Last updated August 23, 2026

MSC Central Privacy Notice

This Privacy Notice explains how personal information is handled when you use the MSC Central mobile application, web experience, and related services (collectively, “MSC Central”).

1. Provider

MSC Central is offered by Murray State College and is operated in part using StudentSquad technology provided by Colabrador, Inc.

In this notice, “Provider” means Murray State College and Colabrador, Inc. collectively. References to “we,” “us,” and “our” mean Provider.

2. Scope

This notice applies to personal information processed through MSC Central. It does not replace separate institutional notices concerning education records, admissions, employment, financial aid, health programs, or other institutional systems, and it does not govern independent websites or services that merely link from MSC Central.

If you use the same account or the StudentSquad-supported platform with another participating organization, that organization’s applicable privacy notice may also apply to information processed in that organizational context.

3. Information collected

Information you provide

• Account and contact information: name, email address, username, account identifier, profile information, and authentication or recovery information.
• Institutional affiliation: information used to confirm your relationship with a participating organization, such as an approved email domain, role, organization, or identity-provider assertion.
• User Content: messages, comments, chat activity, files, images, links, profile content, submissions, feedback, and other material you choose to provide.
• Reports and support information: content reports, blocked-user selections, complaint details, correspondence, troubleshooting information, and support requests.
• Activities and rewards: participation, completion or verification information, points, reward selections, redemptions, and misuse-prevention information.

Information provided or confirmed by participating organizations

A participating organization may provide or confirm information needed to configure MSC Central, authenticate or authorize users, administer organization-specific content and activities, respond to reports, or apply its policies. Depending on the enabled sign-in method, an identity provider may send an identifier, name, email address, role, or other approved authentication attributes.

Information collected automatically

• Device and connection information: IP address, device type, operating system, app and browser version, language, time zone, identifiers used for authentication or notifications, and network or diagnostic information.
• Usage and analytics information: screens viewed, features used, interactions, timestamps, navigation, performance, crashes, errors, and related events.
• Location information: precise or approximate device location only when an enabled feature requires it, you grant the applicable device permission, and the location is used for the disclosed feature, such as verifying proximity to an activity.
• Cookie and similar technology information: authentication state, preferences, security signals, and web analytics described in the MSC Central Cookie Policy.

4. How information is used

Provider may use personal information to:

• create and manage accounts and provide authentication, authorization, hosting, storage, communications, notifications, and application functionality;
• confirm eligibility or affiliation and provide access to participating organizations and communities;
• publish and display institutional content, resources, opportunities, and communications;
• display, transmit, store, and otherwise provide User Content and user-to-user features;
• configure and administer activities, points, rewards, verification, reporting, blocking, and administrative tools;
• establish and enforce community standards, applicable policies, and access or moderation decisions;
• review reports, respond to concerns, conduct moderation, and support institutional or disciplinary processes;
• provide support, diagnose errors, maintain availability, and improve accessibility, features, and performance;
• detect, investigate, prevent, and respond to fraud, misuse, security threats, and technical incidents; and
• comply with legal, records, safety, and institutional obligations and valid legal process.

Provider may create and use information that has been de-identified and aggregated so that it does not identify you or another individual for analytics, benchmarking, security, research, and product development and improvement.

5. Technology vendors and subprocessors

Provider may use vendors and subprocessors for cloud hosting, authentication, storage, analytics, communications, support, security, and other technical functions needed to provide MSC Central. They are required to protect the information they handle consistently with this notice, their contractual obligations, and applicable law.

Provider does not authorize those vendors or subprocessors to use identifiable MSC Central information for unrelated advertising or independent marketing.

6. When information is disclosed

Information may be disclosed in the following circumstances:

• Technology vendors and subprocessors: to providers of cloud hosting, authentication, storage, analytics, communications, security, support, and similar functions needed to supply MSC Central.
• Participating organizations: when you choose or are authorized to participate in an organizational context, information associated with your account, membership, activity, reports, or content in that context may be accessible to the participating organization.
• Other users: when you post content to a group, conversation, profile, or other area visible to those users.
• At your direction: when you intentionally use a feature that sends information to a person or service you select.
• Safety, security, and legal process: when reasonably necessary to protect users or the public, enforce applicable terms or policies, investigate misuse, comply with law, or respond to valid legal process.
• Organizational transactions: in connection with a lawful merger, acquisition, financing, reorganization, or transfer of the relevant services, subject to applicable notice and protection requirements.

Provider does not sell personal information or use it for cross-context behavioral advertising. Provider does not use identifiable MSC Central information to advertise unrelated products or build advertising profiles across participating organizations.

7. Education records and sensitive information

MSC Central is designed to operate without requiring grades, transcripts, financial-aid records, disciplinary records, or similar education records. Do not use free-form fields or uploads to submit education records, protected health information, financial account details, government identification numbers, or other highly sensitive information unless Provider has expressly instructed you that the feature is approved for that purpose.

If information processed through MSC Central is an education record or is otherwise subject to an institutional privacy requirement, Provider handles it only for authorized institutional purposes and subject to applicable law, agreements, and separate institutional notices.

8. Retention

Provider retains personal information for as long as reasonably necessary to provide MSC Central, maintain an authorized account, fulfill the purposes described in this notice, comply with applicable records requirements, resolve disputes, enforce agreements, protect security, and meet legal obligations.

After the applicable retention period, information may be deleted or de-identified. Deletion from active systems may not immediately remove information from routine backups, security records, legal holds, or copies retained where required by law. Information remaining in those systems continues to be protected until deleted or de-identified through the applicable cycle.

9. Security

Provider uses commercially reasonable administrative, technical, and organizational safeguards designed to protect information processed through MSC Central. No system can guarantee absolute security.

If you believe your account or information has been compromised, contact [email protected] promptly.

10. Your choices and requests

• You may review or update available profile information through MSC Central.
• You may control optional device permissions through your device settings. Disabling a permission may disable the feature that requires it.
• You may manage available notification preferences through MSC Central or your device settings.
• You may use in-app account-deletion controls or contact Provider for assistance with an account-deletion request.
• You may use the applicable organization’s established channels for organization-controlled records, eligibility, moderation, policy, or appeal matters.

Deletion of an MSC Central account does not necessarily delete records retained outside MSC Central by a participating organization or under applicable law.

11. Privacy rights

Depending on where you live and the nature of the information, you may have rights to request access, correction, deletion, portability, restriction, or information about processing. These rights may be subject to identity verification, statutory exceptions, institutional or legal obligations, and other applicable limitations.

To exercise a privacy right or request routing assistance, contact Provider at [email protected].

12. Children

MSC Central is intended for an authorized postsecondary or institutional community and is not directed to children under 13. Provider will not knowingly invite or authorize a child under 13 to use MSC Central. If you believe a child under 13 has provided personal information, contact Provider using the contact below.

Provider may determine whether users under 18 may participate and whether any parent, guardian, student, or institutional notice or consent is required.

13. Processing locations

MSC Central is offered in the United States. Provider uses commercially reasonable efforts to store production institution data at rest in United States locations. Personnel, vendors, and subprocessors may access or process information from other locations as reasonably necessary to operate, secure, support, and maintain the service, subject to applicable protections.

14. Updates to this notice

This notice may be updated to reflect changes in MSC Central, applicable law, or data practices. Material changes will be identified by a new effective date and presented through appropriate public or in-app notice. A published revision will not be changed retroactively under the same version.

15. Contact

For questions, concerns, or privacy requests, contact Provider at [email protected].