Privacy Policy

CoreAxis (“CoreAxis,” “we,” “us,” or “our”) provides software for collegiate athletic departments, including budgeting, expenses, revenue, personnel, scholarships, and compliance reporting. For Client Data that an institution uploads, that institution is the data controller (or “school official” under FERPA). CoreAxis is a service provider processing that data on the institution’s behalf.

Privacy questions: support@coreaxis.io.

We collect information in three categories:

• Account and contact information — names, work emails, role, organization, and authentication identifiers.
• Client Data you submit — budgets, expenses, invoices, revenue, personnel records, scholarship and student-athlete information the institution chooses to store, documents you upload, and related operational records.
• Usage and device information — log data, approximate location derived from IP address, browser type, and similar diagnostics needed to operate and secure the Services.

We use information to provide and host the Services; authenticate users; process imports and document extraction; send transactional email; provide support; monitor security and abuse; improve reliability and features (including in aggregated or de-identified form); and comply with law. We do not sell personal information, and we do not use Client Data to train public foundation models.

Scholarship and related modules may contain education records. We process those records only to provide the Services to the institution, as a school official / service provider under FERPA, or as required by law. The institution decides what student information to enter and who among its staff may access it. We do not use education records for marketing.

We use vetted processors who may handle information only to perform services for us:

• Google Cloud Platform and Firebase — hosting, authentication, database, storage, and application infrastructure.
• Google Vertex AI (Gemini) and Document AI — optional AI classification, narratives, and invoice/document parsing.
• DocuSign — electronic signature of scholarship and related agreements when that feature is enabled.
• Mailgun or equivalent email delivery — transactional messages such as invites and password resets.
• Cloud Tasks / Cloud Run — background job processing for imports and similar workloads.

If a customer connects Intuit QuickBooks Online, CoreAxis accesses the QuickBooks company data needed to sync accounting records the customer directs us to sync (typically customers, invoices, and payments). Access uses OAuth tokens stored securely and used only for that integration. We do not use QuickBooks data for advertising. You may disconnect QuickBooks in the product; Intuit’s own terms and privacy policy also apply to data in your QuickBooks company.

We share information with subprocessors as described above; with the institution that owns the tenant (administrators control user access); if required by law or to protect rights, safety, or security; and with a successor in a merger or acquisition, subject to this Policy. We do not sell personal information.

We retain account and Client Data for the life of the customer relationship and a reasonable period afterward so the institution can export data, unless a shorter or longer period is required by the MSA, a legal hold, or law. Backups cycle out on a rolling schedule. Usage logs are kept for a limited operations window.

We maintain administrative, technical, and physical safeguards appropriate to a multi-tenant SaaS product of our size, including access controls, encryption in transit, encryption at rest where commercially appropriate, tenant isolation in the data model, and monitoring. No method of transmission or storage is completely secure.

If you are a California resident, you may have the right to know, access, correct, or delete personal information, and to opt out of “sale” or “sharing” as those terms are defined under the CCPA/CPRA. CoreAxis does not sell personal information. Because most platform data is processed for your institution, many requests must be made through that institution so we do not disclose another organization’s records in error. You may also email us at the address below. We will not discriminate against you for exercising these rights.

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 for our own purposes. Student-athlete information in the product is entered by the institution in its educational capacity.

We host the Services in the United States (Google Cloud). If you access the Services from elsewhere, you understand that information is processed in the United States.

We use cookies and similar technologies as described in our Cookie Notice. We currently use them to run the site and keep you signed in, not for advertising.

We may update this Policy by posting a new version with a revised effective date. Material changes will be highlighted in the product or by email where practical.

Privacy requests: support@coreaxis.io. CoreAxis, California, United States.