Nexus™Loading the page
Nexa is setting the page.
Loading NexusLegal
Nexus handles student education records and financial data. This page says what this website stores, what the product collects, who else can reach it, how long it is kept, and how an institution gets it deleted. It is written to be read by the person who has to approve it, not by a search engine.
Every Not yet decided marker is a commitment that has not been finalized. We would rather show the gap than fill it with language we cannot stand behind in a procurement review. Nothing marked that way is in force, and none of it should be read as a promise. If one of these matters to your institution, raise it during diligence and it gets decided in the agreement before it gets decided here.
Grouped by where it comes from, because that is what determines who controls it.
Nexus does not ask for a Social Security number, a government identity document, or a driver’s license. If a tax or payment feature ever needs one, this section changes before that feature ships.
This website is public. Everything it stores about a person is private: it is written to a database only a Nexus server can read, and no page on this site reads a record from the browser.
Nexus uses what it collects to run the product an institution bought: to teach the curriculum and grade it, to issue and verify certificates, to track deals and the reporting deadlines attached to them, to work out the tax figures on an athlete's income, to answer questions in Nexa, to keep accounts secure, and to give an institution the compliance view it is entitled to.
Nexus provides financial education, not financial advice. Nothing in the product tells an athlete what to buy, sell or hold, and the data behind it is never used to steer one toward a financial product.
Whether Nexus sells or shares personal information as those words are defined in state privacy law, and how an opt out would work if it ever did: Not yet decided. Until that is decided, treat this section as incomplete rather than as a denial.
Most of what Nexus holds for an institution is an education record under the Family Educational Rights and Privacy Act. FERPA does not have a vendor exception. It has a school official provision, and that is the one Nexus operates under.
Under 34 CFR 99.31(a)(1)(i)(B), an institution may disclose education records without consent to a contractor it has designated as a school official with a legitimate educational interest, provided that contractor performs a service the institution would otherwise perform itself, is under the direct control of the institution with respect to the use and maintenance of those records, and does not redisclose them without authorization. Nexus is built to sit inside all three conditions:
Two consequences follow, and both matter more than they look. First, the records remain the institution’s. Nexus is a custodian, not an owner, and an athlete’s FERPA rights of access, amendment and complaint run against the institution, which Nexus supports rather than replaces. Second, the institution is responsible for designating Nexus in its annual FERPA notification and for defining what legitimate educational interest means in its own policy. Nexus cannot do that part for you.
Not everything in a Nexus account is an education record. A bank connection an athlete makes for their own use, and a personal deal an athlete records outside their institution’s program, come from the athlete rather than from the institution. How those are separated in an institution’s administrator view, and what an administrator can and cannot see of them: Not yet decided. This is the single most important open item on this page and it is being decided with counsel, not by engineering.
Nexa answers questions about NIL money, taxes and reporting. To answer well it sends the question, plus the curriculum passages relevant to it, to a model run by Anthropic. What Nexus sends with the question, and specifically whether account or deal information can be included in that context: Not yet decided.
Whether prompts and answers may be used to improve any model, ours or a vendor’s: Not yet decided. Nothing here should be read as a commitment either way until that line is written. If model training on student data is a blocker for your institution, say so in diligence and it becomes a term of the agreement.
Nexa does not make decisions about an athlete. It does not score them, rank them, flag them to a coach, or produce an output that affects their eligibility or their standing. A deal check explains what a clause says and what it means. A person decides what to do about it.
These are the services Nexus runs on. Nothing we do not actually run on appears here, and nothing we do run on is left out. The same list is shown inside the product, on the account’s privacy screen, and the in-product list is the authoritative one because it changes at the moment the stack changes rather than at the moment someone remembers to edit a web page.
| Sub-processor | What it does | What it can reach |
|---|---|---|
| Supabase | The database, the file storage and the sign-in behind this website and the product. | Waitlist rows, bookings, login sessions, account records, coursework and certification records, deal records, and uploaded documents. |
| Netlify | Hosts this website and serves its pages. | Request logs: the address a request came from, the page asked for, and when. |
| Anthropic | The Claude model Nexa answers with. | The text of a question and the context sent with it: on this website, only the public knowledge file. What Anthropic may do with that text under our agreement: Not yet decided. |
| Google Analytics | Page analytics for this website, with consent and with ads turned off. | Which pages were viewed, on what class of device, and the events named in the taxonomy. Never a name, email address or phone number. |
| Twilio | Sends the text messages you opted into and verifies a phone number. | The phone number you gave and the text of the messages sent to it. |
| Plaid | The connection an athlete may choose to make to a bank or a card account. | Account and transaction information from a connection the athlete makes. Bank credentials are entered at the bank, through Plaid, and are never seen or stored by Nexus. |
For each of these, the signed data processing terms, the storage region, and what the sub-processor may itself retain: Not yet decided. How much notice an institution gets before a new sub-processor is added, and whether an institution can object to one: Not yet decided.
There are four ways information leaves Nexus.
In an acquisition or a merger, records would transfer with the business and would remain subject to the institution’s agreement. The notice an institution receives before that happens, and its right to exit and require deletion instead: Not yet decided.
All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.
While an institution’s agreement is active, its records are kept so the product works. After it ends, the clock starts. The specific periods below are the ones an institution should press on in diligence, because they are what deletion actually means in practice.
An institution can require deletion of the records it provided, at any time, without ending its agreement. The procedure is deliberately short.
Where the request goes: an administrator can raise it from the records screen inside the Nexus administrator surface, which is the path that carries proof of who asked. Failing that, in writing to the contact below.
Deletion of an institution’s records does not delete the parts of an account that came from the athlete rather than from the institution. Which parts those are is the open FERPA question above, and it is answered in the agreement before any deletion is run.
An athlete can see everything in their own account, correct what is wrong, and export it. Where the request has to go depends on where the record came from, and that distinction is not a technicality.
Traffic is encrypted in transit and records are encrypted at rest at the storage layer. Access inside Nexus is limited to the people whose work needs it. Support access to an institution’s records is logged.
The parts an institution’s security review will ask about, each of which is a real commitment rather than a description and therefore is not being written here first: independent audit or attestation, such as SOC 2, and its date: Not yet decided. Penetration testing cadence: Not yet decided. Whether multi-factor authentication is required for administrators: Not yet decided. Sub-processor storage regions: Not yet decided.
Accessibility belongs in this conversation too, because procurement treats it the same way. Nexus targets WCAG 2.1 AA across every surface. Current conformance documentation, including a VPAT: Not yet decided.
If Nexus confirms an incident that exposed an institution’s records, the institution’s named security contact is told when the incident is confirmed, not when the investigation is finished. The first notice will be incomplete on purpose. It says what is known, what is not yet known, what has been contained, and when the next update comes.
The stated maximum time from confirmation to first notice: Not yet decided. Who notifies affected athletes, the institution or Nexus, and within what period under the applicable state breach notification law: Not yet decided. Whether Nexus commits to a written post-incident report: Not yet decided.
An institution should name its security contact when the agreement is signed and keep it current. A notification that reaches a dormant inbox is not a notification.
Nexus is built for college athletes and their athletic departments. It is not directed to children under 13 and Nexus does not knowingly collect information from them. If we learn that we have, the record is deleted.
Some incoming athletes are 17. An athlete under 18 uses Nexus under their institution’s agreement, and under FERPA their rights are exercised by a parent until they reach 18 or enroll in a postsecondary institution, whichever comes first. Whether Nexus requires separate parental consent for a minor athlete, and for which features: Not yet decided.
When this policy changes in a way that affects how information is handled, Nexus updates the date at the top of this page and shows the change inside the product before it takes effect. How much notice an institution gets, and whether it can object: Not yet decided. Whether previous versions stay published for comparison: Not yet decided.
The sub-processor list is the part most likely to move, which is why the authoritative copy of it lives inside the product rather than on this page.
Privacy questions, records requests, and breach contact details: Not yet decided. Mailing address for a formal notice: Not yet decided.
An institution’s administrator should use the records screen inside the Nexus administrator surface for an export or a deletion, because that path already proves who is asking.
Financial education, not financial advice. Nexus explains how NIL money, taxes and reporting work. It never tells you what to buy, sell or hold.