the email address listed for you. We will respond within 30 days. We remove your contact details, stop showing you to athletes, delete the copies we made while reading athletics websites, and make sure our collection does not add you back. To do that we keep only your name, your school, and a one-way hash of your email address (not the address itself). Emails athletes have already sent you stay in those athletes’ own account history. You can also use the rights described in Section 11B and, if you live in California, Section 12.

6. How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

• Service providers: Third-party vendors who help us operate the Service — Stripe (payments), Resend (emails we send you), Anthropic / OpenAI / Google (AI generation), Google (Gmail API, for emails you send), Railway (hosting, database and cache), Sentry (error reporting), and PostHog and Google Analytics (analytics; in your browser only after you accept cookies, see Section 9). These providers are contractually restricted from using your data for any purpose other than providing services to us.
• Legal requirements: When required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: In connection with a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred. We will notify you via email and/or a prominent notice on the Service before such a transfer.
• With your consent: For any other purpose with your explicit consent.

6.1 Your Public Profile Page

Every account, including a Free Profile, can publish a public profile page to share with college coaches. The page is off by default and is published only when you turn it on and confirm. If the athlete is under 18, or the profile has no date of birth, the person turning it on must confirm they are the athlete’s parent or guardian or that a parent or guardian has approved; we record which confirmation was given and when. The link ends in a random code, so the page cannot be found by guessing a name. While it is on, anyone with the link can see: your name, sport, position, graduation year, high school, city and state, GPA, SAT/ACT scores, intended major, height, weight, athletic stats and measurables, achievements, bio, profile photo, highlight video links, social media handles, offers you record (school and offer type, marked as self-reported — never the dollar amount), and endorsements you choose to show. It never shows your email address, phone number, date of birth, street address, parent/guardian contact details, NCAA Eligibility Center ID, or transcript. We ask search engines not to index public profile pages, but anyone you share the link with can view or pass it on. We count views of the page to show you coach interest. You can turn the page off at any time from your profile; it stops being available immediately.

6.2 Your NIL Portfolio Page

NIL tools are not currently offered, and no NIL portfolio page can be published or viewed. If they return, plans that include them will be able to publish a separate NIL portfolio page for brands. It is off by default, needs the same confirmation as the profile page (6.1), and its link also ends in a random code. While it is on, anyone with the link can see: your name, sport, position, graduation year, GPA, tagline, the brand categories you choose, the rate card you enter, your social media handles and follower counts, your average engagement rate, a highlight film link, deals you mark public (if you turn deal history on), and the brand contact email you enter, which brands can use to write to you. It never shows our AI estimate of your NIL value, your phone number, date of birth, street address, parent/guardian contact details, test scores, or transcript. We ask search engines not to index it. You can turn it off at any time from the NIL Portfolio page.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account deletion: When you delete your account, your personal data (profile, outreach history, AI generations, Gmail connection) is permanently and immediately deleted via cascading database deletion, our access to your Gmail is revoked with Google, and your analytics profile and its events are deleted from PostHog. This action is irreversible. We keep payment records held by Stripe (see below). We also keep, with no name or email attached: usage and billing counts (AI token counts, billing events), the referral record of whoever referred you (without your email address), and Google Analytics events sent with your cookie consent, which carry only a random ID and expire under our Google Analytics retention setting.
• AI generation logs: Deleted 90 days after they are created, or earlier with your account.
• Payment records: Retained for 7 years as required by applicable tax and accounting regulations. These records are managed by Stripe and contain only transaction metadata, not full payment card details.
• Recruiting Assistant conversations: Deleted automatically after 180 days without activity, when you delete the conversation, or with your account. Usage records kept for billing and cost reporting contain token counts only, not message text.
• Sent emails and email tracking data: Emails you send through the Service and their open and click records are kept while your account is active and deleted with your account. The recipient’s IP address and user-agent are deleted 90 days after they are recorded.
• Unofficial transcript: Kept until you replace or remove it, and deleted with your account.
• College coach information: see Section 5A.
• Gmail tokens: Revoked with Google and deleted immediately when you disconnect Gmail or delete your account.

8. Data Security

We implement industry-standard technical and organizational measures to protect your personal information, including:

• HTTPS/TLS encryption for all data in transit
• AES-256-GCM encryption for Gmail OAuth tokens stored at rest
• Signed, HTTP-only session cookies (JWT) sent only over HTTPS
• Parameterized database queries to prevent SQL injection
• A database that is not reachable from the public internet, which our application reaches through a restricted account that cannot change the database structure
• Role-based access controls limiting employee access to personal data
• Regular security review of our codebase and infrastructure

No system is 100% secure. If a security breach affects your personal information, we will notify you as required by applicable law.

9. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: your session cookie, a short-lived cookie that protects the Gmail connection step, and a cookie that records your cookie choice. These cannot be disabled without logging you out.
• Site cookies: our own cookies that remember a referral link you opened, how you first reached the site, the ad you last clicked to reach it (if any), and whether you have seen the homepage on a phone. They are set only after you accept cookies.
• Analytics cookies: Usage data to understand how the Service is used, collected by PostHog and Google Analytics 4 only after you accept analytics cookies. PostHog is set to discard your IP address. Google Analytics is configured with Google signals and ad personalization turned off, so the data is not used for advertising.
• Error reporting: Sentry receives reports of errors in your browser (including your IP address, browser and the page you were on) only after you accept cookies. Errors on our servers are always reported.

Separately from cookies, our servers record a small number of account and billing events — for example that an account was created, a checkout was started or left unfinished, a subscription began or a payment failed, that an account created from a referral link became a paid subscription, and that a coach opened or clicked an email you sent through MyNextOffer — so we can measure how the product is working. These are records of actions you or a coach took in the Service, not browsing analytics. They are sent to our analytics providers under your user ID, and to Google Analytics only while you accept analytics cookies (declining stops it). Neither these events nor our browser analytics include your email address or name.

We also keep, in our own database and not with any analytics provider, the date your account first reached each step of using the Service — completing your profile, generating your Division Fit, opening the school or coach search, generating or sending a coach email, and seeing plan prices — and the date you last used the Service. We use these to understand where people get stuck, and to decide which account emails to send you (you can turn those off in Settings). A link opened with a referral code is counted per code, with nothing stored about the visitor.

We do not use advertising cookies or share cookie data with advertising networks. Our Cookie Policy lists each cookie we set, and you can change your cookie choice at any time from “Cookie settings” on that page. We honor the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as declining optional cookies, as described in the Cookie Policy. You can also disable cookies in your browser settings, but this may affect your ability to use the Service.

10. Children’s Privacy

The Service is intended for use by high school athletes who are at least 13 years of age. We do not knowingly collect personal information from children under 13. If a parent or guardian believes their child under 13 has provided personal information to us, please contact us at privacy@mynextoffer.io and we will delete such information promptly.

Users between 13 and 17 years of age should use the Service only with the knowledge and supervision of a parent or legal guardian. We encourage parents to review this Privacy Policy with their children. By using the Service, users under 18 represent that they have obtained appropriate parental consent.

Creating an account and a Free Profile does not require payment, so a user under 18 can create an account and publish a public profile page without a parent completing a checkout. At sign-up, we ask for the athlete’s date of birth and do not create an account for an athlete under 13; we use that date only for this check and do not store it. Every new user must also confirm that they are 18 or older or are the athlete’s parent or legal guardian. If a date of birth entered on a profile shows an athlete under 13, we do not save it and we review the account. Users under 18 should turn on their public profile page only with a parent or guardian’s permission. A parent or guardian may ask us to turn off a minor’s public profile page, or to delete the account, by contacting privacy@mynextoffer.io.

11. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Delete your account and all associated data at any time from Settings → Account → Delete Account. This is immediate and irreversible.
• Portability: Download a machine-readable copy of your personal data anytime from Settings → Account → Download My Data.
• Opt-out of marketing: Unsubscribe from marketing emails at any time using the unsubscribe link in any email or by contacting us.
• Disconnect Gmail: Revoke Gmail access at any time from Settings → Gmail Connection or via your Google Account permissions page.
• Withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@mynextoffer.io. Section 11B explains how we verify and answer requests and how to appeal our decision.

11A. International Users

MyNextOffer is operated from the United States and is intended for users located in the United States. We do not target or market the Service to individuals in the European Union, United Kingdom, or other regions with distinct data-protection regimes. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, and you consent to that.

11B. U.S. State Privacy Rights

Several U.S. states give their residents rights over their personal information. Whether or not a particular state’s law applies to us, we give every user in the United States the rights below and handle every request the same way. California residents have the additional rights described in Section 12.

• Access and portability: Confirm whether we process your personal information and get a copy of it, including from Settings → Account → Download My Data.
• Correction: Correct inaccurate personal information, most of which you can edit yourself in your profile.
• Deletion: Delete personal information you provided or that we hold about you, including by deleting your account.
• Opting out of sale, targeted advertising and profiling: We do not sell personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. Division Fit scores and other AI recommendations are suggestions you ask for, not decisions made about you.

Minors and sensitive information

We do not sell the personal information of users we know are under 18, use it for targeted advertising, or use it for profiling. We do not create accounts for children under 13 (see Section 10).

Your profile can include your height, weight, and other athletic measurements. We collect them as athletic statistics for recruiting: we show them on your profile and, if you publish one, your public profile page, and we use them in the AI features you ask for. We do not ask for medical information, do not use these measurements to infer any health condition, and do not share them with advertisers. You can change or remove them from your profile at any time.

Making a request

Email privacy@mynextoffer.io with “Privacy Request” in the subject line, or use the Settings tools above. We will verify your identity, usually by confirming the request from the email address on your account. We do not charge for requests. We will respond within 45 days; if we need more time where the law allows it, we will tell you why within those 45 days and respond within 45 more. You may use an authorized agent as described in Section 12.5, and a parent or legal guardian may make a request for a user under 18.

Appealing our decision

If we decline to act on your request, in whole or in part, we will explain why. You can appeal by replying to our decision or by emailing privacy@mynextoffer.io with “Privacy Request Appeal” in the subject line. We will review the decision again and tell you the result in writing, with our reasons, within 45 days. If we deny your appeal, you may contact the attorney general of your state, and our response will tell you how.

Global Privacy Control

We treat a Global Privacy Control signal from your browser as a request to opt out, and turn off optional cookies and browser analytics for that browser (see Section 9 and the Cookie Policy). Because we do not sell personal information or use it for targeted advertising, there is nothing further to opt out of.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These rights apply regardless of whether our business meets the statutory thresholds — we extend them to all California residents as a matter of policy.

12.1 Your Rights

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions (e.g., completing a transaction, detecting security incidents, complying with legal obligations).
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. You therefore have no need to opt out, but you may contact us to confirm this at any time. We also honor the Global Privacy Control signal (Section 11B).
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information (as defined by CPRA) for purposes beyond those strictly necessary to provide the Service. See Section 12.3 below.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights. We will not deny you goods or services, charge you different prices, or provide a different level of quality because you exercised a CCPA right.

12.2 Categories of Personal Information Collected

In the past 12 months, we have collected the following statutory categories of personal information:

* Internet/network activity data is processed by PostHog and Google Analytics 4 (our analytics providers) solely for the purpose of improving our Service. Neither receives this data for cross-context behavioral advertising (Google signals and ad personalization are turned off), and neither uses it for any purpose other than providing analytics services to us. This does not constitute “sharing” under CCPA. Browser analytics are only activated with your cookie consent (see Section 9).

12.3 Sensitive Personal Information

Under CPRA, certain categories of information are designated as “sensitive personal information.” We collect the following that may qualify:

• Account login credentials: We store your email address and use OTP (one-time password) codes for authentication. We do not store passwords.

We do not use or disclose sensitive personal information for any purpose other than those permitted by CPRA (providing the Service, ensuring security, and fulfilling legal obligations). We do not use sensitive personal information to infer characteristics about you beyond what is necessary to provide the recruiting features you have requested.

Academic data (GPA, SAT/ACT) and athletic statistics you voluntarily provide, including height and weight, are used solely to personalize your recruiting profile and AI-generated content. They are not sold, shared with advertisers, or used for profiling beyond the Service, and we do not use them to infer health information (see Section 11B).

12.4 How to Submit a California Privacy Request

To exercise any of the rights above, you may:

• Email us at privacy@mynextoffer.io with “California Privacy Request” in the subject line, or
• Delete your account directly from Settings → Account → Delete Account (immediate, covers the Right to Delete)

We will acknowledge your request within 10 business days and respond within 45 days. If we require more time, we will notify you of the extension and the reason (maximum one additional 45-day extension). We may need to verify your identity before processing your request.

12.5 Authorized Agents

A California resident may designate an authorized agent to submit a CCPA/CPRA request on their behalf. To do so, the authorized agent must provide written authorization signed by you, and we may contact you directly to verify the request. Authorized agent requests should be submitted to privacy@mynextoffer.io with “Authorized Agent Request” in the subject line, along with a copy of the signed authorization.

12.6 Shine the Light (Cal. Civ. Code § 1798.83)

California residents may request information about whether we have disclosed personal information to third parties for their direct marketing purposes during the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes. If you have questions, contact us at privacy@mynextoffer.io.

12.7 Notice of Financial Incentive: Referral Program

Our referral program offers a discount and a credit that involve personal information, so we describe it here. Its terms:

• What you get: A friend who creates an account from your referral link and picks a paid plan gets 50% off their first month. When their first payment goes through, you get a free month of your plan as a credit on your bill.
• Personal information involved: your referral code; a record linking your account to the friend’s account; the friend’s email address, which we keep with that record and show to you only in part (for example “jor•••@gmail.com”); and the referral’s status and dates. If you accept cookies, a cookie remembers a referral link you opened for 30 days.
• Opting in: You opt in by sharing your link; your friend opts in by creating an account from it. Nobody is enrolled automatically, and no one is charged more or served worse for not taking part.
• Withdrawing: Stop sharing your link at any time. To remove the link between your account and a referred or referring account, email privacy@mynextoffer.io; a discount or credit not yet applied is then no longer owed.
• Value of the information: We estimate the value of the personal information involved as equal to the discount and credit we give, which is what the program costs us. We calculated it from those costs and the price of the plan involved.

13. Third-Party Links

The Service may contain links to third-party websites and services (including Hudl, YouTube, and college athletic department websites). We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We post every version on this page with its effective date. Before a material change takes effect, we will tell you by email to your account address or by a notice when you sign in. Where the law requires your consent to a new use of personal information we already hold, we will ask for it and will not make that use without it.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team:

MyNextOffer, LLC
4410 Zack Rd, Monroe, NC 28110
Email: privacy@mynextoffer.io
Website: mynextoffer.io

We take privacy inquiries seriously and will respond to verified requests within the times stated in Sections 11B and 12.4.