Privacy Policy

1.1 Personal Information You Provide

When you create an account or use Fratnance, we may collect:

• Account information: your full name, email address, phone number, and password (stored as a bcrypt hash).
• Profile information: profile photo, graduation year, major, chapter role, and membership status.
• Financial information: dues records, payment history, invoice details, expense reports, and fund balances. Credit card and bank account details are collected and stored exclusively by Stripe and never touch our servers.
• Academic information: GPA, enrollment status, and academic standing, when provided by you or your chapter administrator.
• Address information: mailing address and housing assignment data.
• Communication data: messages, support inquiries, and notification preferences.

1.2 Information Collected Automatically

When you access our platform, we automatically collect:

• Device and browser data: IP address, browser type, operating system, and device identifiers.
• Usage data: pages visited, features used, time spent on pages, click patterns, and referring URLs.
• Log data: server logs including timestamps, request IDs, and error information for debugging and security monitoring.

1.3 Information from Third Parties

• Google OAuth: if you sign in with Google, we receive your name, email address, and profile picture from Google.
• Stripe: we receive payment confirmation events, transaction statuses, and payout information from Stripe. We do not receive or store your full card number.

We use the information we collect to:

• Provide and operate the service: process payments, generate invoices, manage member records, and deliver financial reports to chapter administrators.
• Communicate with you: send transactional emails (invoices, payment confirmations, reminders), platform notifications, and important service updates via Resend.
• Ensure security: detect and prevent fraud, unauthorized access, and abuse through audit logging and rate limiting.
• Improve the platform: analyze usage patterns to enhance features, fix bugs, and optimize performance.
• Comply with legal obligations: respond to legal requests, enforce our terms, and maintain required financial records.
• Support chapter compliance: assist chapters with tax reporting (such as 501(c)(7) compliance), insurance tracking, and organizational audits.

We rely on trusted third-party providers to deliver our service. Each provider has its own privacy policy governing how they handle your data:

• Stripe (payments): processes all payment transactions and stores payment credentials. Stripe is PCI DSS Level 1 certified. See Stripe's Privacy Policy.
• Resend (email delivery): sends transactional emails on our behalf, including invoices, reminders, and account notifications. See Resend's Privacy Policy.
• Google (OAuth authentication): provides single-sign-on functionality. See Google's Privacy Policy.
• Supabase (database hosting): hosts our PostgreSQL database with encryption at rest. See Supabase's Privacy Policy.
• Vercel (application hosting): hosts and serves the Fratnance web application. See Vercel's Privacy Policy.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

We retain your data according to the following guidelines:

• Active accounts: your data is retained for as long as your account remains active and your chapter maintains an active subscription.
• Deleted accounts: when you request account deletion, we remove your personal information within 30 days. Certain financial records may be retained for up to 7 years to comply with tax and legal obligations.
• Alumni records: chapters may retain alumni contact information for organizational purposes. Alumni can request removal at any time.
• Audit logs: security and audit logs are retained for 2 years, then automatically purged.
• Backups: encrypted backups may retain data for up to 90 days after deletion from the live database.

Fratnance uses cookies and similar technologies for:

• Essential cookies: session management, authentication tokens, and CSRF protection. These are required for the platform to function.
• Preference cookies: theme selection (light/dark mode) and other user preferences.

We do not use third-party advertising cookies or cross-site tracking pixels. We do not participate in ad networks or sell browsing data.

You have the following rights regarding your personal information:

• Access: request a copy of the personal data we hold about you.
• Correction: update or correct inaccurate information through your account settings or by contacting us.
• Deletion: request that we delete your account and associated personal data, subject to legal retention requirements.
• Export: download your data in a portable format (CSV or JSON) through the platform's export features.
• Restriction: request that we limit how we process your data in certain circumstances.
• Objection: object to processing of your data for specific purposes.

To exercise any of these rights, contact us at privacy@fratnance.life. We will respond within 30 days.

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted via TLS 1.2 or higher.
• Database records are encrypted at rest using AES-256 encryption.
• Passwords are hashed using bcrypt with appropriate cost factors.
• Access to production systems is restricted and protected by role-based access controls.

For more details, visit our Security page.

Fratnance is intended for use by college students and chapter administrators who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will promptly delete their account and associated data. If you believe a minor has provided us with personal information, please contact us at privacy@fratnance.life.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: you may request details about the categories and specific pieces of personal information we have collected about you.
• Right to delete: you may request deletion of your personal information, subject to certain exceptions.
• Right to opt out of sale: we do not sell your personal information. No opt-out is necessary.
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.

Other State Laws

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights. We honor all applicable state privacy laws. Contact us to exercise your rights regardless of your state of residence.

Fratnance is hosted in the United States and primarily serves U.S. based Greek organizations. If you access the platform from outside the United States, please be aware that your data will be transferred to, stored, and processed in the United States. By using Fratnance, you consent to this transfer.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a prominent notice on the platform. The "Last updated" date at the top of this page reflects when the policy was most recently revised. Continued use of Fratnance after changes are posted constitutes your acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@fratnance.life
• General inquiries: support@fratnance.life

We aim to respond to all inquiries within 30 days.