Privacy policy

WebFrootz LLC operates College Crusader, including this website and client portal. This policy explains how we handle information through our website, services and business communications. Contact us at [email protected] with privacy questions or requests.

We collect information you provide, including your name, email address, college or organization, inquiry details and communications with us. Inquiries are stored in our administration system and may be included in email notifications to our team.

For portal accounts, we maintain your name, email address, verification status, account identifiers, college membership, invitations, product access and saved resources. When you choose Google or Microsoft sign-in, we receive basic identity information supplied by that provider. We do not receive your provider password or request access to your mailbox, calendar, contacts or cloud documents. Passwords created directly with College Crusader are stored as password hashes.

We and our service providers may collect IP addresses, browser and device information, referring pages, cookie identifiers, website activity and information needed for security, authentication and service operation. Please do not submit student records, financial account details or other sensitive personal information through the public inquiry form.

When you choose to connect Google Ads, we request Google Ads permission separately from Google sign-in. We receive information about the Ads accounts you can access so you can select an account for your college workspace. For that account and the date range you choose, we read account identifiers and settings, campaign and ad-group information, search terms, impressions, clicks, cost and conversion metrics. We use this information to produce Brand Isolation audits, findings, negative-keyword suggestions and saved or exported reports.

Google provides a combined permission that can read and manage Ads data. Paid Search X-Ray uses account-list and reporting calls only; it does not create, edit or delete ads, campaigns, bids, budgets or keywords. Suggestions are not applied automatically. We do not request access to student or enrollment records through this connection.

Connection credentials are encrypted on our servers. Imported data, audit settings and reports are stored in the college workspace and restricted by account permissions. Authorized college members and assigned College Crusader staff can access information needed to use the tool or provide the requested service. Staff-prepared report commentary stays in draft until shared with the college.

You can disconnect Google Ads in the workspace. This removes the stored connection credentials and stops new imports; saved audit reports are retained under the retention policy below. You can also revoke College Crusader's access in your Google Account settings. Contact [email protected] to request deletion of saved reports or other Google data; backup and legal-retention limitations described below apply.

Connecting a social account is optional. Colleges can use the calendar, edit drafts and upload images directly without a Facebook, Instagram or MediaValet connection. MediaValet is an optional asset source where a college enables it.

When an authorized person connects Facebook or Instagram, Meta provides the profile, business, Page and professional-account information needed to identify and authorize the selected connection. This can include names, account identifiers, profile images, granted permissions and authorization tokens. We do not receive Facebook or Instagram passwords.

We use these connections to deliver image posts that authorized college users or assigned staff choose to schedule or publish. We store drafts, captions, images and image descriptions, planned dates and times, the college's time zone, and a saved copy of each submitted post. We also store delivery status, destination identifiers, published links, errors and the operational records needed to resolve delivery issues. The publishing service runs on our infrastructure and separates each college's account connections; college users work within College Crusader. Portal connection credentials are encrypted on our servers. Authorized staff and infrastructure providers may process this information to operate, secure and support the service.

A monthly release creates calendar drafts. It does not automatically publish them. Uploading an image to a draft keeps it behind portal access controls. When an authorized post begins delivery, a separate image copy becomes available through a public publishing URL so Meta can retrieve it. That publishing copy is not protected by portal sign-in. Meta handles received content under its own terms and privacy practices; published content is visible according to the destination account's settings.

You can revoke authorization through the relevant Meta account or business integration settings. To request staff-assisted disconnection or deletion of social connection information, drafts, images or publishing records, email [email protected]. Include your college, registered account email and the affected Page or Instagram account. Do not send passwords, tokens or student records. See our data-deletion instructions at /data-deletion.

Revoking a connection does not remove posts already published on Facebook or Instagram. Deleting a calendar draft does not retract a submitted post or its saved delivery record. A delivery already in progress or with an uncertain result needs to be checked before its outcome can be confirmed. Requests are limited to information you are authorized to manage. We explain any records retained for necessary security, recordkeeping or legal purposes, and any backup-retention limitations, when responding to a request.

We use information to provide services, respond to inquiries, manage customer relationships, authenticate accounts, deliver authorized resources, remember preferences and saved items, provide support and protect against misuse.

We also use information for analytics, advertising, campaign measurement, newsletters and other marketing communications, and related customer relationship management. These activities may involve our business systems and marketing providers outside the portal. Where required, we obtain consent or provide applicable choices before using information for these purposes.

Identity information received through Google or Microsoft sign-in is used for authentication, account administration and security, rather than advertising audiences or targeting. Service messages may include invitations, verification, password recovery and inquiry responses. Our current transactional email integration disables open and click tracking; other marketing tools may use their own measurement technologies.

We share information with providers that support hosting, website delivery, authentication, email, backup storage, analytics, advertising, customer relationship management and other business operations. Our website and portal infrastructure includes Hetzner, Cloudflare, Telnyx and, when selected for sign-in, Google or Microsoft. Providers process information for their services and may operate in other countries.

Analytics and advertising providers may receive browser identifiers, website activity and campaign information through cookies or similar technologies where enabled. This may constitute sharing or targeted advertising under applicable law. Contact us to exercise any applicable objection or opt-out rights.

Authorized team members and contractors may access information needed to support our customers. We may also disclose information when reasonably necessary to comply with law, protect rights or security, or support a business transfer. We do not make private portal documents publicly accessible through this policy.

The following limits apply to the uses and sharing of Google user data described elsewhere in this policy. We use Google sign-in information for authentication, account administration and security, and Google Ads information to provide the reporting features you authorize. We do not sell Google user data, use it for our own advertising or retargeting, or use it to train general-purpose AI models.

We limit transfers of Google user data to providing or improving the user-facing services you authorize, security purposes, compliance with applicable law, or a business transfer with the required prior consent. Human access is limited to your affirmative authorization for specific data, necessary security or legal purposes, or aggregated internal operations permitted by Google's policy. Our service providers and authorized personnel must follow these limits.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

Necessary cookies support sign-in, sessions and account security. Disabling them may prevent portal access. Sign-in sessions normally expire after seven days unless renewed. You can sign out, manage browser cookies and review connected identity providers through their account settings.

Analytics and advertising tools may use additional cookies or similar technologies where enabled. You can manage them through available site or provider controls and browser settings. Cookie settings do not remove records already held in our account or business systems. We honor choices and browser signals where required by applicable law.

Pages may embed YouTube or Vimeo content or link to other services. Those services may receive browser information and apply their own privacy practices. You can unsubscribe from marketing emails using the provided method or contact us at [email protected]. Account and service messages are handled separately from marketing preferences.

We retain information while needed for our services, customer relationships, legitimate business purposes, security, recordkeeping and legal obligations. The appropriate period depends on the information and its purpose. Account closure, session expiry or an expired verification link does not automatically remove all associated records. Backups are maintained separately and may retain information until the affected copies are retired. Our social publishing backups normally retain 30 days of verified copies and keep at least two verified recovery copies. Protected copies can remain longer when fresh recovery copies are unavailable. Other service backups may have different retention. We do not promise that an active-data deletion immediately removes every backup copy. Before recovering a service, staff must reapply recorded restrictions and approved deletions before it resumes processing.

Email [email protected] to request access, correction, account closure, deletion or any applicable restriction or opt-out. Our team handles these requests and may ask for information to verify your identity and authority. We will consider applicable legal requirements and explain any necessary limitations, including records that must be retained or isolated backup copies. You may also have rights to portability or appeal under applicable law; contact us to ask about exercising them.

We use safeguards appropriate to the service, including access controls, secure website connections and encrypted off-server backups where configured. No system can guarantee absolute security. The portal is intended for authorized college personnel and contractors, rather than for collecting student records or providing services directly to children.

We may update this policy as our services or practices change. The effective date identifies the current version. Where required, we provide additional notice or obtain consent for material changes. For questions or requests, contact College Crusader at [email protected].

Connecting Google Business Profile is optional and separate from Google sign-in and Google Ads. When an authorized business owner or manager connects a profile, we request basic Google identity information and permission to manage Business Profiles. We receive the account and location identifiers, names and address information needed to display and authorize the selected campus, along with authorization credentials. We do not receive your Google password.

We use this connection to find eligible locations and deliver the What's new posts you explicitly choose to schedule or publish. The initial Google channel supports a caption, one image and an optional Learn more link. It does not provide review management, profile editing or performance reporting. Although Google's permission covers additional management actions, the calendar uses it for the supported publishing functions.

The publishing service runs on our Postiz infrastructure. Credentials remain server-side. Authorized college members and assigned staff can prepare posts and see connection information and publishing records within their authorized workspace. We store drafts, selected destination identifiers, saved publication content, delivery status, errors and available public links to operate the service and resolve delivery issues.

Draft images stay behind portal access controls. When an authorized delivery begins, a publishing copy becomes available at a public URL so Google can retrieve it. Google processes received content under its terms and privacy practices. Published Business Profile posts may be visible publicly on Google Search and Maps.

You can revoke access in your Google Account's third-party connections settings. Contact [email protected] for staff-assisted disconnection or deletion of connection information, drafts, images or publication records. Include your college, registered account email and affected Business Profile; do not send passwords or tokens. Revoking access or deleting a calendar draft does not remove content already sent to Google. An in-progress or uncertain delivery needs to be checked before its outcome is confirmed. Retention, backup and identity-verification limitations in our privacy policy and data-deletion instructions also apply.