HackSprint

01Who we are#

HackSprint is the data controller for personal data processed on the Platform for your own account. Where you take part in a hackathon run by an organization, that organization is the controller for the data generated inside its event, and we act as its processor.

Reach our privacy team through the contact form by selecting the privacy topic.

02What we collect#

CategoryExamples

AccountName, email, sign-in credential or provider identifier, country, timezone

ProfileHandle, avatar, bio, skills, links, and any employment or education history you add

CompetitionRegistrations, submissions, source code, scores, ranks, badges, and rating

WorkspaceSession state, files you save, run and test output, prompts you send the AI agent

ProctoringCamera and screen activity, focus and tab events, identity-match results, only for proctored sessions you consented to

HiringApplications, interview transcripts and scores, offers, and recruiter notes about you

BillingPlan, billing contact, and invoices. Card details are held by our payment provider, not by us

TechnicalIP address, device and browser, pages viewed, timestamps, and error diagnostics

We do not ask for special-category data. Camera activity captured during proctoring may allow inference of biometric characteristics, so we treat it as special-category data and process it only on your explicit consent, as described in section 05.

03Signing in with a provider#

You can sign in with a third-party developer account instead of a password. When you do, that provider asks you to approve the connection and then sends us a limited set of fields.

·We receive only what identifies your account: a stable provider identifier, your email address, your username or display name, and your avatar image.

·We never receive your password with that provider, and we do not request access to your private repositories, mail, files, or contacts.

·We ask for the narrowest permissions that allow sign-in to work, and we never post or act as you.

·We store the provider identifier so we recognise you on return, plus an access credential where a feature you switched on needs it. Those credentials are encrypted and are not written to logs.

·Disconnecting a provider in your settings deletes the stored credential. If it is your only sign-in method, set a password first.

·Revoking access at the provider also ends the connection. Your HackSprint account and its data remain until you delete them.

Legal basis

Using a sign-in provider is necessary to perform our contract with you when it is the method you chose, under Art. 6(1)(b) GDPR. Any optional permission beyond sign-in rests on your consent, which you withdraw by disconnecting the provider.

04Why we use it#

·Run your account, workspaces, and hackathon entries, and show your results.

·Grade submissions and compute leaderboards, ratings, and badges.

·Give organizers the review and integrity tooling their events need.

·Operate the job portal, covering matching, applications, interviews, and offers.

·Keep the Platform secure, prevent cheating and fraud, and diagnose faults.

·Send service messages, and product email you can unsubscribe from.

·Produce aggregate statistics, which carry no identifiers.

We do not sell personal data, and we do not use your source code to train our own models.

05Proctoring data#

·Nothing is captured until you accept the consent dialog for that specific session, which lists every signal that will be monitored.

·Declining blocks only that proctored challenge. It never affects your account or other events.

·Evidence is visible to the organizer and reviewers of that event, and every view is written to an audit log.

·Retention is set per event, and evidence is deleted automatically once that window ends.

·Signals are indicators for human review, never an automated decision on their own. You can contest a flagged session by contacting us or the organizer.

·You can withdraw consent for future sessions at any time. That does not undo processing already carried out lawfully.

06Sharing and processors#

We share personal data only as needed to run the Platform:

·Organizers of events you enter receive your submissions, scores, and proctoring evidence for that event.

·Employers you apply to receive your application, profile, and interview results, and only after you apply.

·Service providers under written contract handle hosting and storage, email delivery, payments, and error diagnostics. A current list is available on request.

·Authorities receive data where a valid legal request compels it, and we notify you unless we are prohibited from doing so.

·An acquirer may receive data in a merger or sale, under the protections of this policy.

07International transfers#

We and our service providers operate across more than one country, so your data may be processed outside the country you live in. Transfers out of the EEA, UK, or Switzerland are covered by the European Commission’s Standard Contractual Clauses, with the UK Addendum where relevant, together with a transfer risk assessment and technical safeguards including encryption. Copies of the mechanism we rely on are available through the contact form.

08How long we keep it#

DataRetention

Account and profileWhile your account is open, then a short deletion window

Submissions, scores, leaderboard resultsWhile your account is open. Published results may persist in anonymised form

Workspace files and run outputA limited period after the event ends

Proctoring evidenceThe retention window set for that event

Interview transcripts and scoresPer the employer’s own retention policy

Billing and tax recordsAs long as tax law requires

Server and security logsA short rolling window

Exact periods for your account and for a specific event are available on request.

09Your rights#

Under the GDPR and UK GDPR you can request access, correction, deletion, restriction, and portability, and you can object to processing based on legitimate interests. Where processing rests on consent, you can withdraw it at any time.

·Self-serve: export your data and delete your account from Settings, then Privacy.

·Or send a request through the contact form. We respond within 30 days and tell you if we need longer.

·You will not be charged or treated differently for exercising a right.

·You can complain to your local supervisory authority.

Requests

Send a rights request through the contact form and select the privacy topic. We may ask you to verify your identity before acting.

10Cookies#

Strictly necessary cookies keep you signed in and protect the session, and they run without consent. Analytics and preference cookies load only after you accept them in the cookie banner, and you can change that choice at any time from the banner link.

11Children#

The Platform is not for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will delete it.

12Changes and contact#

We post updates here with a new last-updated date, and we email you before material changes take effect. For anything about this policy, use the contact form and select the privacy topic.