01 Who this covers
This Privacy Policy applies to Nestrel, a campus platform for verified Caldwell University students, operated by [OPERATOR NAME] doing business as Amahle Digital Creatives ("we," "us," "our"). Nestrel is independent: it is not owned, operated, or endorsed by Caldwell University.
The standard we hold ourselves to
FERPA (the Family Educational Rights and Privacy Act) is the federal law that protects students' education records — things like grades, transcripts, and class schedules kept by a school. It doesn't legally apply to Nestrel: we aren't a school, and we don't receive any records from Caldwell University. What we hold is information people give us directly through Nestrel.
We've chosen to build our data handling to FERPA's standards anyway. You sign up with your university email, and Nestrel holds your messages and campus activity — information that deserves that level of care whatever the law technically requires. In practice, that means:
- We use your information only for the purposes we list (section 03), and nothing broader.
- We don't sell it, advertise with it, or pass it on beyond the people and services named in sections 05 and 06.
- We collect only what we need to verify you and run the platform (section 02).
- You can see, correct, and delete your information, with a set response time (section 09).
- We keep information for stated periods (section 08) and protect it with real safeguards (section 10).
If a university ever shares its own student records with us, we'll accept them only under a written agreement that gives the university control over how those records are used, kept, and destroyed — and we'll update this policy before that happens.
02 What we collect
| Category | Examples |
|---|---|
| Account & identity | Your @caldwell.edu email, first and last name, username, and display name — plus, if you add them, a profile photo, bio, pronouns, major, and class year. We also record when you accepted our Terms and which version you accepted. |
| Listings & content | Items and textbooks you post, photos you upload, prices, descriptions, and course details. |
| Messages | Messages you send and receive through the platform, and when they were read. |
| Clubs & organizations | Clubs you follow or join, your role in a club (for example, officer), posts you publish for a club, and your votes in club polls. |
| Events | Events you RSVP to, whether and when you checked in (and which officer checked you in), and any rating or comment you leave after an event. We also record the first time you open an event's page, so each person counts once in its view total. That record is erased 30 days after the event ends, leaving only the number. |
| Activity | Saved items, and actions on your listings (posting, marking sold, renewing). For each listing we also keep a running total of how many times it has been opened — a number, not a record of who opened it. |
| Safety & moderation | Reports you file or that are filed about you, appeals, and any suspension history. |
| NestBot inputs | Text you send to NestBot, our AI assistant. |
| Technical | Basic technical data your browser sends (e.g., device/browser type) and data our infrastructure providers process to keep the service running and secure. |
| Information others give us about you | When a club officer checks in a walk-in at an event, they may enter that person's name and email, even if the person has no Nestrel account. People who join our waitlist for another school give us their email, school name, and role. |
What we don't collect. We collect what we need to verify you and run Nestrel, and nothing more. We never ask for your student ID number, Social Security number, date of birth, grades, class schedule, or financial account information — and Nestrel does not handle payments. Please don't put any of these in listings, messages, or NestBot.
03 How we use it
- To verify you're a current Caldwell student and give you access.
- To operate core features: listings, marketplace, textbooks, free items, clubs and organizations, events, saved items, and messaging.
- To display your listings and public profile to other verified students.
- To power NestBot responses (see section 07).
- To let club officers run their events — RSVP lists, door check-in, and feedback summaries (see section 05).
- To show club officers how their club is doing, using totals only — how many students viewed, saved, RSVP'd to and attended each event, average ratings once at least five people have rated, and how many new followers the club gained. The record of who opened an event is used only to count each person once; officers never see it (see section 05).
- To keep the platform safe — moderating content, investigating abuse, and enforcing our Terms.
- To understand how the platform is used and improve it, using totals and counts (e.g., which categories are active) rather than tracking what individual students do.
- To contact you about your account, security, or important service changes.
- To meet legal obligations, such as responding to a valid court order (see section 05).
Only these purposes
These are the only things we use your information for. If we ever want to use it for something new, we'll update this policy and tell you in the app before the change takes effect (see section 13).
We do not:
- sell or rent your personal information;
- show you targeted advertising, or let advertisers use your information;
- share your information with data brokers or marketers;
- use your listings, messages, or activity to train AI models.
04 Why we're allowed to process your data
We process your information to provide a service you've signed up for, to meet our legitimate interest in running a safe and functional platform, to comply with legal obligations, and — where applicable — with your consent (which you can withdraw). If you're in a region with specific legal-basis requirements, this section describes the grounds we rely on.
05 Who we share it with
Here is who can see what.
- Other students: your public profile (name, username, display name, photo, and — if you add them — bio, pronouns, major, and class year), whether your account is currently suspended (never the reason), your listings, and posts you publish for a club. Messages are visible to the person you send them to. When you post a listing, the email on your account is stored with it and can be accessed by other signed-in students. Poll results are shown to students as totals.
- Club officers: officers who manage an event or run its check-in can see the name and email of everyone who RSVPs to that event, and whether they checked in. Officers who manage a club's membership can see its member list. Officers with analytics access can see how individual members voted in that club's polls. Officers can't see who follows a club. Officers with analytics access also see totals for their club's events and followers — views, saves, RSVPs, attendance and ratings — but never who viewed, saved or followed. Event ratings and comments are shared anonymously with the organizers: they see the comments and an average rating, never names, and the average stays hidden until at least five people have responded — though in a small event, what a comment says may still hint at who wrote it. Officers must use what they see only for their club's own activities (see our Terms, section 04).
- Nestrel administrators: the people who run Nestrel can access account information, listings, messages, reports, and activity records in order to verify students, review reports, investigate abuse, and keep the platform working. Administrators can currently open any conversation, not only reported ones. Admin access is limited to accounts we've given an admin role, and every data export is recorded in our activity log.
- Caldwell University: Nestrel is independent of the university, and we do not share information that identifies individual students with it. If we share anything with the university — for example, as part of a pilot with a university office — it will be totals, such as how many students attended an event, and never figures for a group of fewer than five people. If that ever changes for a particular event or program, we'll tell you there, before you sign up — not after.
- Service providers (subprocessors): companies that help us run Nestrel, listed in section 06.
- Legal & safety: we may disclose information if required by law (for example, a valid subpoena or court order), or where needed to protect the safety of our users or the public, or to protect Nestrel against fraud or abuse. We share only what the situation requires.
- Business transfer: if Nestrel is transferred to another entity (for example, once Amahle Digital Creatives is formally registered), your information may transfer with it under this policy.
No passing it on
Beyond the people and services listed above, we don't share your personal information with anyone. We do not sell your data or share it with advertisers. When we share totals or statistics instead of personal information, we remove names and anything else that could identify you, and we don't report on groups of fewer than five people.
A record of disclosures
If we ever disclose your personal information to someone outside the categories above — for example, in response to a legal request — we'll record who received it, what was shared, when, and why. You can ask to see that record for your account (section 09), unless the law prevents us from telling you.
06 Third-party services (subprocessors)
We rely on trusted third parties to operate Nestrel:
| Provider | What it does | Data involved |
|---|---|---|
| Supabase | Hosts our authentication, database, and file storage (including listing photos). | Account data, listings, messages, club and event records, uploaded photos, activity records. |
| Anthropic | Provides the AI model behind NestBot. | Text you send to NestBot when you use it. |
We use these providers only to run Nestrel, and we don't give them your information for any other purpose. How they handle data is also governed by their own privacy and security terms, and we encourage you to review Supabase's and Anthropic's privacy policies. We'll update this section before we start using a new provider that handles your personal information.
07 NestBot & AI
When you use NestBot, the text you send is transmitted to our AI provider (Anthropic) to generate a response. Please don't share sensitive personal information (such as government IDs, financial details, or health information) with NestBot. NestBot output is AI-generated and may be inaccurate — treat it as a helper, not an authority.
08 How long we keep it
We keep information only as long as we need it for the purposes in section 03. Here is how long that is:
| Information | How long we keep it |
|---|---|
| Your account & profile | While your account is open. If you ask us to delete your account, we complete the deletion within 30 days of confirming your request. |
| Listings | Listings you mark sold or withdrawn, or that expire, stop being visible to others but stay in our database so we can support your listing history, moderation, and totals. They're deleted along with your account. |
| Messages | While your account is open. A conversation is stored once for both people, so deleting your account also removes those conversations from the other person's inbox. |
| Club & event records | RSVPs, check-ins, feedback, poll votes, follows, and memberships are deleted along with your account, or when the club deletes the event. Someone checked in as a walk-in without an account can ask us to delete their entry. |
| Event views | The record that you opened an event is erased 30 days after the event ends; after that only its total view count is kept. It is also deleted along with your account. |
| Reports, appeals, suspensions & the admin activity log | Up to 2 years after your account is closed, so we can handle repeat abuse and answer questions about past moderation decisions. After that they're deleted, or the details that identify you are removed. |
| Waitlist sign-ups | Deleted when we launch at that school or decide not to — or sooner, if you ask. |
When we delete information, it is removed from our database, not just hidden. Deleted information may remain in our hosting provider's backups until those backups are replaced on the provider's regular schedule. If you graduate or leave Caldwell, your account stays open until you delete it; if we close an account we can no longer verify, we delete it on the same timeline.
09 Your rights & choices
These rights apply to every Nestrel user, wherever you live.
- See your information: ask for a copy of the personal information we hold about you. We'll send it within 45 days — the same window FERPA gives students — and usually much sooner.
- Correct it: you can edit most of your profile and listings yourself in the app. For anything you can't edit, ask us. If we decide not to make a change, we'll explain why in writing.
- Delete it: you can delete listings in the app. To delete your whole account, email us and we'll complete it within 30 days of confirming your request (section 08 explains what is kept, and for how long).
- See our disclosure record: ask whether we've disclosed your information to anyone outside the categories in section 05, and to whom.
- Raise a concern: if you disagree with how we use your information, tell us. We'll review it and reply in writing.
How to make a request. Email
amahledigitalcreatives@gmail.com
from your @caldwell.edu address, so we can confirm it's really you. If you no
longer have access to that address, tell us and we'll find another way to confirm who you
are. Requests are free, and using these rights won't affect your account.
10 Security
We protect your information with measures including:
- Encryption: data is encrypted in transit (HTTPS) and at rest by our hosting provider, Supabase.
- Access rules enforced by the database: each account can read only the records it's allowed to see, and those rules are enforced by the database itself — not just by the app's screens.
- Limited extra access: only accounts we've given an admin role get administrator access. Club officer permissions (managing events, checking people in, viewing analytics) are granted one at a time.
- Verified accounts: the database only accepts sign-ups from approved university email domains, and every email address must be confirmed.
- Logging: moderation decisions and data exports are recorded in an activity log.
No system is perfectly secure, and as a beta product Nestrel may have vulnerabilities. Please use a strong, unique password and let us know right away if you notice anything suspicious.
If there's a breach. If we learn that someone has gained unauthorized access to your personal information, we'll notify affected users without unreasonable delay — and at least as quickly as New Jersey law requires — and tell you what happened, what information was involved, and what we're doing about it.
11 Age requirement
Nestrel is intended only for users 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we've collected data from someone under 18, we'll delete it. If you believe a minor is using Nestrel, contact us.
12 International note
Nestrel is operated for a New Jersey university community, and our providers may process and store data in the United States and other countries. By using Nestrel, you understand your information may be processed in the U.S. and elsewhere, where data protection laws may differ from those in your home country.
13 Changes to this policy
We may update this policy as Nestrel develops. When we do, we'll change the "Last updated" date above.
If a change affects what we collect, how we use it, or who we share it with, we'll tell you in the app before it takes effect and say plainly what is changing — not just post a new version. We won't start using information we already hold for a purpose this policy didn't cover without telling you first. Continuing to use Nestrel after changes take effect means you accept the updated policy.
14 Contact
Questions or privacy requests? Email amahledigitalcreatives@gmail.com.