Privacy Policy

1. Who We Are

GirlScript Foundation ("we", "us", "our") is the data controller for personal information collected during GSSoC 2026. GirlScript Foundation is a registered non-profit organisation operating under Indian law.

The Program's technology platform is operated by Smartly Ventures, which acts as a data processor under a formal Data Processing Agreement with GirlScript Foundation. Smartly Ventures processes personal data only on GirlScript Foundation's instructions and in accordance with this Privacy Policy.

For privacy enquiries: gssoc@girlscript.org

2. Data We Collect

Information you provide directly

• Full name and email address
• Date of birth
• City, country, and educational institution
• Graduation year and current role or title
• GitHub profile URL
• LinkedIn profile URL
• Discord username
• Professional biography
• Application responses (free-text answers, URLs, selection choices)

Information collected automatically

• Application submission timestamp (for processing and fraud detection)
• IP address at time of account creation (for fraud detection; not stored long-term)
• GitHub contribution data fetched from the public GitHub API (public repositories only) for leaderboard scoring and profile display

3. How We Use Your Data

• Program administration: Reviewing applications, communicating decisions, coordinating accepted participants, and managing role assignments
• Public leaderboard and profiles: Displaying participant names, roles, scores, and public social links on the leaderboard and profile pages (accepted participants only)
• Email communications: Sending application confirmations, status updates, program announcements, and certificates
• Certificate generation: Creating and distributing digital certificates of participation and achievement
• Fraud prevention: Detecting duplicate accounts, coordinated manipulation, and other forms of program abuse
• Program improvement: Aggregated, anonymised analytics to improve future editions of the program

4. Data Sharing

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Smartly Ventures: Platform infrastructure and technology partner, bound by a formal Data Processing Agreement
• Project Admins and Mentors: Limited profile information relevant to their role — names, GitHub URLs, Discord handles — for coordination purposes
• Technology service providers: Email delivery (Resend), authentication and database (Supabase) — all bound by data processing agreements that restrict use to service delivery only
• Legal requirements: Where disclosure is required by applicable law, court order, or regulatory authority

5. Public Profile

Accepted participants have a public profile page accessible at /profile/[id]. This page displays your name, city and country, educational institution, biography, approved roles, GitHub URL, and LinkedIn URL. GitHub contribution data displayed on your profile is sourced from the public GitHub API and reflects only public repository activity.

Your public profile becomes available when your application status is set to Accepted. You may request removal of your public profile at any time by emailing gssoc@girlscript.org. Profile removal does not affect your participation status or leaderboard score.

6. Data Retention

We retain your application data, profile information, and contribution records for three years following the conclusion of the program season in which you participated. This period supports certificate verification requests, compliance with legal obligations, and program continuity.

After this retention period, personal data is either securely deleted or anonymised such that it can no longer be attributed to you as an individual. Anonymised aggregate data may be retained indefinitely for statistical purposes.

7. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your personal data, subject to legal retention requirements
• Objection: Object to the processing of your personal data in certain circumstances
• Portability: Request your personal data in a structured, machine-readable format
• Withdrawal of Consent: Where processing is based on consent, withdraw that consent at any time

To exercise any of these rights, email gssoc@girlscript.org. We will respond within 30 days. We may need to verify your identity before processing certain requests.

8. Security

We implement industry-standard technical and organisational measures to protect your personal data, including: TLS encryption for all data in transit, encrypted database storage at rest, strict role-based access controls limiting data access to authorised personnel only, and regular security review of our platform partner Smartly Ventures.

No system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected individuals within 72 hours of becoming aware of the breach, in accordance with applicable law.

9. Cookies

We use only essential cookies necessary for the platform to function: authentication session cookies that keep you logged in while using the application portal. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

You may disable cookies in your browser settings, but doing so will prevent you from logging in to the application portal.

For questions about this Privacy Policy, contact us at gssoc@girlscript.org.