GreekOS Privacy Policy

The short version

• GreekOS runs on a schema-per-tenant architecture – your organization's data lives in its own isolated database space, never mixed with another organization's.
• Your National or Chapter controls your data. For most of what's in the Service – rosters, dues records, event data, forms – your Organization is the controller and GreekOS is the processor, acting on your Organization's instructions. If you're a member with a question about your own data, your Chapter or National admin is usually the fastest path to an answer; we'll also help directly.
• GreekOS staff do not have standing access to your organization's individual member data, financial records, or communications beyond a limited onboarding window, unless your organization approves a specific, time-limited access request or we're compelled by law. Every access event is logged, and your organization can see that log.
• We don't sell your personal information.
• We use a small number of named subprocessors (payment processing, email, SMS, hosting, analytics) to run the Service – listed below.
• Money moves directly between payers and your Organization's own payment-processor account. GreekOS does not hold funds, and does not receive full card numbers.

The full policy follows.

1. Who this policy covers and who we are

This Privacy Policy explains how GreekOS LLC, a Wyoming limited liability company ("GreekOS," "we," "us"), collects, uses, discloses, and protects information in connection with the GreekOS platform (the "Service").

This policy applies to:

• National organizations and Chapters ("Organizations") that sign up for and administer the Service;
• Members – including officers, active members, pledges/new members, recruits, and alumni – whose data is entered into the Service by their Organization or who create their own accounts;
• Visitors to our marketing site.i — whose data is entered into the Service by their Organization or who create their own accounts;
• Visitors to our marketing site.

2. Controller vs. processor

This distinction matters, so it's up front.

What this means in practice: if you're a member and you want your profile corrected or deleted, the fastest path is usually your Chapter or National administrator, since they control your organization's roster. We will also honor direct requests from you as described in Section 9, and will coordinate with your Organization where necessary.

3. Information we collect

3.1 Information provided to or through the Service

• Account and identity data: name, email, phone number, password (hashed, never stored in plain text), profile photo.
• Membership and organizational data: chapter affiliation, role (e.g., sysadmin, national admin, chapter admin, member, pledge, alumni), pledge class, initiation/crossing/graduation dates, position history, membership status and status-change history.
• Academic data (where applicable): GPA, major, minor, and enrollment status, for organizations that use GPA-gated intake or academic reporting features. This category is only collected where your Organization has enabled and populated it.
• Contact and emergency-contact data: address, emergency contact name/phone/relationship.
• Financial and payment data: dues and fee records, payment status, wallet balances and transaction history, and – where you pay through the Service – data passed to and returned from our Payment Processor. We do not receive or store full card numbers; the Payment Processor handles that directly. We may receive limited data such as a payment status, a transaction ID, and the last four digits of a card for record-keeping.
• Communications and documents: messages sent through in-product features (if enabled by your Organization), form responses, uploaded files, rosters, and similar content.
• Recruitment/intake data: for organizations using recruitment tooling – recruit contact info, notes, tags, ratings, and vote records entered by chapter members.

3.2 Information collected automatically

• Log and device data: IP address, browser and device type, operating system, referring URLs, pages viewed, and timestamps.
• Usage data: feature usage tied to an account or an anonymized identifier, used to understand how the Service is used and to improve it.
• Cookies and local storage: used to maintain your session, remember preferences (e.g., theme), and, on our marketing site, to measure traffic. See Section 8.
• Security and audit logs: authentication events, administrative actions (e.g., status changes, role changes, staff access events), and payment activity, logged for security, fraud prevention, and audit purposes. This is written to an immutable audit log that your Organization's administrators can review.

3.3 What we deliberately don't collect

We don't knowingly collect data from anyone under 18. We don't build advertising profiles from your organization's member data, and we don't use your organization's roster, financial, or communications data to train any AI model.

4. Legal bases for processing (where applicable, e.g., GDPR)

5. How we use information

We use the information described above to:

• Provide, operate, and maintain the Service, including membership management, dues/payment processing, event management, reporting, and communications features;
• Route payments directly between payers and the receiving Organization's connected payment account, without GreekOS taking custody of funds;
• Maintain the schema-per-tenant isolation that keeps each Organization's data separate;
• Enforce role-based access so that Members, Chapter admins, and National admins see only the data appropriate to their role;
• Detect, investigate, and prevent fraud, unauthorized access, and abuse;
• Respond to support requests and communicate service updates;
• Comply with legal, tax, and regulatory obligations (including obligations that flow through to your Organization, such as Form 990-adjacent reporting);
• Improve the Service through aggregated or de-identified usage analysis.

6. GreekOS Staff Access to Your Organization's Data

Because we know this is a top concern for national organizations evaluating vendor access to sensitive membership data, we spell this out explicitly:

• Basic access (aggregate counts, org name, plan/billing status, error logs) is available to GreekOS staff at all times, for platform operation and support.
• Deep access (individual member records, financial data, messages, or PII-containing audit entries) is available to GreekOS staff only: (a) during a limited onboarding window after your Organization is provisioned, for setup and migration support; or (b) after your Organization's National admin explicitly approves a time-limited access request, specifying a reason and duration.
• Every instance of staff access to Tier 2 (deep) data is written to an audit log that your National admin can review, showing who accessed what, when, and under what approval.

This access-control model is a deliberate architectural choice, not a promise we make only in this policy – it's enforced in the product itself.

7. How we share information

We do not sell or rent your personal information. We share information only as follows:

• Within your Organization: authorized Chapter and National administrators can access member data as necessary to run their organization, per the role-based scoping described in Section 6 and our Terms of Service.
• Payment Processors: to process dues, fees, event payments, and disbursements. These processors act as independent controllers or processors under their own privacy policies for the payment data they handle directly.
• Service providers (subprocessors): vendors who help us run the Service, under contractual confidentiality and data-protection terms, including:
  • Neon (database hosting)
  • Cloudflare (file storage and content delivery – R2, email routing)
  • Vercel (application hosting, transitional – see note below)
  • Resend (transactional email)
  • Telnyx (SMS delivery, for organizations using SMS features)
  • Payment Processors as they are implemented

We are in the process of migrating parts of our infrastructure to self-hosted servers; this list will be updated as that migration completes.

• AI features (if and when introduced): any optional AI-assisted feature we introduce (for example, document parsing) will be disclosed at the point of use, will process only the data necessary for that feature, and will be subject to a no-training commitment from any AI subprocessor – meaning your data is not used to train the underlying models.
• Legal and safety: where required to comply with law, respond to lawful requests, or protect the rights, property, or safety of GreekOS, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

8. Cookies and tracking

• In the product: cookies for authentication, session management, and remembering preferences (e.g., theme). These are necessary for the Service to function.
• On our marketing site: we may use privacy-conscious analytics to measure traffic. We do not run third-party advertising trackers in the product itself.
• You can control cookies through your browser settings; disabling essential cookies may prevent you from logging in.

9. Your rights

Depending on your role and jurisdiction, you may have the right to: access the personal information we or your Organization hold about you, correct inaccurate information, request deletion, request an export of your data in a portable format, or object to or restrict certain processing.

• If you're a Member: because your Organization typically controls your roster data, we encourage starting with your Chapter or National administrator for corrections. We will also honor direct requests sent to support@usegreekos.com, and will coordinate with your Organization where the data is under their control.
• If you're a National or Chapter admin acting for your Organization: most of these actions are available directly in-product (member editing, export tools, disaffiliation workflows). For anything not self-service, email support@usegreekos.com.
• California residents: you have rights under the CCPA/CPRA to know what personal information we collect, request deletion, request correction, and opt out of "sale" or "sharing" of personal information. We do not sell personal information, so there is nothing to opt out of in that respect. Submit requests to support@usegreekos.com.
• EEA/UK residents: you may also lodge a complaint with your local data protection authority.

We will verify your identity before fulfilling a request and will respond within the timeframe required by applicable law (generally within 30–45 days).

10. Data retention

• Active accounts: we retain data for as long as your Organization's account is active and as needed to provide the Service.
• Disaffiliated or former members: when a member is disaffiliated, suspended, or otherwise removed, their historical record (status changes, dues history, event attendance, positions held) is preserved in your Organization's schema for institutional and compliance record-keeping, even though their access to the Service is revoked. Your Organization controls its own retention policy for this historical data, subject to any platform-wide minimums or maximums we establish.
• After account closure: we provide a reasonable export window before deleting an Organization's data from active systems, except where we are legally required to retain it (e.g., tax and financial records) or where data persists in backups or security logs until those roll over on their normal schedule.
• Audit and financial logs: retained as required for fraud prevention, security, and applicable financial/tax recordkeeping requirements (which may extend for several years).

11. Data security

We use encryption in transit and at rest, role-based and schema-level access controls, hashed credentials and tokens (never stored in plaintext), immutable audit logging for sensitive actions, and idempotency safeguards on financial operations to prevent duplicate transactions. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify affected Organizations and individuals without undue delay, consistent with applicable law.

12. Children's privacy

The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18. If we learn that we have collected information from someone under 18 without appropriate authorization, we will take steps to delete it. If you believe a minor has provided us with personal information, contact support@usegreekos.com.

13. SMS messaging

If your Organization uses SMS features and you opt in to receive text messages from GreekOS or your Organization through the Service:

• Opt-in occurs when you affirmatively provide a mobile number and consent, either yourself or via a chapter administrator adding you with your authorization.
• Message frequency depends on your Organization's usage (dues reminders, event alerts, urgent announcements).
• Message and data rates may apply.
• You can opt out at any time by replying STOP, or reply HELP for assistance.
• Your phone number and opt-in status are not sold or used for marketing by third parties; they are shared only with our SMS delivery subprocessor solely to deliver the message.

14. International data transfers

We are a U.S. company, and data is primarily processed in the United States. If we or our subprocessors process data outside your home country, we rely on appropriate safeguards (such as standard contractual clauses) where required by law.

15. Third-party links and integrations

The Service may link to or integrate with third-party services (payment processors, calendar exports, etc.). This policy does not apply to those third parties' own data practices; review their privacy policies directly.

16. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy here and update the "Last updated" date. For material changes – such as a new category of subprocessor or a new use of personal data – we will provide notice (by email or in-product) before the change takes effect.

17. Contact us

Questions about this Policy: support@usegreekos.com