MikeroManage Privacy Policy

Effective date: June 30, 2026 Last updated: July 31, 2026

This Privacy Policy explains how MikeroManage Software LLC ("MikeroManage," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use the MikeroManage mobile application, websites, administrative dashboards, and related services (collectively, the "Services").

This Policy provides notice of our privacy practices and should be read with the applicable Terms of Service and any additional notice presented when information is collected.

1. Scope and Our Role

MikeroManage provides organization and chapter-management tools. In many cases, an organization purchases or administers the Services and decides which members may use them, what information is entered, which features are enabled, and how organization records are managed. For that organization-controlled information, the organization may act as the business, controller, or responsible entity, and MikeroManage may process information on its behalf as a service provider or processor.

For information that MikeroManage uses for its own purposes—such as account security, service administration, billing, fraud prevention, product operations, and direct support—MikeroManage acts as the business or controller where those terms apply.

If your request concerns information controlled by your organization, we may direct the request to that organization or work with it to respond.

This Policy does not cover third-party websites, applications, or services that have their own privacy policies.

2. Information We Collect

The information collected depends on your role, your organization's configuration, the features you use, and the permissions you grant.

MikeroManage is not a medical, fitness, health-record, or treatment service. The app does not intentionally connect to HealthKit, wearable health sensors, electronic medical records, insurance claims, or similar health-data sources. User-entered text, photos, attachments, and reports are not analyzed to diagnose, treat, or measure a health condition.

A. Account, identity, and organization information

We may collect:

• name, display name, username, user ID, email address, telephone number, profile image, and avatar;
• organization or chapter name and identifier;
• account role, leadership position, permissions, feature access, active or inactive status, and administrative settings;
• graduation year, biography, current work, location description, chapter positions, connection preferences, and other alumni-profile information;
• invitations, account-approval status, conversion requests, and organization membership history; and
• information submitted in organization-interest, signup, support, account-unlock, and other forms.

B. Authentication, security, and technical information

We may collect or generate:

• authentication credentials and records used to verify identity, maintain authorized sessions, provide multifactor authentication, and recover or unlock accounts;
• login timestamps, unsuccessful-access events, account restrictions, abuse-prevention events, access-control decisions, and security or audit records;
• IP address, device and browser characteristics, request timestamps, general service activity, and diagnostic information;
• mobile notification identifiers, app version, operating-system context, and notification preferences; and
• local device identifiers and locally stored session, preference, cache, draft, and feature-state information.

Payment-card credentials are handled by our payment processor rather than stored directly by MikeroManage.

C. Study, attendance, and integrity information

We may collect:

• study-session start, stop, periodic status, duration, attendance state, and adjustment records;
• weekly requirements, totals, leaderboards, compliance status, intervention reminders, and reports;
• disconnect information, stop reasons, attendance-verification results, and administrator notes; and
• approved Wi-Fi network identifiers, Wi-Fi exemptions, and related attendance-verification settings.

D. Location and designated-driver information

With device permission or when entered by a user or administrator, we may process precise or approximate location information, including:

• latitude, longitude, radius, place name, address, and geofence information for study zones and events;
• current device location used to display local weather or support location-enabled features;
• designated-driver ride pickup and destination information, requester and driver coordinates, route-related status, estimated arrival information, ride notes, timestamps, and ride history; and
• location-verification results used for attendance or safety workflows.

The Services may continue receiving ride or session updates while a relevant feature is active. Device permissions can be managed in iOS Settings. Disabling location may prevent some features from working.

E. Communications, social, and user-generated content

We may collect:

• message-group names, memberships, permissions, messages, replies, reactions, read status, message images, and message reports;
• blocked-user relationships and reports concerning content or conduct;
• tasks, projects, assignments, comments, attachments, due dates, status, and submission history;
• event details, attendee or participant information, chapter announcements, dress-code settings, and party-list entries, check-off status, notes, and optional birthdays;
• votes, polls, elections, choices, responses, governance permissions, and related timestamps;
• recruitment records, recruit contact and profile information, ratings, notes, events, statuses, and administrative decisions;
• gallery or memory-vault images, captions, sections, upload metadata, and deletion information;
• receipt images, scanned documents, and other PaperTrail attachments, including any text or metadata included in those files;
• sober-monitor assignments, check-in requests, ride-home requests, event-safety reports, descriptions, event-area hints, resolution information, and related timestamps; and
• alumni connection requests, acceptance status, directory information, and communications.

Do not upload information about another person unless you are authorized to do so. Avoid placing highly sensitive information in free-text fields unless necessary for the feature.

F. Billing and transaction information

We may collect:

• billing contact and organization information;
• customer, subscription, checkout, payment-method, invoice, trial, plan, quantity, cancellation, and payment-status metadata received from our payment provider; and
• transaction and webhook records needed to administer subscriptions, prevent fraud, reconcile payments, and meet legal obligations.

G. Usage, analytics, and diagnostics

We may collect feature interactions, dashboard activity, click events, aggregate usage statistics, app-launch records, performance information, and limited diagnostic logs. We use this information to operate, secure, troubleshoot, and improve the Services. We do not use third-party advertising pixels or cross-site behavioral-advertising trackers in the Services.

H. Information from others

We may receive information from your organization, its administrators, other members, payment and email providers, identity or security systems, Apple services, and other service providers. Organization administrators may create accounts, assign roles, upload records, submit notes, adjust hours, manage content, and take other actions that affect your information.

I. Commission Affiliate Program information

If you apply for, are invited to, or participate in the MikeroManage Commission Affiliate Program, we may collect and use additional information about you and your activities. This may include:

• application and recruiting information, including first and last name, email address, telephone number, chapter or organization connection, application status, invitation and setup records, and review notes;
• affiliate account information, including login and authentication records, account status, dashboard permissions, agreement version, typed acknowledgment name, acceptance date and time, IP address, user-agent information, and audit records;
• secure tax-onboarding metadata, including whether a Form W-9 was submitted, the W-9 provider and submission or recipient identifiers, taxpayer-name or business-name information made available to us by the provider, W-9 status, TIN-matching status, verification messages, and related timestamps;
• lead and opportunity information, including state, school, chapter, organization, contact name, contact email, contact telephone number, notes, source, assignment or claim status, progress stage, expiration, communications, and evidence submitted for review;
• commission and payout information, including transaction and attribution records, commission requests, approved amounts, status notes, payout provider references, payment status, reversals, disputes, and records needed for tax reporting; and
• affiliate-workspace communications, including mailbox address, message headers, message content, attachments, delivery records, moderation or abuse-prevention events, and notifications.

The secure W-9 form is collected and stored by the third-party tax-form provider presented during onboarding. Through the embedded onboarding flow, MikeroManage does not receive or store your full SSN, ITIN, or EIN; we receive the verification status and limited identifiers needed to match the submission to your affiliate account, administer approval, and pay or report commissions. The provider's own privacy policy also applies to its collection and processing.

3. How We Use Information

We may use personal information to:

• provide, maintain, personalize, and support the Services;
• create accounts, authenticate users, manage sessions, provide two-factor authentication, and recover or unlock accounts;
• administer organizations, members, alumni, recruitment, events, voting, messages, tasks, study programs, party lists, galleries, safety tools, and designated-driver features;
• calculate study hours, attendance, progress, compliance, reports, and organization analytics;
• provide location-enabled functionality, route coordination, local weather, geofencing, and attendance verification;
• send transactional, security, billing, administrative, reminder, message, event, safety, and push notifications;
• process subscriptions, invoices, payment status, trials, cancellations, and account quantities;
• review affiliate applications, create and secure affiliate accounts, record agreement acknowledgments, administer W-9 and TIN verification, determine active affiliate status, and manage dashboard access;
• register, assign, monitor, review, expire, withdraw, suspend, or reassign affiliate leads and opportunities; communicate with organizations and their contacts; calculate and review commissions; process payouts; and maintain attribution, tax, audit, and dispute records;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, prohibited conduct, service misuse, and violations of applicable terms;
• moderate content, respond to reports, protect users, and enforce rights and policies;
• debug, monitor, analyze, develop, and improve the Services;
• respond to support, privacy, legal, and regulatory requests;
• establish, exercise, or defend legal claims; and
• comply with law and protect the rights, safety, and property of MikeroManage, users, organizations, and others.

Where applicable law requires a legal basis, we rely on performance of a contract, consent, compliance with legal obligations, protection of vital interests, and our or others' legitimate interests, including service operation, security, support, improvement, and fraud prevention. You may withdraw consent where processing relies on consent, but withdrawal does not affect prior lawful processing.

4. How We Disclose Information

We may disclose personal information as follows:

A. Your organization and authorized users

Organization owners, administrators, leaders, sober monitors, designated drivers, group members, and other authorized users may access information according to their role, feature permissions, group membership, and organization settings. For example, administrators may access member profiles, study records, reports, safety information, recruitment records, events, party lists, tasks, billing status, and audit information. Message participants may see messages, reactions, names, images, and read status. Ride participants and authorized safety personnel may see ride and location information needed to coordinate a ride.

B. Service providers

We use service providers to host and operate the Services, store information and uploaded files, deliver communications, process payments, provide maps and weather information, support infrastructure, prevent abuse, and assist with security and diagnostics. Provider categories may include:

• cloud hosting, database, storage, content-delivery, and infrastructure providers;
• payment, checkout, subscription, invoice, and billing-portal providers;
• transactional email and mobile-notification delivery providers;
• operating-system, mapping, geocoding, route, and device-platform providers;
• weather-information providers;
• tax-form, identity-verification, TIN-matching, payout, and affiliate-program administration providers; and
• security, caching, abuse-prevention, support, and diagnostic providers.

These providers receive information reasonably necessary for their functions and are subject to contractual or legal obligations, as applicable. When you interact directly with a third-party service, its own privacy terms may also apply. Provider relationships may change as the Services evolve.

C. Legal, safety, and business purposes

We may disclose information if we believe disclosure is reasonably necessary to comply with law, legal process, or governmental requests; enforce agreements; investigate fraud or security issues; respond to an emergency; protect rights, property, or safety; or establish, exercise, or defend legal claims.

We may transfer information in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law.

D. At your direction or with consent

We may disclose information when you direct us to do so, use a sharing feature, connect with another user, submit information to your organization, or otherwise consent.

E. Affiliate Program participants and counterparties

For the Commission Affiliate Program, authorized MikeroManage personnel and company administrators may access application, account, onboarding, opportunity, commission, communication, and review records for recruiting, approval, support, compliance, attribution, payout, and dispute handling. When an affiliate submits an organization or chapter contact, the relevant contact and opportunity information may be used to communicate with that organization, its chapter, or authorized representatives and may be visible to personnel responsible for the account or transaction. Affiliates must have authority to provide contact information and must not submit unnecessary or unlawfully obtained personal information.

5. Sale, Sharing, and Advertising

MikeroManage does not sell personal information for money. Based on the Services reviewed as of the effective date, we also do not share personal information for cross-context behavioral advertising or use it for targeted advertising. We do not knowingly sell or share the personal information of consumers under 16 for those purposes.

If these practices change, we will update this Policy and provide legally required choices before using information in the new manner.

6. Sensitive Information

Depending on feature use, the Services may process information considered sensitive under certain laws, including account credentials, precise geolocation, private communications, Wi-Fi identifiers, safety reports, and information that may reveal organizational or social relationships.

MikeroManage is not designed to collect health information, medical records, diagnoses, treatment information, or health measurements. Sober Monitor and designated-driver features are event-safety and transportation-coordination tools. Do not submit medical details or use the Services as a substitute for emergency services. In an emergency, contact 911 or the appropriate local emergency service.

7. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining business and security records, resolving disputes, enforcing agreements, and complying with legal, accounting, tax, and regulatory obligations.

Retention varies by record and context:

• active account and organization records generally remain while the account or organization uses the Services;
• content such as messages, tasks, uploads, votes, recruitment records, party lists, study records, and alumni information generally remains until deleted through available tools, removed by an authorized administrator, or no longer needed;
• some events are configured for automated deletion after the event ends and an additional operational grace period;
• authentication challenges, rate-limit records, and password-reset records may expire after short security periods, although related security or audit records may be retained longer;
• designated-driver, safety, billing, audit, and transaction records may be retained as reasonably necessary for safety, fraud prevention, dispute handling, contractual obligations, or legal compliance;
• affiliate applications, agreement acknowledgments, account-status records, lead and opportunity records, commission reviews, payout records, and related communications may be retained for the duration of the relationship and afterward as reasonably necessary for contract administration, tax, accounting, fraud prevention, disputes, and legal claims;
• W-9 and TIN-verification records are retained by the tax-form provider under its policies; MikeroManage retains only the submission metadata, verification results, and identifiers reasonably needed to administer the Program and comply with tax or legal obligations;
• local caches and preferences remain on a device until removed by app functionality, logout, account deletion where supported, app deletion, or operating-system controls; and
• backups and disaster-recovery copies may persist for a limited period after deletion and will be isolated from ordinary use until overwritten or securely deleted under applicable procedures.

Deletion may not remove deidentified or aggregated information, information another user independently provided, or information we must retain by law or for security, fraud prevention, dispute resolution, or legal claims. We apply data-minimization principles and periodically review retention needs, but no storage system is instantaneous or infallible.

8. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information. These include access controls, authentication safeguards, encryption where appropriate, monitoring, abuse-prevention controls, logging, secure development practices, provider oversight, and procedures for handling suspected incidents. Safeguards are selected according to the sensitivity of the information, the nature of the processing, and reasonably foreseeable risks.

No security measure is perfect. We cannot guarantee that information will never be accessed, disclosed, altered, lost, or destroyed. You are responsible for protecting your credentials, using a secure device and network, and promptly reporting suspected unauthorized access.

9. Your Choices and Rights

Depending on where you live and subject to legal exceptions, you may have the right to:

• know or access personal information we process about you;
• request correction of inaccurate information;
• request deletion of personal information;
• obtain a portable copy of certain information;
• object to or restrict certain processing;
• withdraw consent;
• opt out of sale, targeted advertising, or certain profiling (although we do not currently engage in sale or targeted advertising as described above);
• limit certain uses of sensitive personal information where applicable; and
• appeal a refusal to act on a privacy request.

You may update some information through the Services or through your organization administrator. The iOS app includes an account-deletion function. You may also submit a request to support@mikeromanage.net. Please state that your request concerns privacy and identify your organization.

We may need to verify your identity and authority before fulfilling a request. Verification may require matching information associated with your account or completing an authentication challenge. Authorized agents may submit requests where permitted by law; we may require proof of authorization and identity verification. We will not unlawfully discriminate against you for exercising privacy rights.

If your organization controls the relevant information, submit the request to the organization first. We may forward or refer requests to it. To appeal a decision, reply to our response with “Privacy Appeal” in the subject line and explain your concern.

You may control location, notifications, photos, and similar device permissions through iOS Settings. Browser storage can be cleared through browser controls. Transactional or security communications may continue even if optional notifications are disabled.

10. California Privacy Notice

California residents may have rights under the California Consumer Privacy Act, as amended (CCPA). The categories of personal information we may have collected during the preceding 12 months are described in Section 2 and may include identifiers; customer records; commercial information; internet or other electronic-network activity; geolocation data; audio, electronic, visual, or similar information; professional or employment-related information; education-related information supplied for organization features; sensitive personal information; and inferences drawn to provide status, compliance, safety, or administrative features.

We collect these categories from users, organizations and administrators, devices and browsers, service providers, and feature interactions. We use and disclose them for the business and commercial purposes described in Sections 3 and 4. The recipient categories are organizations and authorized users, service providers, legal or safety recipients, transaction parties, and persons you direct us to contact or share with.

We do not sell personal information or share it for cross-context behavioral advertising. We retain each category according to Section 7. California residents may request access, correction, deletion, and information about collection, use, and disclosure, subject to exceptions, and may use an authorized agent as described in Section 9.

California's “Shine the Light” law may permit residents with an established business relationship to request information about certain disclosures for direct-marketing purposes. We do not disclose personal information to third parties for their own direct marketing as contemplated by that law.

11. Other U.S. State Privacy Rights

Residents of states with comprehensive privacy laws may have additional rights, including rights to confirm processing, access, correct, delete, obtain a copy, opt out of targeted advertising, sale, or certain profiling, and appeal a decision. We will honor applicable rights based on your state of residence and our legal obligations.

The Services are not designed to collect consumer health data. A user should not submit medical details, medical records, diagnoses, treatment information, or health measurements through a safety report, message, ride request, or other feature. If a user voluntarily includes such information in free text, an image, or a communication, we treat it as incidental sensitive content and use it only to provide, secure, investigate, or respond to the requested event-safety or ride-coordination feature. We do not sell it or use it for advertising.

12. Children and Students

The Services are designed for organizations, college and university communities, alumni, and authorized administrators—not for children or minors. You must be at least 18 years old to use the Services.

We do not knowingly collect personal information online from children under 13. If we learn that we collected such information without legally sufficient authorization, we will take reasonable steps to delete it. A parent or guardian who believes a child under 13 provided personal information should contact support@mikeromanage.net.

The Services are not intended to create a direct school-official relationship under the Family Educational Rights and Privacy Act (FERPA). If an educational institution uses the Services with education records, that institution is responsible for determining and documenting the lawful basis and required protections for that use.

13. International Use and Transfers

MikeroManage is based in the United States. Information may be processed and stored in the United States and other countries where we or our service providers operate. Those countries may have privacy laws different from the laws where you live. Where required, we use legally recognized safeguards for international transfers.

14. Third-Party Links and Services

The Services may link to or interact with third-party services, including payment portals, maps, email, weather, and device settings. Their privacy practices are governed by their own policies. We are not responsible for third-party privacy or security practices.

15. Changes to This Policy

We may update this Policy to reflect changes in the Services, law, or our practices. We will post the revised Policy and update the effective or “last updated” date. If changes are material, we may provide additional notice through the Services, email, or another appropriate method. Continued use after the effective date of an updated Policy constitutes acknowledgment of the revised Policy where permitted by law.

16. Contact Us

For privacy questions, requests, or complaints, contact:

MikeroManage Software LLC 8735 Dunwoody Place, Suite R Atlanta, Georgia 30350 United States Email: support@mikeromanage.net Website: https://mikeromanage.net

Please include “Privacy Request” in the subject line and identify the organization associated with your account. Do not send passwords, full payment-card numbers, or unnecessary sensitive information by email.

If you are not satisfied with our response, you may have the right to appeal as described above or complain to your state attorney general or another competent privacy regulator.

17. Detailed Data-Practices Chart

The following chart provides additional detail about our practices. A category may apply only when you or your organization uses the relevant feature. “Disclosed” does not mean sold; it includes operational disclosure to an organization, authorized user, or contracted provider.

18. Feature-Specific Notices

A. Study tracking and verification

Study tracking is designed to record time spent in an authorized session. During an active session, the Services may receive periodic status updates containing elapsed time and verification context. Session records may include a start time, end time, duration, approved-location or Wi-Fi result, connection status, and stop reason. Administrators may adjust records, set requirements, review timelines, receive reports, and mark exemptions.

The Services may flag a session or generate a disconnect report when expected session, network, or location status stops. Such a flag is an operational indicator and may not prove misconduct. Organizations are responsible for applying their policies fairly and providing an appropriate process for users to contest errors.

B. Location permissions

The iOS application requests location access for specific features. Location permission is controlled by the operating system. The Services do not need location permission for every function, but study verification, local weather, geofences, event location, designated-driver mapping, or nearby status may be degraded or unavailable without it.

When the app sends coordinates to a weather provider, those coordinates are used to return weather information. Mapping and geocoding providers may receive map queries, coordinates, or addresses under their own terms. MikeroManage does not use precise location for advertising.

C. Designated-driver and safety services

The designated-driver feature is a coordination tool for organization members and is not a commercial transportation network, emergency dispatch service, ambulance service, or guarantee of transportation. Ride records may associate identities with pickup/destination coordinates and movement status. Authorized drivers, requesters, organization personnel, and safety-role users may receive status or location details needed for coordination.

Safety reports and sober-monitor alerts may contain sensitive descriptions. Users should submit only the event-safety or ride-coordination information reasonably needed for the request and should not submit medical details. An organization may determine which of its personnel receive those reports. MikeroManage may preserve a record when reasonably necessary to investigate misuse, protect a person, address a dispute, or comply with law.

D. Messaging and content moderation

Communications are processed by authorized systems so they can be delivered, synchronized, moderated when reported, and made available to permitted participants. Users should not use messaging to transmit passwords, payment-card credentials, government identification numbers, or information unnecessary for the conversation.

Users may report content or block another user. We or the organization may review reported content and related context to investigate a report, enforce rules, or protect users. Deleting a message may remove it from ordinary product views but may not immediately remove copies in backups, reports, quoted replies, notifications, exports, legal holds, or another recipient's records.

E. Uploads, images, and attachments

Uploaded files may contain metadata or information not visible in the main product interface. Before uploading, users should remove unnecessary embedded location, identity, or device metadata. Users are responsible for having authority to upload and share the content. Access controls reduce exposure but cannot prevent an authorized recipient from saving, copying, or redistributing content.

We may reject, transform, compress, scan, restrict, or delete uploads for security, storage, moderation, legal, or technical reasons. Access may be provided through time-limited or access-controlled delivery methods.

F. Recruitment

Recruitment tools allow authorized users to maintain information about prospective members. Organizations are responsible for providing appropriate notice to recruits, limiting entries to relevant and lawful information, configuring access, and deleting records when no longer needed. Users must not enter discriminatory, defamatory, or unlawfully obtained information. MikeroManage does not determine membership decisions.

G. Voting and governance

Voting tools may display whether a person is eligible, has participated, or selected an option, depending on the configured vote and implementation. Organizations must not describe a vote as anonymous unless their configuration and applicable records actually support that representation. Security and audit data may be maintained to protect election integrity.

H. Alumni Network

Alumni profiles may be visible to members of the same organization or other audiences permitted by feature configuration. Users should avoid including home addresses, personal schedules, or other information they do not want authorized viewers to see. Connection requests reveal an interest in connecting and may be visible to the recipient and administrators.

I. Reports and exports

Administrators may generate, download, email, or otherwise distribute reports and exports containing personal information. Once an authorized recipient downloads or forwards an export outside the Services, that copy is controlled by the recipient or organization. Organizations must protect exported files, limit recipients, and securely delete copies when no longer needed.

J. Local storage and offline information

The website and mobile application use device or browser storage for authorized-session state, settings, drafts, caches, and limited feature information. Other people with access to an unlocked device or browser profile may be able to view locally available information. Logging out, clearing browser storage, deleting the app, or using device controls may remove some local data, but those actions do not necessarily delete server records.

The app may cache organization-specific party-list names, list membership, and optional birthday fields on the device. When enabled, Face ID or Touch ID is evaluated by Apple's operating system; MikeroManage does not receive or store biometric templates or images. During an active designated-driver ride, iOS Live Activities may display the driver's first name or initials, ride status, status message, and estimated arrival information on the Lock Screen or Dynamic Island.

K. Commission Affiliate Program

The Commission Affiliate Program is a separate business workflow for approved independent contractors. Application information is used to review and contact applicants. An accepted applicant must complete the electronic Contractor and Program Agreement and the secure W-9 onboarding before the Company can approve active affiliate status or dashboard access. Agreement records may include the typed name, version, date, acceptance method, IP address, browser information, and related audit data.

Affiliate tools allow an approved affiliate to register chapter leads, request or receive written approval for National Opportunities, record organization contacts and progress, communicate through an affiliate workspace, and submit a completed lead for commission review. Company personnel may review those records, verify attribution and transaction status, suspend or reassign an opportunity, approve or deny a commission request, and send status notifications. A lead contact may receive communications from the affiliate or Company as directed by the Program.

The secure W-9 is handled through the third-party tax-form provider shown in onboarding. MikeroManage receives completion and verification results and limited provider identifiers, not the full tax identification number through the embedded flow. Affiliate dashboard access remains restricted while tax verification or Company approval is pending. Commission and payout records may be retained for tax, accounting, contractual, fraud-prevention, dispute, and legal purposes.

19. Organization Customer and Administrator Responsibilities

Organizations and their authorized administrators play a significant role in determining how personal information is handled. Each organization is responsible for:

• having a lawful basis and giving any required notice before adding, importing, or directing MikeroManage to process personal information;
• ensuring that invitations and accounts are provided only to authorized people;
• configuring roles, feature access, message groups, safety roles, report recipients, and administrator permissions according to least-privilege principles;
• maintaining accurate organization and member information;
• responding to member questions and privacy requests when the organization controls the information;
• establishing lawful retention schedules and deleting information that is no longer needed;
• obtaining any consent required for precise location, student information, photos, recruitment records, safety data, or information about non-users;
• protecting reports and data exported from the Services;
• promptly removing access for former or unauthorized users;
• reviewing flagged sessions, safety reports, recruitment information, and voting records fairly and lawfully;
• complying with employment, education, anti-discrimination, wiretap, biometric, consumer-health, and other laws that may apply to its use; and
• notifying MikeroManage promptly of suspected unauthorized access or misuse.

Administrators may have the technical ability to view or change information. That ability does not itself grant legal authority to do so. Misuse may violate organization policy, our Terms, or law.

20. Privacy Request Procedures

A. Submitting a request

A request should include:

1. the requester's name and contact information;
2. the organization associated with the account;
3. the specific right being exercised;
4. enough information to locate the relevant account or records; and
5. if submitted by an agent, documentation showing authority to act.

Do not send a password, session credential, full payment-card number, driver's-license copy, or other excessive information unless we specifically request an appropriate verification item through a suitable channel.

B. Verification

We match information in the request to information associated with the account and may require login confirmation, a one-time code, confirmation through an existing email address, organization verification, or a signed declaration. The verification level may depend on the sensitivity of the request. We may deny a request if we cannot reasonably verify identity or authority.

C. Timing and response

We aim to acknowledge and respond within the period required by applicable law. We may extend the response period when legally permitted, in which case we will provide notice. If we cannot fulfill all or part of a request, we will explain the basis when required.

D. Exceptions

Rights are not absolute. We may retain or decline to change information when reasonably necessary and legally permitted to:

• complete a transaction or provide a requested service;
• maintain security, detect incidents, prevent fraud, or repair errors;
• protect free-expression rights or the rights and safety of others;
• comply with law, legal process, tax, accounting, audit, or recordkeeping obligations;
• establish, exercise, or defend legal claims;
• conduct permitted internal uses reasonably aligned with user expectations;
• preserve evidence relating to misuse, safety, disputes, or organization governance; or
• maintain deidentified or aggregated information.

E. Organization-controlled records

If the organization is the controller or business for the requested records, we may send the request to an authorized organization representative. MikeroManage may be unable to alter an organization-controlled record without its instruction unless law requires otherwise.

F. Appeals

Where applicable, a requester may appeal by replying within a reasonable time and stating “Privacy Appeal.” The appeal should identify the original request, the disputed outcome, and any supporting facts. A person not involved in the original decision will review the appeal where practicable. We will provide information about further regulatory complaints when required.

21. U.S. State Supplemental Disclosures

This section supplements the general Policy. It applies only to the extent a state privacy law covers MikeroManage and the relevant processing. Exemptions may apply based on the nature of the information, the organization relationship, or statutory thresholds.

A. Categories collected and disclosed

During the preceding twelve months, we may have collected and disclosed for operational business purposes each category identified in Sections 2 and 17. We do not disclose every category for every user. Disclosure depends on feature use and organization configuration.

B. Purposes

Our business purposes include performing services, maintaining accounts, processing payments, providing customer service, maintaining and improving quality, analytics, security, debugging, fraud prevention, internal research, legal compliance, and protecting users.

C. Sale and targeted advertising

We do not sell personal information for monetary or other valuable consideration as those concepts are commonly defined under U.S. comprehensive privacy laws, and we do not process personal information for targeted advertising based on activity across nonaffiliated services. Therefore, we do not currently provide a “Do Not Sell or Share” link. If our practices change, we will implement required notices and controls.

D. Profiling

The Services calculate operational statuses such as study progress, compliance categories, eligibility, access permissions, and ride queue information. MikeroManage does not use automated processing to make decisions that produce legal or similarly significant effects concerning employment, lending, housing, insurance, criminal justice, or access to essential goods or services. Organization personnel remain responsible for their own decisions.

E. Sensitive-data consent

Where state law requires consent before processing sensitive data, we rely on affirmative feature use, device permission, organization instruction supported by an appropriate legal basis, or another legally recognized authorization. A user may withdraw device permission through operating-system controls. Withdrawal may make the feature unavailable and does not require deletion where an exception applies.

F. Universal opt-out mechanisms

Because we do not sell personal information or use it for targeted advertising, recognized browser-based opt-out preference signals do not alter those practices. We will reassess this position if our practices change. We do not respond to legacy “Do Not Track” signals, for which there is no uniform industry standard, as a request to disable functions necessary to provide and secure the Services.

22. Safety and Incidental Sensitive Content

MikeroManage is an organization-management product, not a healthcare app. Sober Monitor, designated-driver, and safety-report features are designed to coordinate event safety and rides. They do not collect or analyze medical records, diagnoses, treatment information, health measurements, or health profiles.

Users should not submit medical details. If a user voluntarily includes sensitive information in a report, photo, message, or ride request, it is incidental content. We use it only as reasonably necessary to provide the requested safety or ride-coordination feature, maintain security, investigate misuse or incidents, respond to legal requirements, or protect a person.

Access is limited according to event and organization permissions. Potential recipients include assigned sober monitors, designated drivers, administrators, the requester, relevant infrastructure and notification providers, and emergency or legal recipients when reasonably necessary. We do not sell or use this incidental content for advertising. Privacy requests may be submitted through Section 20, subject to organization control and applicable safety, legal, security, and retention exceptions.

23. Information About Non-Users

Users and organizations may provide information about people who do not have MikeroManage accounts, including recruits, party-list guests, emergency or ride contacts, report subjects, alumni prospects, report recipients, and organization contacts.

The person or organization entering that information represents that it has authority and an appropriate lawful basis to do so. MikeroManage uses non-user information to provide the requested feature, communicate as directed, maintain security, and comply with law. A non-user may contact us to request information or deletion; we may need to consult the organization that supplied the record and verify identity before acting.

24. Deidentification and Aggregation

We may create aggregated or deidentified information by removing or modifying information reasonably capable of identifying a person. We may use and disclose such information for service analytics, capacity planning, security, research, reporting, and improvement where permitted by law.

When we maintain information as deidentified under a law that regulates deidentified data, we will take reasonable measures designed to prevent reidentification, publicly commit to maintain and use it in deidentified form, and contractually require recipients not to attempt reidentification where required. This section does not prevent us from re-linking information when needed to test whether deidentification controls work, protect security, or fulfill a verified request where permitted.

25. Security Incident Response

We maintain procedures designed to identify, assess, contain, investigate, and remediate suspected security incidents. Depending on the circumstances, we may restrict access, protect relevant records, coordinate with providers and organizations, require protective account measures, and notify affected persons or regulators.

Notification timing and content depend on applicable law, the nature of the information, risk of harm, law-enforcement needs, and available facts. Nothing in this Policy is a promise that every event will qualify as a legally reportable breach or that notice will be provided when law does not require it.

Users should immediately report suspected compromise to support@mikeromanage.net, log out of affected sessions when possible, change compromised credentials, and follow any instructions we provide.

26. Data Governance and Access

Access to production personal information is intended to be limited to personnel and providers with a business need. Access may be used for support, incident response, service maintenance, fraud prevention, legal compliance, and other purposes described in this Policy. Administrative actions may be logged.

We seek to apply data minimization, purpose limitation, least privilege, separation of environments, secure credential handling, dependency maintenance, and change-review practices appropriate to the nature of the Services. Specific safeguards may change as technology, threats, and operations evolve. Descriptions of safeguards are not warranties and should not be interpreted to disclose confidential security architecture.

27. Business Transfers, Insolvency, and Service Closure

If ownership or control of all or part of MikeroManage changes, information may be reviewed or transferred as a business asset subject to confidentiality and applicable law. We will provide legally required notice of material changes in controller identity or use.

If a Service or organization account closes, we may provide a limited period for an authorized administrator to export information, after which ordinary records may be deleted or deidentified according to operational procedures. Billing, security, backup, dispute, and legal records may remain longer. We are not responsible for copies previously exported by an organization or user.

28. Email and Push Communications

We may send:

• authentication, two-factor, password-reset, and account-unlock messages;
• invitations, administrative notices, and account-status communications;
• study reminders, weekly reports, and intervention messages configured by an organization;
• message, event, task, safety, and designated-driver notifications;
• billing, invoice, trial, cancellation, and payment-status communications;
• affiliate application, W-9 and TIN-verification, account-approval, opportunity, commission, payout, and affiliate-workspace communications; and
• support, privacy, security, and legal notices.

Some communications are essential to an account or requested feature and are not promotional. Notification controls may suppress optional mobile alerts but cannot prevent an authorized organization user from contacting a person through another channel. Email delivery providers receive addressing and message-delivery information needed to transmit and monitor the communication.

29. Payment Information

Our payment processor hosts or processes checkout, payment-method setup, invoices, subscription management, and billing-portal functionality. MikeroManage generally receives transaction references, card brand and last digits where provided, subscription state, invoice status, and related metadata—not full card numbers or card security codes.

For the Commission Affiliate Program, MikeroManage may maintain commission amounts, payout status, payout-provider identifiers, payment references, and tax-reporting records. A payout provider may independently collect identity, payment, fraud, and transaction information under its own privacy policy. MikeroManage does not need full payment-card credentials to administer an affiliate payout.

The payment processor may independently collect device, fraud, identity, and transaction information under its privacy policy. A user's direct interaction with that provider is also governed by its terms. Refunds, disputes, and payment-method rights may depend on the organization's agreement, provider rules, card-network rules, and applicable law.

30. Legal Process and Preservation

We evaluate governmental and civil requests for information and may require valid legal process. We may notify the affected organization or user unless prohibited by law, emergency circumstances, safety concerns, or the integrity of an investigation.

We may preserve information in response to a valid preservation request, reasonably anticipated litigation, a safety incident, suspected fraud, or an investigation. A preservation hold may temporarily override ordinary deletion practices. We disclose only information we reasonably believe is required or appropriate under the circumstances.

31. Nature of the Services

MikeroManage provides organizational software and does not provide legal, medical, mental-health, transportation, or emergency-response services. Submitting information through the Services does not create an attorney-client, doctor-patient, therapist-patient, fiduciary, or other professional-services relationship with MikeroManage. Separate confidentiality obligations may apply between an organization and its members.

Accessibility

MikeroManage is designed to support accessible use with VoiceOver, Dynamic Type, increased text size, Zoom, keyboard navigation where available, increased contrast, reduced motion, clear focus order, semantic controls, skip links, and navigation announcements. Accessibility depends on the device, operating system, browser, assistive technology, organization configuration, user-generated content, and third-party services.

We do not represent that every screen, document, uploaded file, user-generated item, or third-party component will always conform to every accessibility standard. Report a barrier to support@mikeromanage.net with the screen or feature, device and operating-system version, assistive technology, and task you could not complete. We will review the report, provide a reasonable accessible alternative where practicable, and track remediation.

32. Interpretation

In this Policy:

• “including” means including without limitation;
• “personal information” includes “personal data” and similar terms under applicable law;
• “process” includes collecting, using, storing, transmitting, disclosing, deleting, and otherwise handling information;
• “organization” includes a chapter, association, customer, or other entity that administers an account;
• “authorized user” means a person granted access through an organization or feature; and
• references to a law include amendments and implementing regulations.

If a translated version conflicts with the English version, the English version controls to the extent permitted by law. Headings are for convenience and do not limit the Policy. If a provision is unenforceable, the remaining provisions continue to apply. This Policy does not waive rights or obligations that cannot lawfully be waived.