Privacy Policy

1.People and responsibilities

This policy applies to visitors, applicants, invited staff, chapter officers, members, alumni, prospects and students in invited university registration pilots. A chapter or institution decides the purposes and authorized use of records it collects through its workspace; Greek Central processes those records to provide the service and follow lawful instructions. Applicable legal roles depend on the activity and law, not a blanket certification.

The service is designed for college communities, not children under 13. We do not represent that we verify each user’s age. Contact Privacy if you believe a child’s information was submitted inappropriately. Chapters and institutions must have authority to provide information from school or other systems.

2.Information and sources

We receive information from you, chapter and institution staff, invited participants, imported records, service providers and use of the app. Applications include contact details, role, affiliation, chapter size, goals and responses. Accounts include identity, email, profile details, notification preferences and authentication information handled by our auth provider.

Chapter records may include roster contacts, membership statuses and positions, custom fields, academic terms, prospect invitations, recruitment forms, photos, notes, ratings, event history, bids and sent messages. Participation records include events, guests, RSVPs, check-in, attendance corrections and excuses, private programs, enrollments, requirements, progress, evidence, Tasks / Assignments, reviews and points.

Communication records include channels, groups, direct messages, attachments, announcements, acknowledgements, files and versions, poll/election eligibility, ballots, results and certification. Alumni records include directory and contact preferences. Emergency contacts or other sensitive custom fields are processed only where a chapter collects them with appropriate authority.

Financial records include subscriptions, provider identifiers and statuses, member charges, installments, manual payments and claims, credits, waivers, returns, refunds, disputes, budgets, expenses, receipts and reimbursement records. Autopay includes versioned consent, method labels and identifiers, gross caps, notices and attempts. Stripe collects raw payment credentials; Greek Central does not store full card or bank-account numbers.

University pilot data includes office and team staff, canonical chapter listings and recognition metadata, invitations, connections, consent history, registration cycles, form responses, uploads, review decisions, optional institution-fee records, delegates, meetings, votes and permitted reports. Milo processes prompts, uploads, scoped context, replies and action proposals. Support records include requests, reasons, targets, session expiry, access/action audits and customer notices.

Technical data may include IP address, browser and device details, pages and requests, error reports, security logs, essential cookies and local/session browser storage. Provider logs may also process technical information needed to serve and protect the app.

3.Purposes

We use information to review applications, verify invitations, authenticate users, display permitted records, run confirmed workflows, provide notifications and account emails, record or process authorized payments, respond to support, prevent abuse, investigate errors and maintain service integrity.

We may use service diagnostics and appropriately aggregated information to understand reliability and improve the product. We do not use private chapter records as public testimonials or advertising content. Necessary workspace processing may occur when a user requests AI assistance or an authorized support session.

4.Who sees workspace records

Ordinary access depends on the current workspace, membership, staff scope, positions, participants, record ownership and consent. An officer does not automatically receive every conversation, protected ballot or sensitive field. A prospect’s account shows their own eligible experience and officer-sent information, never internal ratings, stages, evaluations or ballots.

Chapter-approved organization connections provide only permitted datasets with their chosen sharing scope. Generic membership counts are not education or program progress. Education and program details, evidence, enrollment/progress and derived attendance or completion metrics never enter routine office, council-team or national sharing, templates, public pages, exports or standard platform support. Sponsorship and affiliation do not override this boundary.

Student registration profiles are shared only with eligible participating chapters the student selected and only through permitted fields. Private review notes, student IDs and sensitive academic documents are not ordinary chapter-shared fields. Outcomes require the configured cycle and student consent. Revocation stops future authorized server access; it cannot retrieve previously downloaded copies.

5.Platform support and legal requests

The authorized platform owner can start a reasoned, time-limited support session for a chapter or office. The session and actions are audited and the customer is shown a notice. It does not create real chapter membership, team staff membership or sharing consent. Education and program records remain excluded, including their derived information.

Legal or safety disclosures use a separate reviewed process, scoped to a valid obligation or legitimate necessity and the minimum appropriate information. An authority request by itself does not confer account access. There is no ordinary police role, prompt-triggered override or automatic data release. We may notify affected parties where appropriate and legally permitted.

6.AI processing

Milo and AI-assisted form/import tools send the prompt, relevant uploaded content and authorized request context through Lovable’s AI gateway to the configured model provider. The current integration uses an OpenAI Responses model with the request option store:false. That option is not a promise of zero retention, no training or a particular location across every provider and subprocessor.

Conversation history and proposals may be retained in the app so users can continue their work and review actions. Tools remain role-, workspace-, permission- and module-scoped; education confidentiality applies. Users confirm supported actions, while other workflows remain guidance or drafts. Avoid uploading unnecessary sensitive information, credentials or information you are not entitled to process.

7.Providers and other disclosures

We use Lovable for application hosting, service infrastructure and the AI gateway; managed database, authentication and private-storage infrastructure; Stripe for subscriptions, connected payments and payment-method setup; configured transactional email infrastructure; and model providers for AI processing. If you choose external scheduling such as Cal.com, its own privacy terms apply. Providers process data as necessary for their services and under applicable arrangements; we do not infer universal retention or data-residency guarantees.

We do not currently sell personal information or use it for cross-context behavioral advertising. We may disclose information to service providers, authorized workspace users, valid legal/safety processes, or in a genuine business transfer subject to appropriate protections and notices. A link to an external site does not place that site under this policy.

8.Cookies and browser storage

Essential cookies and local/session storage support sign-in, active workspace choice, saved forms, invitation destinations, UI preferences and continued navigation. Request and error telemetry support reliability and security. No advertising pixels or nonessential third-party marketing-analytics integration is currently configured in the application source.

Blocking essential storage may interrupt sign-in or saved progress. Browser controls can clear storage, but this is not an account-deletion request. We do not add a consent banner for unconfigured advertising tools; if nonessential tracking is introduced, disclosures and any required choice must be updated before use.

9.Security

We use HTTPS in transit, provider-managed authentication, server-side permission checks, workspace and record-level access rules, private files with short-lived download links and audit history for sensitive workflows. Supported uploads receive type, signature and size validation; this is not antivirus scanning. Messages are not end-to-end encrypted.

No system is perfectly secure. We do not claim a SOC 2 certification, completed independent penetration test, fixed recovery guarantee or universal zero-retention policy. Security reports go to the Security contact, not a public file or credential dump.

10.Retention and closure

Records are retained while needed to provide the workspace and for legitimate security, payment, tax, dispute, consent, audit and service-integrity purposes. Application, prospect and support records may remain as needed for those purposes. Retention may differ across provider systems and legal obligations; no fixed automatic purge or instant deletion is promised.

An authorized user can request closure or deletion through Support or Privacy. We verify authority and assess deletion, anonymization or restricted retention as appropriate. Canceling billing, leaving a chapter or revoking sharing does not automatically remove ledger/audit history or copies already held by another authorized recipient.

11.Choices, requests and applicable rights

Use supported profile controls for corrections, notification preferences for optional notices, alumni settings for directory visibility, and Payments to pause or turn off new autopay attempts. Transactional account, security and payment notices may remain necessary. Chapter admins control permitted connections and datasets; students control the supported registration sharing choices.

Contact Privacy to request access, correction, a copy, deletion or other rights available under applicable law. We may ask for information reasonably needed to verify identity and authority. Where allowed, an authorized agent may make a request with evidence of authority. We route chapter- or institution-controlled requests to the responsible workspace when appropriate without preventing direct contact with us.

If a request is declined, you may ask Privacy to reconsider or appeal and provide relevant context. We explain the reason and any applicable escalation or regulator complaint options, and follow legally required response periods where the law applies. We do not impose a website-only deadline or promise a universal SLA. Exercising applicable rights is not a basis for unlawful discrimination.

Privacy-law coverage, exemptions, consent duties and rights—including Texas, other U.S. state laws and international rules—depend on the actual processing and applicable law. MVP status is not itself an exemption. Chapters and institutions must establish an appropriate lawful basis, minimize sensitive fields and obtain required consent; Greek Central does not certify blanket FERPA, GDPR or state-law compliance.

12.Policy changes

We update the date when this policy changes and provide appropriate notice of material changes. New uses requiring consent will require that consent rather than treating continued use as authorization where the law requires more.

13.Contact

General questions: hello@greek-central.com. Account support: support@greek-central.com. Billing: billing@greek-central.com. Privacy requests: privacy@greek-central.com. Security reports: security@greek-central.com.