Privacy Policy

Effective date: [date of publication]. Last updated: [date].

Summary

Campus Voices runs paid student-creator programs for U.S. universities. We collect what we need to recruit creators, run each university's program, review and verify sponsored posts, pay creators, and keep the platform secure. We collect some public social media profile information about students who have not applied, so we can invite a small number of them to apply; they can opt out at any time and we will never contact them again. We share information with the university that runs a program (for that program only) and with a short list of service providers that host, email and schedule for us. We do not sell personal information, and we do not use or share it for targeted advertising. The site uses one cookie, to keep you signed in. There are no analytics or advertising cookies. You can ask to see, correct or delete your information at privacy@campusvoicesmedia.com, and we will answer within 30 days.

1. Who we are

1.1 This Privacy Policy explains how TTplus10 Inc., a Nevada corporation doing business as Campus Voices and Campus Voices Media ("Campus Voices", "we", "us"), handles personal information collected through www.campusvoicesmedia.com and the Campus Voices platform (together, the "Services").

1.2 Address: [registered address]. General contact: hello@campusvoicesmedia.com. Privacy contact: privacy@campusvoicesmedia.com.

1.3 Two roles. For most information in this policy, Campus Voices decides why and how it is used (we are the "controller" or "business"). When a participating university gives us information to run its own program, such as its guidelines, plans, staff contacts or any student information it chooses to share, we handle that information on the university's behalf and under our written agreement with the university (we act as its "service provider" or "processor"). Section 8 explains the difference.

1.4 This policy does not cover the social media platforms where creators post (TikTok, Instagram and others). Those platforms have their own privacy policies.

2. Who this policy covers

2.1 Visitors: anyone browsing our public website.

2.2 Applicants: students who apply to become creators.

2.3 Prospects: students who have not applied, whose public creator profiles we reviewed to decide whom to invite (Section 4).

2.4 Creators: enrolled students who have been accepted, signed the Creator Agreement and have an account.

2.5 University users: staff at a participating university who use the platform to plan, review and report on their program.

2.6 Pilot-call contacts: people who book a call with us through the website scheduler.

2.7 Featured people: people who appear in creator content and sign a Featured Person Release.

3. What we collect, by audience

3.1 Applicants

When you apply, we collect what you type into the form:

(a) identity and contact: first and last name, school email, personal email (required), phone number (optional). We use your school email only to check that you are enrolled. We contact you about your application and creator work at your personal email, never at your school address;

(b) school details: graduation year, major, and your confirmation that you are currently enrolled;

(c) eligibility answers: that you are 18 or older, that you can receive payment for independent work in the United States without Campus Voices sponsoring or providing work authorization, and that you already make original content. These are yes or no answers. We do not ask for your date of birth, citizenship, visa type or national origin;

(d) creator details: your TikTok username, Instagram username (optional), which accounts you would post from, the types of content you make, links to up to three example videos, your interests, why you are interested, your comfort with posting sponsored content, disclosure and a live window, and your expected rate range;

(e) how you heard about us;

(f) the acknowledgments you check (accuracy, no guarantee of acceptance, paid content, and permission to contact you about your application and creator opportunities), with the time you submitted;

(g) technical and acquisition data collected automatically with the form: your IP address, your browser's user agent string, the page that referred you (referrer), and any campaign tags in the link you used (a "source" or "ref" value and utm_source, utm_medium, utm_campaign, utm_content and utm_term).

We also record our decision on your application (accepted, waitlisted, declined or withdrawn), who made it, when, and any reason noted.

3.2 Prospects (students who have not applied)

To recruit creators, we review public TikTok profiles of people who appear to be students at a school where we run or plan a program. For each prospect we may store:

(a) public profile information: TikTok username, display name, profile link, and public bio;

(b) public activity measures: follower count, median views on recent posts, how often they post, an engagement rate, the number of posts that appear to be about the campus, content categories, and links to up to five example public posts;

(c) our own assessment: a fit score, an overall score, a priority label, and our confidence (with a short reason) that the person is a student at that school.

We collect this only from information the person has made public on the platform. We do not buy data, do not collect private messages or private accounts, and do not collect contact details that are not on the public profile. We use it only to decide whom to invite to apply and, if the person later applies, to show our reviewers the public work next to the application. See Section 11 for how to opt out.

3.3 Creators

When you join as a creator we collect and create:

(a) account data: name, email, a password (stored only as a salted one-way hash), your role, and when you last signed in;

(b) profile data: display name, TikTok and Instagram usernames, major, graduation year, a short bio, and phone number;

(c) onboarding data: whether your profile is complete; the result of enrollment verification (verified, pending or failed), the date, who verified it, the method used and the academic term verified; which version of the Creator Agreement you accepted, when, and the IP address it was accepted from; and whether your payout setup with our payment provider is not started, pending or ready;

(d) work records: briefs offered to you, whether you accepted or declined (and any reason you give), due dates, fees, and your own content ideas ("pitches");

(e) any enrollment evidence we ask for. We only ask for evidence if the school email check fails or is doubtful. If we do, we ask for a current-term enrollment letter or registrar screenshot showing only your name, school and term, and we ask you to hide your student ID number, grades and photo. We view it, record the result, and delete the file within 30 days. We never ask for student ID images, Social Security numbers, transcripts, grades, immigration documents, date of birth or financial aid information.

(f) status disclosures: if you tell us you are a student-athlete (so you can meet your NIL reporting duties) or that you are employed by the university, we record that you told us and when, so we do not offer you briefs that conflict with those duties.

3.4 Content

For each assignment we collect:

(a) draft videos you upload (with file type and size), captions, and any note you add;

(b) the confirmations you make when you submit: music is cleared, whether you intentionally feature anyone and, if so, that you have their permission, that no private information is shown, and that you understand the disclosure rules, with the time you confirmed;

(c) review records: the reviewer, whether they work for Campus Voices or the university, the decision, notes, and the result of each checklist item;

(d) published post records: the platform, the post link, when it went live, verification results and notes, required live-window dates, live checks, and any removal request, reason and removal date;

(e) performance numbers: views, likes, comments and shares as captured from the platform on a date, who entered them (you or our staff), and, where provided, a screenshot;

(f) rights records: which uses of the content are licensed (organic use, and paid use only where a separate addendum is signed), start and end dates, and the agreement version;

(g) Featured Person Releases: name, contact details and signature of people intentionally featured in content, and the content they relate to.

3.5 Payments

(a) In our own systems we keep a payment ledger for each approved post: amount, currency, status, when it became payable and when it was paid, the name of the payment provider, the provider's reference number, and notes.

(b) Your bank details, tax identification number and tax form (a W-9 if you are a U.S. person, or a W-8BEN if you are a nonresident alien for tax purposes) are collected and held by our payment provider [provider name] in its own onboarding flow, not in our database. Any tax withholding on W-8BEN payees is applied as the payment provider determines. We receive status information (for example, "ready to be paid") and the information we need to issue tax forms where the law requires, such as Form 1099-NEC. [Confirm with the chosen provider what tax data flows back to us.]

(c) If a university pays creators directly under its own process, the university collects payment information under its own policies.

3.6 University users and program data

(a) University staff accounts: name, work email, role (administrator or reviewer), invitation and acceptance dates, and account status.

(b) Program information the university gives us: approval mode, content guidelines and rules, priorities, key facts, off-limits topics, important dates and events, departments and programs, topic requests, and decisions on plan items and drafts. This is mostly institutional information, but it can include names of staff or others. We handle it for the university under Section 8.

3.7 Pilot-call bookings

When you book a call through our scheduler we collect: your name, email, university, role, notes you add, your answers to the short discovery questions (whether you have a creator program, roughly how many creators, what interests you), the time slot and time zone, how you found us (if the link carried a source), the IP address used to book, and whether you later cancelled. We send you a confirmation with a Zoom link and a calendar file.

3.8 Website visitors

If you only browse the public site, we do not ask for personal information and we do not run analytics, advertising pixels or third-party tracking scripts. Like any website, our hosting infrastructure receives your IP address and browser details to deliver the page, and may keep standard server logs for a short time (Section 3.9).

3.9 Technical data, cookies and logs

(a) One cookie. When you sign in we set a single cookie named cv_session. It holds a random token that keeps you signed in. It is marked HttpOnly and Secure, is sent only to our own site, and expires after 30 days or when you sign out. We store only a one-way hash of the token. We do not use analytics cookies, advertising cookies or any third-party cookies. Because this cookie is strictly necessary to provide the account you asked for, we do not show a cookie banner.

(b) Session records. For each sign-in session we keep the time created and last used, the expiry, whether it was revoked, and the IP address and browser user agent it started from.

(c) Sign-in links and invitations. We create single-use sign-in and invitation links that expire (sign-in links in 15 minutes) and store only a hash of each.

(d) Rate limiting. To stop abuse, we count attempts per IP address and per email address for sign-in, magic links, applications and bookings. These counters are kept in server memory for up to one hour and are not written to our database.

(e) Audit log. We keep a permanent record of important actions (for example, sign-ins, application decisions, approvals, verifications, removal requests and payment status changes), with who did it, when, the before and after state, a reason where given, and the IP address. The database blocks edits and deletions of this log so that history cannot be rewritten.

(f) Do Not Track and Global Privacy Control. We do not track you across other websites, so there is no cross-site tracking for these signals to turn off. We still treat a Global Privacy Control signal as a valid opt-out of any sale or sharing, of which there is none.

4. Where we get information

4.1 From you: forms, uploads, messages, and your use of the platform.

4.2 Automatically: IP address, user agent, referrer and campaign tags, session and audit records (Section 3.9).

4.3 From public sources: public TikTok profiles and posts (prospects), and your public posts (to verify them and record performance).

4.4 From the participating university: staff contacts, program information and, only if the university chooses and you have consented in writing, confirmation of your enrollment.

4.5 From our payment provider: payout readiness status and payment references.

4.6 From other people: a university reviewer's notes on your draft, or a creator who submits a Featured Person Release you signed.

5. Why we use information

5.1 To review applications and decide whom to accept, including checking eligibility (enrollment, age 18+, and ability to receive payment for independent work).

5.2 To find and invite prospective creators (Section 3.2) and to show reviewers a prospect's public work if that person applies.

5.3 To run each program: plan content with the university, offer briefs, review drafts against the brief and the university's rules, verify live posts, handle removal requests, and keep rights records.

5.4 To pay creators and meet tax reporting obligations.

5.5 To report program results to the participating university.

5.6 To communicate with you: sign-in links, invitations, notifications and reminders about your work, weekly digests to university staff, and booking confirmations.

5.7 To keep the Services secure: authenticate users, prevent fraud and abuse (for example fake enrollment or bought engagement), rate limit, investigate incidents, and keep an audit trail.

5.8 To understand which recruiting channels work (from the source and campaign tags on application links), in aggregate.

5.9 To comply with law, enforce our terms, and protect the rights and safety of creators, universities, Campus Voices and others.

5.10 With your separate permission only: to show Approved Content in Campus Voices sales materials and case studies (Section 13).

We do not use personal information to train artificial intelligence models, and we do not make decisions about you that are based solely on automated processing. People make every application, review and payment decision.

6. Lawful basis (where relevant)

6.1 Most U.S. law does not require a stated lawful basis, but we apply one to every use so the reason is clear. We do not target people outside the United States (Section 16).

7. Who we share with

7.1 The participating university, for its own program only. Staff at a university see the applicants to, creators in, content for, and results of that university's program. They never see other universities' programs. Depending on the program's approval mode, university reviewers may see and comment on drafts. The university also receives the content it licenses under the Creator Agreement and its agreement with us. In the Independent Test at Indiana University Bloomington, IU is not a customer and receives nothing from us.

7.2 Service providers that process information for us under contract, only to provide their service:

We will update this table before adding a provider that receives personal information.

7.3 Payment provider: see Section 3.5.

7.4 Social media platforms: we do not send personal information to TikTok or Instagram. Creators post from their own accounts under those platforms' terms.

7.5 Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or court order, or is needed to protect someone's safety, investigate fraud or security issues, or enforce our agreements.

7.6 Business transfer: if Campus Voices is involved in a merger, acquisition, financing, reorganization or sale of assets, information may transfer as part of that deal, subject to this policy or a notice to you.

7.7 With your direction or consent: for example, when you ask us to send something to another person.

8. When we act for a university

8.1 When a university gives us information to run its program, we use it only to provide the Services to that university, under our Master Services Agreement and its Data Processing and FERPA Addendum. We do not sell it, use it for our own marketing, or combine it with other universities' data.

8.2 We do not ask for or receive education records from a university by default. A university may choose to designate Campus Voices a "school official" with a legitimate educational interest under FERPA for a specific purpose, such as confirming enrollment of students who have consented in writing. If it does, we use those records only for that purpose and under the university's direct control.

8.3 If you are a student and want to exercise rights over information the university gave us, you may contact the university or us; we will work with the university to respond.

9. No sale, no targeted advertising

9.1 We do not sell personal information, and we have not sold it in the past 12 months.

9.2 We do not share personal information for cross-context behavioral advertising (targeted ads), and we have not done so in the past 12 months.

9.3 We do not allow third parties to collect information about your online activities over time and across websites through our Services.

10. How long we keep information

10.1 We keep information only as long as needed for the purposes above, then delete or anonymize it. Where a legal hold, dispute or an active content license requires it, we keep the minimum needed for as long as needed.

11. Prospects: notice and opt-out

11.1 If we found your public TikTok profile and you have not applied, we may hold the information in Section 3.2 for up to 12 months after we imported it.

11.2 We may contact you, through the platform's direct messages or a public contact method on your profile, at most twice. Every first contact will say who we are, that we found your public profile, and how to opt out.

11.3 To opt out, reply "stop" to our message, or email privacy@campusvoicesmedia.com with your handle. We will delete your prospect record promptly and add only your handle to a suppression list so we never import or contact you again. You do not need to create an account or give us any other information.

11.4 You can also ask what we hold about you (Section 14).

12. Marketing messages

12.1 We send account and program messages you need (sign-in links, brief notifications, reminders, payment notices). These are not marketing and continue while you have an account.

12.2 If we send promotional email (for example, news to universities that booked a call), each message will identify us, include our postal address and an unsubscribe link, and we will honor unsubscribes within 10 business days.

12.3 You can opt out of marketing at any time by using the unsubscribe link or emailing privacy@campusvoicesmedia.com.

13. Case studies and sales materials

13.1 We only show a creator's Approved Content in Campus Voices sales materials or case studies if both (a) the university has opted in to that use in its agreement with us, and (b) the creator has not opted out in their settings. This use is organic only, never paid ads.

13.2 Creators can opt out at any time in their settings or by emailing privacy@campusvoicesmedia.com. The opt-out stops new uses and we will remove the content from materials we control within [30] days. Universities can withdraw their opt-in on 30 days notice.

14. Your rights and how to use them

14.1 Wherever you live in the United States, you can ask us to:

(a) tell you what personal information we hold about you and give you a copy (access);

(b) correct inaccurate information (correction);

(c) delete your information (deletion), subject to Section 14.3;

(d) stop marketing messages (Section 12) and case-study use (Section 13);

(e) stop prospect research about you (Section 11).

14.2 How to ask. Email privacy@campusvoicesmedia.com. Tell us who you are and what you want. We will verify your request by matching it to information we already hold, usually by sending a code or link to the email address on file. An authorized agent may make a request for you with written permission you have signed; we may still ask you to confirm it directly.

14.3 Limits on deletion. We may keep information we are required to keep by law (for example, tax records), information needed to resolve a dispute or legal claim, the audit log for its retention period, signed agreements and releases, and records needed to honor licenses already granted in paid content. Deleting your information does not cancel a license you granted in Approved Content that was paid. Where we cannot delete, we will tell you why and restrict use to that purpose. Where a record must stay but does not need to identify you, we anonymize it.

14.4 Response time. We will confirm receipt within 10 business days and respond within 30 days. If we need more time, we will tell you why and respond within 45 days of receipt, or longer where a law that applies to you allows it.

14.5 Appeals. If we decline your request, you can appeal by replying to our decision with "appeal". We will respond within [45] days. If you are still not satisfied, you may contact your state attorney general.

14.6 No retaliation. We will not treat you differently for using these rights. Using them does not affect whether you are offered briefs.

14.7 University data. For information we hold on behalf of a university, we may refer your request to the university or handle it with the university's instruction (Section 8.3).

15. Text messages

15.1 The platform does not send text messages. Our staff may text a creator at the phone number the creator gave us, only about the creator's application or active work (for example, an urgent removal request). We do not send marketing texts.

15.2 You can reply "STOP" at any time and we will stop texting you, except where you have an urgent removal obligation, in which case we will use email and phone as the Creator Agreement describes. Message and data rates may apply.

15.3 We do not sell or share phone numbers or text-messaging consent with anyone.

16. Age

16.1 The Services are for adults. Creators and applicants must be 18 or older, and applications that say otherwise are refused. We do not knowingly collect personal information from children under 13, or from anyone under 18 as an applicant or creator.

16.2 Creators may not intentionally feature minors in program content, and reviewers reject content where a minor is a prominent subject. If we learn we hold information from or about a minor in breach of this policy, we delete it. Contact privacy@campusvoicesmedia.com.

17. United States only

17.1 The Services are offered only to U.S. universities and to students enrolled at them. We store and process information in the United States [verify Railway region for the production service and database]. If you use the Services from outside the United States, your information will be processed in the United States.

18. Security

18.1 We use administrative, technical and physical measures appropriate to the information we hold, including: encrypted connections (HTTPS with HSTS); passwords stored only as salted scrypt hashes; session and sign-in tokens stored only as hashes; short-lived, single-use sign-in links; access controls that separate every university's data and limit each role to what it needs; signed, expiring links for private files; rate limiting; and an audit log the database will not let anyone edit or delete.

18.2 No system is perfectly secure. If a breach affects your personal information, we will notify you and any regulators as the law requires, and notify affected universities as our agreements require.

19. Changes to this policy

19.1 We may update this policy. We will post the new version here with a new effective date. If a change is material, we will tell account holders by email or in the platform at least [30] days before it takes effect, and we will not use information collected under an earlier version in a materially different way without your consent where the law requires it.

20. Contact

TTplus10 Inc. (Campus Voices) [registered address] Privacy: privacy@campusvoicesmedia.com General: hello@campusvoicesmedia.com

Appendix A: Data inventory as built

For counsel review and for encoding retention jobs in the software. Model names and fields are taken from prisma/schema.prisma as of 2026-09-23. "Retention" is the target from the decisions sheet; "Enforced today?" says whether the software enforces it now. As of this draft no automated retention or deletion job exists; every row is currently kept until deleted by hand.

Not stored in the database today, but promised above: a prospect suppression list, prospect contact counts, creator marketing and case-study opt-out settings, Featured Person Releases, Paid Media Addenda, clean-file (Version B) delivery records, and enrollment evidence uploads. Each needs a model before launch of the matching feature, or the policy text must change.