Legal
Privacy Policy
Last Updated: January 20, 2026
At College, Inc. (d/b/a “The Yard,” “Company,” “we,” “us,” or “our”), we are committed to respecting your privacy and protecting it through our compliance with this Privacy Policy (“Policy”). This Policy describes how we collect, use, share, and process personal information in connection with our websites, applications, and related products and services (together, the “Services”), including our campus creator marketplace, campaign management tools, social media analytics, messaging, payment processing, and AI-powered advisory features.
By accessing, using, or interacting with our Services, you acknowledge that you have read and understood this Policy and agree to the practices described below. If you do not agree, we ask that you do not use our Services.
This Policy supplements, and does not replace, our Terms of Service and other agreements governing your use of The Yard’s Services.
1. Roles
The Yard serves three distinct user roles, each of which interacts with our Services differently. The information we collect and how we process it depends on your role.
User Types
Students
Individual creators—typically college students—who create profiles, connect their social media accounts (Instagram and TikTok), apply to brand campaigns, complete deliverables, and receive payouts through Stripe Connect. Students build a presence on the platform through their Yard Score, social media metrics, and campaign participation history.
Brands
Companies and businesses that subscribe to the platform, create and manage marketing campaigns, build and maintain a CRM of student creators, review applications, approve deliverables, send payments, and access analytics dashboards. Brands pay for the Services through Stripe-powered subscription plans.
Organizations
University organizations, clubs, and student groups that operate similarly to Students but represent a collective. Organizations maintain a group profile with member count, social reach, and contact information, and can apply to campaigns and collaborate with Brands on behalf of their members.
Platform Role
The Yard acts as a data controller when we determine how and why personal data is processed—for example, when managing user accounts, operating the platform, and providing analytics. When facilitating interactions between Students/Organizations and Brands (such as sharing creator profiles or campaign data), The Yard may also act as a service provider or data processor on behalf of Brands, consistent with applicable law.
2. Information We Collect
Information You Directly Provide
All Users
When you create an account on The Yard, we collect the following base information regardless of your role:
- Email address and login credentials (managed via our authentication provider, Clerk)
- Account role (Student, Brand, or Organization)
- First and last name
- Profile avatar image
Students
When you create or manage a Student account, we additionally collect:
- University name, major, minor, and graduation year
- Date of birth, phone number, and zip code
- Bio, personal interests, and collaboration preferences
- LinkedIn profile URL
- Education verification status
- Yard Score (a platform-generated metric reflecting your profile completeness and engagement)
- Stripe Connect account identifier (for receiving payouts)
- Campaign application materials, deliverable submissions, and proof uploads
Brands
When you create or manage a Brand account, we additionally collect:
- Company name, website URL, and industry
- Company size and your role/title within the company
- Company logo
- Partner preferences, desired campaign outcomes, and activation timeline
- Target campus regions
- Instagram and TikTok social media handles
- Stripe Customer ID (for subscription billing and creator payments)
- Campaign briefs, creative assets, and instructions
Organizations
When you create or manage an Organization account, we additionally collect:
- Organization name and affiliated university
- Contact information for organization representatives
- Organization bio and interests
- Member count and aggregate social media reach
Payments
We process payments through Stripe. The following payment-related information is collected and processed:
- Brand subscription details (Starter at $99/month, Growth at $299/month, or Enterprise at $999/month)
- Student payout information via Stripe Connect Express accounts
- Payment intents, invoices, and payment method references
- Webhook event data for payment status updates
We do not store complete payment card numbers. All sensitive payment information is handled directly by Stripe in accordance with PCI-DSS standards.
Information from Connected Social Media Accounts
When Students connect their Instagram or TikTok accounts through OAuth, we collect:
- OAuth access tokens and refresh tokens (stored encrypted using AES-256-GCM)
- Profile information (username, display name, profile picture, follower count)
- Media list (posts, reels, videos published by the account)
- Post-level analytics including views, likes, comments, saves, reach, impressions, and engagement rate
- Account-level insights and audience demographics
Instagram data is fetched via the Meta Graph API and TikTok data via the TikTok Open API. We run daily automated processes (cron jobs) to refresh access tokens and synchronize your latest social media metrics. Post-level analytics are tracked and linked to specific campaigns when applicable.
Information Automatically Collected
When you use our Services, we may automatically collect:
- Web performance and usage analytics via Vercel Analytics
- Authentication session data via Clerk session cookies
- Browser type, operating system, and device information
- Platform interaction data (pages viewed, features used, timestamps)
Information from Third-Party Sources
We may receive or generate information from:
- Meta/Instagram and TikTok (social media profile data and analytics as described above)
- Stripe (payment confirmation, payout status, subscription events)
- Campus intelligence databases (university demographics, enrollment figures, and general campus marketing data used to power our AI advisor and analytics)
- Tavily web search API (real-time web results provided to our AI campus advisor for contextual responses)
3. How We Use Information
We use information for the following purposes.
Providing the Services
- Creating and managing Student, Brand, and Organization accounts and profiles
- Facilitating campaign creation, applications, approvals, and deliverable tracking
- Enabling real-time messaging between users
- Processing Brand subscription payments and Student payouts through Stripe
- Connecting and synchronizing Instagram and TikTok social media accounts
- Generating social media analytics, Yard Scores, and campaign performance metrics
- Powering the Campus Advisor AI feature with contextual campus data and web search results
- Delivering notifications for application updates, payment events, and messages
- Sending transactional emails (welcome, application status, payment confirmations, new messages)
Platform Operations, Security, and Compliance
- Maintaining the integrity and security of our Services through Row Level Security, JWT-based authentication, and encrypted token storage
- Verifying webhook signatures from Stripe and other third-party services
- Preventing fraud, abuse, and unauthorized access
- Enforcing our terms and policies
- Complying with legal and regulatory obligations
Analytics, Insights, and Reporting
We analyze information to:
- Generate daily social media metric snapshots for Student profiles
- Provide Brand analytics dashboards with aggregate campaign performance data
- Track post-level analytics and link them to specific campaigns
- Enable shared analytics links (public, token-based, with configurable expiration)
- Support CSV data exports of creators, posts, and analytics for Brands
- Monitor web performance through Vercel Analytics
- Improve platform functionality and user experience
AI-Powered Features
Our Campus Advisor feature uses OpenAI GPT-4o to provide intelligent campus marketing guidance. When you use this feature:
- Your queries are processed alongside campus intelligence data and real-time web search results (via Tavily API)
- Responses are streamed in real time
- Conversation history is maintained during your session but is not stored long-term
Communications
- Sending welcome emails upon account creation via Resend
- Notifying Students when their applications are received, accepted, or rejected
- Alerting users to new messages in their conversations
- Confirming payment receipts and payout initiations
4. Aggregated and De-Identified Information
We may aggregate and de-identify information so that it no longer identifies an individual. This includes aggregating social media metrics across creators, generating campus-level analytics, and compiling campaign performance benchmarks.
This aggregated or de-identified information may be used to power Brand analytics dashboards, shared analytics links, CSV exports, campus intelligence profiles, and other reporting features. It may also be used internally to improve our Services.
Aggregated or de-identified information does not constitute personal data under applicable privacy laws, including the GDPR, where such data cannot reasonably be used to identify an individual.
We do not attempt to re-identify de-identified information except as permitted by law for security, fraud prevention, or compliance purposes.
5. How We Share Information
With Other Users
Student and Organization profile information—including social media metrics, Yard Score, university, and bio—may be visible to Brands through the creator database and campaign management tools. Messages sent through the platform are shared with conversation participants. Brands may share analytics data through shared analytics links, which are accessible via public token-based URLs with configurable expiration dates.
With Service Providers
We share information with the following third-party service providers that help us operate the platform:
- Clerk — Authentication and user session management
- Stripe — Payment processing for Brand subscriptions and Student payouts
- Meta (Instagram Graph API) — Social media account connection, profile data, and analytics retrieval
- TikTok (Open API) — Social media account connection, profile data, and analytics retrieval
- Resend — Transactional email delivery
- OpenAI — AI-powered Campus Advisor feature (GPT-4o)
- Tavily — Web search results for AI advisor context
- Vercel — Application hosting, serverless functions, scheduled cron jobs, and web analytics
These providers are contractually required to protect personal information and may not use it for their own independent purposes.
With Brands
Brands may access Student and Organization profile information, social media metrics, application materials, campaign deliverables, and post-level analytics as part of campaign management. Brands may also export creator data, post data, and analytics data via CSV downloads.
Analytics and Shared Links
Brands may generate shared analytics links that make certain aggregated campaign and creator analytics accessible to third parties via a public URL. These links are token-based and have configurable expiration dates. Data accessible through shared links is limited to aggregated performance metrics and does not include sensitive personal information such as email addresses, phone numbers, or payment details.
Legal and Business Transfers
We may disclose information to comply with law or legal process, to protect the rights, safety, or property of users or The Yard, or in connection with a merger, acquisition, financing, reorganization, or sale of assets.
6. Your Privacy Rights and Choices
Depending on where you are located, you may have the right to:
- Access, correct, or delete your personal data
- Obtain a copy of your data
- Disconnect your Instagram or TikTok accounts at any time, which will stop data synchronization and remove stored access tokens
- Delete your account, which will remove your profile data, messages, and associated records
- Opt out of marketing communications
- Withdraw consent when processing is based on consent
You may exercise these rights by contacting us at alicejacob@college.harvard.edu.
7. Cookies and Similar Technologies
We use the following cookies and similar technologies to operate our Services:
- Clerk Session Cookies — HTTP-only, secure cookies used to maintain your authenticated session across page loads. These are essential for the platform to function and cannot be disabled.
- Vercel Analytics — Privacy-focused web analytics that collect anonymized performance and usage data to help us understand how users interact with the platform.
We do not use third-party advertising cookies or cross-site tracking technologies. You can control cookies through your browser settings, but please note that disabling essential authentication cookies will prevent you from using the Services.
8. Data Retention
We retain personal data for as long as it is necessary to:
- Provide our Services and maintain your account
- Comply with legal, tax, and regulatory requirements
- Resolve disputes and enforce agreements
- Maintain historical analytics and campaign performance records
Specific retention practices include:
- Social media access tokens are retained as long as accounts remain connected and are deleted upon disconnection
- Social media metric snapshots are retained for historical analytics and trend reporting
- AI Campus Advisor conversations are not stored long-term and are discarded after your session
- Shared analytics links expire according to Brand-configured expiration dates
- Uploaded files (avatars, campaign media, proof submissions) are retained for the duration of your account
When your personal data is no longer required, it is deleted or de-identified in accordance with applicable law.
9. International Data Transfers
The Yard operates out of the United States. Our Services are hosted on Vercel, with database and file storage provided by our infrastructure and trusted service providers.
If you are accessing our Services from outside the United States, your information may be transferred to and processed in the U.S., or other jurisdictions where our service providers (including Clerk, Stripe, Meta, TikTok, OpenAI, Resend, Tavily, and Vercel) operate. By using our Services, you consent to the transfer of your information to these jurisdictions, which may have different data protection laws than your country of residence.
10. Security
We implement administrative, technical, and physical safeguards to protect your personal information. Our security measures include:
- AES-256-GCM encryption for all stored social media access tokens and refresh tokens
- Row Level Security (RLS) policies enforced on all database tables to ensure users can only access their own data
- JWT-based authentication for all API requests
- Signed URLs with expiration for private file access (such as proof uploads)
- Webhook signature verification for Stripe payment events
- HTTP-only, secure session cookies to prevent cross-site scripting attacks
- File upload validation with size limits (5MB for avatars, 50MB for campaign media, 100MB for proof uploads) and type restrictions
However, no security system is perfectly secure, and we cannot guarantee absolute security. We encourage you to protect your account credentials and promptly notify us of any suspected unauthorized access.
11. Children’s Privacy
Our Services are designed for college students, university organizations, and businesses, and are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at the address below.
12. Updates and Changes
We may update this Policy from time to time as our Services, privacy practices, and legal requirements evolve. If we make material revisions to this Policy, we will notify you by updating the “Last Updated” date at the top of this page and, where appropriate, by sending a notification through the platform or via email.
Continued use of our Services after any changes to this Policy constitutes your acceptance of the updated Policy.
13. Contact Information
If you have any questions or concerns regarding this Policy, our data practices, or your privacy rights, please contact us at alicejacob@college.harvard.edu.
© 2025 The Yard. All rights reserved.